OpenClaw LLM Agent Execution Approval Bypass via config.patch

The OpenClaw npm package, a tool used for managing execution permissions within systems, is susceptible to an agentic consent bypass vulnerability. Specifically, an LLM agent leveraging OpenClaw can manipulate the config.patch file to silently disable execution approval processes. This vulnerability, reported by @YLChen-007, affects OpenClaw versions up to 2026.3.24. Successful exploitation could lead to unauthorized code execution and compromise of systems relying on OpenClaw for security controls. The vulnerability was addressed in commit 76411b2afc4ae721e36c12e0ea24fd23e2fed61e and subsequently released in version 2026.3.28. This allows an attacker to bypass intended security measures.

Attack Chain

1. The attacker gains initial access to a system with OpenClaw installed, potentially through existing vulnerabilities or misconfigurations.
2. The LLM agent identifies the location of the config.patch file used by OpenClaw, typically within the OpenClaw installation directory.
3. The attacker crafts a malicious config.patch file designed to disable or weaken execution approval requirements. This file contains configuration changes that alter the behavior of OpenClaw's execution control mechanisms.
4. The LLM agent uses file manipulation techniques (e.g., fs.writeFile in Node.js) to overwrite the existing config.patch file with the malicious version.
5. OpenClaw automatically loads and applies the modified configuration from the config.patch file upon its next execution or configuration refresh.
6. With the weakened or disabled execution approval, the attacker executes arbitrary code or commands without proper authorization or consent checks.
7. The attacker performs malicious actions, such as data exfiltration, system compromise, or lateral movement within the network.

Impact

Successful exploitation of this vulnerability allows attackers to bypass intended security controls implemented by OpenClaw. This can lead to unauthorized execution of arbitrary code, potentially resulting in data breaches, system compromise, and further propagation of malicious activity within the affected environment. The number of victims depends on the adoption of OpenClaw and the exposure of vulnerable versions. Systems relying on OpenClaw for critical security functions are at the highest risk.

Recommendation

• Upgrade the openclaw npm package to version 2026.3.28 or later to remediate the vulnerability described in this brief.
• Monitor file modifications to the config.patch file within the OpenClaw installation directory. Deploy the Sigma rule Detect OpenClaw Config Patch Modification to identify unauthorized changes.
• Review and audit existing OpenClaw configurations to ensure that execution approval requirements are correctly implemented and not inadvertently bypassed.