CVE-2026-29608: Openclaw RCE Vulnerability

CVE-2026-29608 Overview

CVE-2026-29608 is an approval integrity vulnerability in OpenClaw 2026.3.1 affecting the system.run node-host execution component. The vulnerability allows attackers to bypass operator approval mechanisms through argv rewriting, which changes command semantics. By placing malicious local scripts in the working directory, attackers can execute unintended code even when the operator has approved different command text.

Critical Impact

Attackers can execute arbitrary code by manipulating the argument vector after operator approval, undermining the trust model of the system.run approval workflow.

Affected Products

• OpenClaw 2026.3.1 for Node.js
• OpenClaw node-host execution module (system.run)
• Systems using OpenClaw with operator approval workflows

Discovery Timeline

• 2026-03-19 - CVE CVE-2026-29608 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-29608

Vulnerability Analysis

This approval integrity bypass vulnerability (CWE-88: Improper Neutralization of Argument Delimiters in a Command) occurs in the system.run node-host execution path. The core issue stems from how the argv array is processed after operator approval. When an operator reviews and approves a command for execution, the approval is bound to the displayed command text. However, the actual argv array can be rewritten after approval, allowing attackers to substitute malicious scripts that execute with the authority granted by the original approval.

The vulnerability particularly impacts environments where the working directory contains attacker-controlled files. An attacker can place a malicious script with the same name as an approved command in the current working directory, causing the execution engine to resolve and run the attacker's script instead of the intended system command.

Root Cause

The root cause lies in the failure to preserve approval semantics when processing the system.run wrapper. The original implementation did not properly bind the shell command context to the approval verification, allowing argv manipulation to occur between the approval check and actual command execution. The hardenApprovedExecutionPaths function lacked visibility into the original shellCommand parameter, creating a gap where command semantics could diverge from what was approved.

Attack Vector

The attack requires local access and user interaction (operator approval). An attacker with local access to the system can:

1. Place a malicious script in the working directory with a name matching a commonly approved command
2. Trigger a system.run execution that passes operator approval for the legitimate command
3. Exploit the argv rewriting vulnerability to execute the malicious local script instead
4. Gain code execution with the privileges of the approved operation

The following patches from the security fix demonstrate how the vulnerability was addressed:

 export function hardenApprovedExecutionPaths(params: {
   approvedByAsk: boolean;
   argv: string[];
+  shellCommand: string | null;
   cwd: string | undefined;
 }): { ok: true; argv: string[]; cwd: string | undefined } | { ok: false; message: string } {
   if (!params.approvedByAsk) {

Source: GitHub Commit

The fix introduces the shellCommand parameter to the hardenApprovedExecutionPaths function, ensuring the original shell command context is preserved during approval verification:

   const hardenedPaths = hardenApprovedExecutionPaths({
     approvedByAsk: policy.approvedByAsk,
     argv: parsed.argv,
+    shellCommand: parsed.shellCommand,
     cwd: parsed.cwd,
   });
   if (!hardenedPaths.ok) {

Source: GitHub Commit

Detection Methods for CVE-2026-29608

Indicators of Compromise

• Unexpected script executions from working directories following system.run approvals
• Mismatch between approved command text in logs and actual executed binaries
• Presence of suspicious scripts in working directories with names matching common system commands
• Anomalous process spawning patterns where approved commands result in different child processes

Detection Strategies

• Monitor system.run invocations and compare approved command text against actual executed paths
• Implement file integrity monitoring on working directories used by OpenClaw
• Log and alert on discrepancies between approval requests and execution outcomes
• Audit local script files in directories where OpenClaw operates

Monitoring Recommendations

• Enable detailed logging for the node-host execution module to capture argv transformations
• Implement runtime monitoring for process execution patterns in OpenClaw environments
• Set up alerts for new executable files appearing in OpenClaw working directories
• Monitor for shell command execution anomalies following approval workflows

How to Mitigate CVE-2026-29608

Immediate Actions Required

• Update OpenClaw to a patched version that includes commit dded569626b0d8e7bdab10b5e7528b6caf73a0f1
• Audit working directories for suspicious scripts that may have been staged for exploitation
• Review recent system.run execution logs for potential compromise indicators
• Restrict write access to OpenClaw working directories where possible

Patch Information

The vulnerability has been addressed in commit dded569626b0d8e7bdab10b5e7528b6caf73a0f1. The fix modifies the hardenApprovedExecutionPaths function in src/node-host/invoke-system-run-plan.ts and src/node-host/invoke-system-run.ts to include the shellCommand parameter, ensuring approval semantics are preserved throughout the execution flow. Organizations should apply this patch immediately or upgrade to a version containing this fix. Refer to the GitHub Security Advisory for detailed guidance.

Workarounds

• Restrict working directory permissions to prevent attackers from placing malicious scripts
• Implement strict PATH controls to ensure only absolute paths are used in approved commands
• Use directory whitelisting for system.run operations to limit execution contexts
• Consider disabling the system.run functionality until the patch can be applied in high-security environments

# Configuration example - Restrict working directory permissions
chmod 755 /path/to/openclaw/workdir
chown root:root /path/to/openclaw/workdir

# Remove write access for non-privileged users
chmod o-w /path/to/openclaw/workdir

# Audit for suspicious scripts in working directories
find /path/to/openclaw/workdir -type f -executable -mtime -7 -ls