OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers…

OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution. The vulnerability allows attackers to obscure which applet would actually run by exploiting opaque multi-call binaries. Attackers can bypass exec approval mechanisms and weaken risk classification of unsafe applet invocations. This affects the security controls designed to prevent execution of potentially dangerous applets. The vulnerability impacts OpenClaw's ability to properly validate and control applet execution in containerized environments.