CVE-2026-53822 Details

A command injection vulnerability has been identified in OpenClaw versions prior to 2026.5.18. This vulnerability arises from a time-of-check time-of-use race condition, where the shell wrapper arguments can be altered between the approval stage and execution. As a result, attackers may manipulate command arguments after they have been approved against a allowlist, potentially executing unapproved command shapes and bypassing security controls.

Users are advised to update to OpenClaw version 2026.5.18 or later. It is also recommended to require explicit approval for shell wrappers and to avoid durable allowlists for commands that heavily use wrappers until the patch has been applied. As a general hardening measure, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.