CVE-2026-101880 is a High (CVSS 8.8) incorrect authorization flaw in OpenClaw Windows Node. A gateway or agent can hide a denied command behind an allowed one using pipe operators or command substitution. The record says before 2026.7.1; the advisory names v2026.7.1-3 as patched.
What's affected
The weakness is CWE-863 (incorrect authorization). The record says OpenClaw Windows Node before 2026.7.1 is affected. The GitHub advisory lists the patched version as v2026.7.1-3, so confirm that the release you install is at least that build. We note the difference in the two sources and recommend the later one.
The system.run feature checks commands against an exec approval policy. A parser, ExecShellWrapperParser, splits a requested command into parts so that each one can be checked against allow and deny rules. It handles several wrappers and splits chains joined by semicolons, ampersands and logical OR. The record and advisory say it does not split on the pipe operator and does not extract command substitution. The command is then run through a real shell, so a denied command placed behind an allowed prefix can run without review.
The vector is network, low complexity, low privileges, no user interaction, with high impact on all three measures. The advisory rates it High, in line with the record.
How to check if you're exposed
Check the installed version of the OpenClaw Windows Node. Look at the application's version display, the installer version in the Windows installed programs list, or the file version of the executable.
If you use exec approval rules, review them. Rules like "allow git *" are the kind that a hidden second command can ride behind. Look for allow rules built on prefixes, since those are the easiest to chain behind.
Check which gateways and agents are connected to each node. The attacker needs to be a connected gateway or agent that can issue requests, so the trust you place in those connections matters.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Update OpenClaw Windows Node to v2026.7.1-3 or later.
- Review the exec approval rules and remove broad prefix allow rules.
- Limit which gateways and agents can connect to each node, and use credentials for each.
- Run the node as a low privilege Windows account.
- Review recent command history on nodes for entries that do not match what you approved.
Why it matters
Approval systems that parse shell commands have a built in weakness: the parser has to understand the shell as well as the shell does. Any syntax the parser misses becomes a way around the policy. Pipes and command substitution are the obvious gaps, and the maintainers closed them in the fix.
The deeper lesson for agent tooling is that an allow list of command names is not a sandbox. Real isolation comes from limiting what the process can do, not from reading the command text. The record does not mark the CVE as known exploited.
Quick check
Which version fixes it?
The record says before 2026.7.1 is affected and the advisory names v2026.7.1-3 as patched. Install v2026.7.1-3 or later.
Who can exploit it?
Per the record, connected gateways or agents with the ability to call system.run. It is not a flaw for anonymous internet users.
Sources
Last reviewed: 18 October 2026.
