OpenClaw versions 2026.2.23 before 2026.4.12 contain a vulnerability that allows attackers to bypass exec approval mechanisms through busybox and toybox applet execution. The flaw enables obscuring which applet would actually run by exploiting opaque multi-call binaries. This weakens risk classification of unsafe applet invocations and compromises security controls. The vulnerability affects the exec approval binding functionality specifically. Attackers can leverage this to execute unauthorized code while evading detection mechanisms.