7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26325

CVE-2026-26325: OpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, a mismatch between rawCommand and command[] in the node host system.run handler could cause allowlist/approval evaluation to be performed on one command while executing a different argv. This only impacts deployments that use the node host / companion node execution path (system.run on a node), enable allowlist-based exec policy (security=allowlist) with approval prompting driven by allowlist misses (for example ask=on-miss), allow an attacker to invoke system.run. Default/non-node configurations are not affected. Version 2026.2.14 enforces rawCommand/command[] consistency (gateway fail-fast + node host validation).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26325

CVE-2026-26325:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.14	2026.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-h3f9-mjwj-w476, is an access control bypass in OpenClaw's node host 'system.run' functionality. The root cause is a discrepancy in how the system handles two parameters for command execution: 'rawCommand' and 'command' (which becomes the argv array). The system would perform security policy checks (e.g., allowlist validation) against the 'rawCommand' string, but the actual command passed to the system for execution was the 'command' array. An attacker could exploit this by providing a benign, allowlisted command in 'rawCommand' to satisfy the security check, while simultaneously providing a different, malicious command in the 'command' parameter, which would then be executed, bypassing the intended security policy.

The analysis of the patch commit 'cb3290fca32593956638f161d9776266b90ab891' reveals two key functions that were modified to address this flaw:

handleInvoke in src/node-host/invoke.ts: This is the core function on the node host that executes the command. The patch introduces a call to a new validateSystemRunCommandConsistency function, which ensures that the command derived from the command array matches the rawCommand string. If they are inconsistent, the request is rejected. This directly remediates the execution vulnerability.
sanitizeSystemRunParamsForForwarding in src/gateway/node-invoke-system-run-approval.ts: This function acts as a gateway-level pre-check. The patch adds the same consistency validation here. This provides a defense-in-depth, fail-fast mechanism that rejects a malicious request before it even reaches the node host for execution.

Both functions were vulnerable because they lacked this critical consistency check. During an exploit, both sanitizeSystemRunParamsForForwarding and handleInvoke would appear in a runtime profile as they process the malicious node.invoke call.

Vulnerable functions

handleInvoke

src/node-host/invoke.ts

This function is the primary handler for the 'system.run' command on the node host. The vulnerability lies in the fact that it performed security allowlist checks on the 'rawCommand' parameter, but the actual command executed was derived from the 'command' parameter (argv). This allowed an attacker to supply an allowlisted command in 'rawCommand' to bypass validation, while a separate, malicious command was provided in 'command' for execution. The patch rectifies this by enforcing consistency between the two parameters before any checks or execution occur.

sanitizeSystemRunParamsForForwarding

src/gateway/node-invoke-system-run-approval.ts

This function operates on the gateway, preparing and sanitizing parameters for the 'system.run' command before they are forwarded to the node host. It was vulnerable because it lacked a check to ensure the 'rawCommand' and 'command' parameters were consistent. This omission allowed a request with mismatched, malicious parameters to be passed through the gateway to the vulnerable 'handleInvoke' function on the node. The patch adds a fail-fast validation step to reject such inconsistent requests at the gateway level.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.