PT-2026-26007 · Toybox+2 · Toybox+2
Jisung
·
Published
2026-02-24
·
Updated
2026-03-19
·
CVE-2026-22175
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.2.23
Description
OpenClaw contains a flaw in allowlist mode where 'allow-always' grants can be bypassed through unrecognized multiplexer shell wrappers, such as
busybox sh -c and toybox sh -c commands. This allows attackers to invoke arbitrary payloads under the same multiplexer wrapper, satisfying stored allowlist rules and circumventing intended execution restrictions. The issue arises because wrapper analysis incorrectly treated invocations of busybox and toybox as non-wrapper commands, persisting the wrapper binary path instead of the inner executable. This allowed subsequent arbitrary payloads to satisfy the stored allowlist rule. The fix improves wrapper detection and persistence behavior, ensuring approvals bind to the intended inner executables and fail closed when unwrap safety is uncertain.Recommendations
Update OpenClaw to version 2026.2.23 or later.
Fix
Incomplete List of Disallowed Inputs
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openclaw
Busybox
Toybox