CVE-2026-42423 Overview
OpenClaw before version 2026.4.8 contains a critical authorization bypass vulnerability in its approval-timeout fallback mechanism. The flaw allows attackers to circumvent strictInlineEval explicit-approval requirements on gateway and node exec hosts. By exploiting the timeout fallback behavior, malicious actors can execute inline eval commands that should require explicit user approval, effectively bypassing the intended security boundary designed to prevent unauthorized code execution.
Critical Impact
Attackers can bypass explicit approval requirements and execute arbitrary inline eval commands on affected OpenClaw gateway and node exec hosts, compromising the security boundary between trusted and untrusted code execution contexts.
Affected Products
- OpenClaw versions prior to 2026.4.8
- OpenClaw Node.js deployments with strictInlineEval enabled
- OpenClaw gateway and node exec host configurations
Discovery Timeline
- 2026-04-28 - CVE-2026-42423 published to NVD
- 2026-04-30 - Last updated in NVD database
Technical Details for CVE-2026-42423
Vulnerability Analysis
This vulnerability is classified under CWE-636 (Not Failing Securely), which describes scenarios where a security mechanism fails to its least secure state rather than maintaining protection. In the case of OpenClaw, the strictInlineEval feature is designed to require explicit user approval before executing potentially dangerous inline eval commands. However, when an approval timeout occurs, the fallback mechanism incorrectly defaults to allowing the operation rather than denying it.
The attack requires network access and low privileges to initiate, but relies on the presence of certain conditions (such as triggering or waiting for an approval timeout) to successfully exploit. Once exploited, attackers gain the ability to execute code with high impact to confidentiality, integrity, and availability of the affected system.
Root Cause
The root cause lies in the insecure fallback design of the approval-timeout mechanism. When explicit approval for inline eval commands is not received within the configured timeout window, the system incorrectly interprets this as implicit approval rather than denial. This "fail-open" behavior contradicts security best practices, which mandate that security controls should "fail-closed" to maintain protection when uncertain states occur.
Attack Vector
The attack exploits the network-accessible approval workflow on OpenClaw gateway and node exec hosts. An attacker with low-level privileges can:
- Submit an inline eval command that triggers the strictInlineEval approval workflow
- Manipulate or wait for conditions that cause the approval request to timeout
- Leverage the insecure fallback to gain unauthorized execution of the eval command
- Execute arbitrary code within the context of the OpenClaw runtime environment
The security patch addresses this by restructuring the DNS pinning and dispatcher logic to ensure proper security boundary enforcement before trusted environment proxy dispatch:
try {
assertExplicitProxySupportsPinnedDns(parsedUrl, params.dispatcherPolicy, params.pinDns);
await assertExplicitProxyAllowed(params.dispatcherPolicy, params.lookupFn, params.policy);
- const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
- lookupFn: params.lookupFn,
- policy: params.policy,
- });
const canUseTrustedEnvProxy =
mode === GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY && hasProxyEnvConfigured();
if (canUseTrustedEnvProxy) {
dispatcher = createHttp1EnvHttpProxyAgent();
} else if (params.pinDns === false) {
dispatcher = createPolicyDispatcherWithoutPinnedDns(params.dispatcherPolicy);
} else {
+ const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+ lookupFn: params.lookupFn,
+ policy: params.policy,
+ });
dispatcher = createPinnedDispatcher(pinned, params.dispatcherPolicy, params.policy);
}
Source: GitHub Commit d7c3210
Detection Methods for CVE-2026-42423
Indicators of Compromise
- Unexpected inline eval command executions in OpenClaw logs without corresponding approval records
- Approval timeout events followed immediately by successful command execution
- Anomalous command patterns originating from low-privileged accounts on gateway or node exec hosts
Detection Strategies
- Monitor OpenClaw audit logs for approval timeout events correlated with subsequent command execution
- Implement alerting on inline eval executions that lack matching explicit approval records
- Deploy network monitoring to detect unusual patterns of approval request timing manipulation
Monitoring Recommendations
- Enable verbose logging for the strictInlineEval approval workflow to capture all timeout events
- Establish baseline metrics for normal approval request timing and alert on statistical anomalies
- Review gateway and node exec host logs regularly for patterns consistent with timeout-based bypass attempts
How to Mitigate CVE-2026-42423
Immediate Actions Required
- Upgrade OpenClaw to version 2026.4.8 or later immediately
- Audit recent inline eval execution logs for evidence of unauthorized command execution
- Review and restrict network access to OpenClaw gateway and node exec hosts to minimize attack surface
Patch Information
OpenClaw has released a security patch in version 2026.4.8 that addresses this vulnerability. The fix modifies the approval-timeout fallback behavior to fail securely by denying operations when explicit approval is not received. Organizations should apply this update as the primary remediation measure. For detailed patch information, refer to the GitHub Security Advisory GHSA-q2gc-xjqw-qp89 and the commit d7c3210.
Workarounds
- Disable the strictInlineEval feature entirely and implement alternative authorization controls if immediate patching is not possible
- Implement network segmentation to restrict access to OpenClaw gateway and node exec hosts
- Configure extended approval timeouts to reduce the likelihood of timeout-based bypass while patch deployment is planned
# Configuration example - Extend approval timeout as temporary mitigation
# Note: This is a workaround only; patching to 2026.4.8+ is the recommended fix
export OPENCLAW_APPROVAL_TIMEOUT=300 # Increase timeout to 5 minutes
export OPENCLAW_STRICT_INLINE_EVAL=true
export OPENCLAW_FAIL_CLOSED=true # If supported in your version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
