OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers.
Date: 2026-06
Affected: openclaw/openclaw
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-53829
CWE: CWE-451
CVSS: 8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes to execute unauthorized operations after approval.


Mitigations:

Architectural layers (MAESTRO):