Loading vulnerability…
Allowlist Bypass in OpenClaw Shell Inline-Command Parsing
CVE-2026-53866 affects OpenClaw versions before 2026.5.12. The vulnerability is an allowlist bypass in shell inline-command parsing. A command request using shell inline-command forms can be routed through a parser case that does not perform the expected allowlist decision, allowing shell content to execute without the intended approval prompt. The issue requires an authenticated operator and is described as remotely exploitable over the network. In practical terms, the flaw causes OpenClaw to mishandle certain inline shell command forms so that command execution policy enforcement is skipped on the vulnerable parser path.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated operator to bypass intended command approval and allowlist enforcement and execute unapproved shell commands. Because the published scoring indicates high impact to confidentiality, integrity, and availability, exploitation could enable unauthorized access to sensitive data reachable by the OpenClaw process, unauthorized modification of system or application state, and disruption of service or workflows through arbitrary command execution within the privileges and environment available to the affected component.
If you can’t patch tonight, do this now.
Until patched versions are deployed, restrict or disable shell inline-command forms where possible, require explicit approval for shell inline-command use, keep channel and tool allowlists narrow, avoid sharing a single Gateway between mutually untrusted users, limit operator access to trusted users only, disable the affected feature if it is not needed, and monitor for suspicious or unauthorized command execution attempts.
Patch, then assume compromise.
Upgrade OpenClaw to version 2026.5.12 or later; this is identified as the first stable patched version. Also review and enforce command execution policies after upgrading to ensure shell inline-command handling is subject to the intended approval and allowlist controls. Where applicable, follow the authoritative replacement advisory GHSA-f397-5vjw-v2c2.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.