CVE-2026-53848: OpenClaw: Exec allowlist could miss side effects from transparent command wrappers

Exec allowlist could miss side effects from transparent command wrappers. In affected versions, a command request that reaches the exec allowlist path could be evaluated against the inner command while the wrapper invocation still executed.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw’s trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.