CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

OpenClaw

product · product:openclaw

Coverage
1
first 2026-05-16 → last 2026-10-21
Latest activity
2026-05-16
OpenClaw "Claw Chain": code running in the agent sandbox can expose secrets, take owner control and plant…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
8
4 hosts

Defender insights

What each entry about OpenClaw tells a defender to do, newest first.

2026-05-16NOTABLEOpenClaw "Claw Chain": code running in the agent sandbox can expose secrets, take owner control and plant backdoors

Exposure · detection

Story timeline

  1. 2026-05-16OpenClaw "Claw Chain": four chainable sandbox, exec-allowlist and MCP loopback flaws (CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, CVE-2026-44118) fixed in release 2026.4.22
    trending-vulnerabilitiesOpenClaw "Claw Chain": code running in the agent sandbox can expose secrets, take owner control and plant backdoors

Hunting pivots

CVEs
CVE-2026-44112CVE-2026-44113CVE-2026-44115CVE-2026-44118
Releases covered
OpenClaw
Tags
ai-abuseinfo-disclosurepatch-availablepriv-escvulnerabilities
ATT&CK techniques (5 across 5 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessSupply Chain Compromise: Compromise Software Supply Chain
  • ExecutionCommand and Scripting Interpreter: Unix Shell
  • Privilege EscalationExploitation for Privilege Escalation
  • Credential AccessUnsecured Credentials: Credentials In Files
  • CollectionData from Local System

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-05-16/cve-2026-44112-cve-2026-44113-cve-2026-44115-cve-2026-44118 · ATT&CK page ↗

Execution TA0002

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-05-16/cve-2026-44112-cve-2026-44113-cve-2026-44115-cve-2026-44118 · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-05-16/cve-2026-44112-cve-2026-44113-cve-2026-44115-cve-2026-44118 · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-05-16/cve-2026-44112-cve-2026-44113-cve-2026-44115-cve-2026-44118 · ATT&CK page ↗

Collection TA0009

T1005Data from Local System×1

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-05-16/cve-2026-44112-cve-2026-44113-cve-2026-44115-cve-2026-44118 · ATT&CK page ↗

Entries about OpenClaw (1)

2026-05-16 · view entry permalink →

NOTABLECVE-2026-44112 +3updatedNATOA2

OpenClaw "Claw Chain": four chainable sandbox, exec-allowlist and MCP loopback flaws (CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, CVE-2026-44118) fixed in release 2026.4.22

Cyera disclosed four vulnerabilities in OpenClaw, an open-source platform for autonomous AI agents originally launched as Clawdbot in late 2025, on 2026-05-15 after reporting them to the maintainers in April (Cyera, 2026-05-15). OpenClaw's advisories of 2026-04-23 list the openclaw npm package up to release 2026.4.21 as affected and 2026.4.22 as fixed for all four (OpenClaw GHSA-wppj-c6mr-83jj, 2026-04-23; OpenClaw GHSA-5h3g-6xhh-rg6p, 2026-04-23; OpenClaw GHSA-x3h8-jrgh-p8jx, 2026-04-23; OpenClaw GHSA-r6xh-pqhr-v4xh, 2026-04-23). CVE-2026-44112 and CVE-2026-44113 are time-of-check/time-of-use races in the OpenShell sandbox's filesystem bridge, where a symlink swap redirects a write outside the intended mount root or makes a read return bytes from outside it (OpenClaw GHSA-wppj-c6mr-83jj, 2026-04-23; OpenClaw GHSA-5h3g-6xhh-rg6p, 2026-04-23). CVE-2026-44115 lets an allowlisted command hide shell expansion in an unquoted heredoc body, so the shell evaluates more than the approved command text shows, which Cyera says returns environment variables such as API keys and tokens (OpenClaw GHSA-x3h8-jrgh-p8jx, 2026-04-23; Cyera, 2026-05-15). CVE-2026-44118 sits on the loopback MCP path, which accepted spoofable owner-context metadata from request headers and so let a non-owner loopback client act as owner for owner-gated operations such as gateway configuration, cron scheduling and execution-environment management (OpenClaw GHSA-r6xh-pqhr-v4xh, 2026-04-23; Cyera, 2026-05-15).

Cyera's chain starts from code execution inside the OpenShell sandbox through a malicious plugin, prompt injection or compromised external input, uses the read escape and the heredoc flaw to expose credentials, secrets and files, the loopback flaw for owner-level control of the agent runtime, and the write escape to plant backdoors or change configuration; it says each step looks like normal agent behavior to traditional controls (Cyera, 2026-05-15). Cyera rates CVE-2026-44112 at CVSS 9.6 and CVE-2026-44115 at 8.8 (Cyera, 2026-05-15), VulnCheck scores them 8.4 and 8.7 in CVSS 4.0 (VulnCheck, CVE-2026-44112; VulnCheck, CVE-2026-44115), and OpenClaw's own advisory for the heredoc allowlist bypass rates it moderate (OpenClaw GHSA-x3h8-jrgh-p8jx, 2026-04-23). Cyera counts about 65,000 (Shodan) and about 180,000 (Zoomeye) publicly accessible OpenClaw instances as of May 2026 (Cyera, 2026-05-15). Neither Cyera nor the vendor advisories report exploitation.

A time-of-check/time-of-use race around OpenShell sandbox filesystem writes could let a symlink swap redirect a write outside the intended local mount root.

An allowlisted command containing an unquoted heredoc could hide shell expansion in the heredoc body.

The loopback MCP path accepted spoofable owner-context metadata from request headers, which could allow a non-owner loopback client to present itself as owner for owner-gated operations.

OpenClaw

A malicious plugin, prompt injection, or compromised external input gains code execution inside the OpenShell sandbox.

Assume any environment variable or credential reachable by OpenClaw processes may be compromised.

Cyera Research 2026-05-15
Correctionrun 2026-10-21T1148Z-auditactionsaffected_productsbodyclassificationcvesevidenceheadlineprioritysourcessourcing_notesummarytechniquestitle

CVE-2026-44115 does not hide expansion tokens in environment-variable names: an allowlisted command containing an unquoted heredoc can hide shell expansion in the heredoc body, so the shell runs more than the approved text shows (OpenClaw GHSA-x3h8-jrgh-p8jx, 2026-04-23). Cyera reports about 65,000 instances on Shodan and about 180,000 on Zoomeye as two separate counts, not a combined 245,000, and its chain runs from a foothold inside the sandbox through the read escape and the heredoc flaw (credentials and files), then the loopback flaw (owner control), to the write escape (backdoors and persistence) (Cyera, 2026-05-15). The advisories list release 2026.4.21 and earlier as affected and 2026.4.22 as the fix for all four (OpenClaw GHSA-r6xh-pqhr-v4xh, 2026-04-23). The 9.6 for CVE-2026-44112 is Cyera's score; VulnCheck scores it 8.4 in CVSS 4.0 (VulnCheck, CVE-2026-44112), and OpenClaw's advisory for the heredoc bypass rates it moderate (OpenClaw GHSA-x3h8-jrgh-p8jx, 2026-04-23).

vulnerability16 May 05:00Zmulti-sourceOpen finding →
Sources: Cyera Research · The Hacker News · OpenClaw (GHSA-wppj-c6mr-83jj) · OpenClaw (GHSA-5h3g-6xhh-rg6p) · OpenClaw (GHSA-x3h8-jrgh-p8jx) · OpenClaw (GHSA-r6xh-pqhr-v4xh) · VulnCheck

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • github.com4 (50%)
  • vulncheck.com2 (25%)
  • cyera.com1 (12%)
  • thehackernews.com1 (12%)
All cited sources (8)