Authorization Bypass Vulnerability in OpenClaw Windows Node

CVE-2026-101880

What is CVE-2026-101880?

The OpenClaw Windows Node, prior to version 2026.7.1, displays a security flaw in its exec-approval policy. Specifically, the ExecShellWrapperParser does not handle command inputs correctly, allowing connected gateways or agents to circumvent approval rules. This is achieved by placing prohibited commands alongside permitted prefixes, employing pipe operators or command substitution syntax, which could potentially lead to arbitrary command execution on Windows hosts.

References