CVE-2026-53822: OpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Execution

Synopsis

This is a command injection vulnerability in OpenClaw, a shell wrapper tool, affecting all versions before 2026.5.18. An authenticated attacker can reach the vulnerable endpoint over the network and manipulate command arguments in the window between allowlist approval and actual execution, causing the wrapper to run a different command shape than the one that was approved. Successful exploitation lets the attacker execute arbitrary unapproved commands, bypassing the allowlist security control entirely. A patched-image rebuild at version 2026.5.18 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OpenClaw service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is assumed.

• AuthenticationRequired

  A low-privilege account is sufficient; the vector specifies PR:L, so no admin credentials are needed, but the attacker must be authenticated.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the race window between approval and execution without involving another party.

• Attack complexityDetail

  Attack complexity is rated Low (AC:L), meaning the exploit is reliable and does not depend on race-condition timing luck or specific memory layout; the approval-to-execution window is consistently exploitable.

Blast Radius

• The attacker executes arbitrary shell commands outside the approved allowlist, gaining the same OS-level privileges as the OpenClaw wrapper process.
• Confidential data accessible to that process, such as environment variables, secrets, and files on the host, can be read and exfiltrated.
• The attacker can modify files, configuration, or state that the wrapper process has write access to, corrupting application data or injecting malicious payloads.
• The wrapper process can be used to crash or destabilize services that depend on it, causing availability loss for workloads relying on OpenClaw for command orchestration.