OpenClaw < 2026.2.14 - 通过节点调用审批绕过实现远程代码执行

攻击者利用此漏洞可以执行任意命令，从而完全控制受影响的系统。由于 OpenClaw 通常用于连接开发人员工作站和 CI 运行器，因此该漏洞可能导致敏感数据泄露、恶意软件部署以及对整个开发流程的破坏。攻击者需要有效的网关凭据才能利用此漏洞。如果攻击者能够获取这些凭据，他们可以注入审批控制字段，从而执行任意代码，并可能在连接的节点主机上获得持久存在性。

Development teams using OpenClaw, particularly those with CI/CD pipelines, are at significant risk. Organizations relying on OpenClaw to manage access to sensitive developer workstations and infrastructure are also vulnerable. Shared hosting environments where OpenClaw is deployed could expose multiple users to the risk of compromise.

• linux / server: Monitor OpenClaw logs for unusual node.invoke requests containing suspicious approval control fields. Use journalctl -u openclaw to filter for relevant events.

journalctl -u openclaw | grep 'approval control field'

• generic web: Examine OpenClaw API request logs for patterns indicative of approval field manipulation. Look for requests with unusually long or complex node.invoke parameters. • other: Review OpenClaw configuration files for any misconfigured approval gating settings that could inadvertently weaken security controls.

1. 2026-03-05Disclosure

   disclosure

1. 已保留2026-02-27
2. 发布日期2026-03-05
3. 修改日期2026-03-09
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即将 OpenClaw 升级到 2026.2.14 或更高版本。如果升级会导致中断，请考虑暂时禁用 system.run 命令，或限制允许执行的命令。此外，审查并强化网关凭据，确保它们使用强密码并定期轮换。监控 OpenClaw 日志，查找任何异常活动，例如未经授权的命令执行尝试。