---
schema: 1
kind: vulnerability
title: "CVE-2026-44112 / CVE-2026-44113 / CVE-2026-44115 / CVE-2026-44118 — OpenClaw \"Claw Chain\": four chainable flaws in autonomous-agent platform enable sandbox escape → credential leak → privilege escalation → file disclosure"
headline: "CVE-2026-44112 / CVE-2026-44113 / CVE-2026-44115 / CVE-2026-44118 — OpenClaw \"Claw Chain\": four chainable flaws in autonomous-agent platform enable sandbox"
summary: "Cyera Research discloses OpenClaw \"Claw Chain\" — four chainable vulnerabilities (CVE-2026-44112 CVSS 9.6 / CVE-2026-44115 8.8 / CVE-2026-44118 7.8 / CVE-2026-44113 7.7) in the autonomous-agent platform enabling sandbox escape → credential leak → privilege escalation → file disclosure; ~245 K publicly accessible instances; fixed by the 2026-04-23 OpenClaw release (GHSA-5h3g-6xhh-rg6p / wppj-c6mr-83jj / r6xh-pqhr-v4xh / x3h8-jrgh-p8jx) (Cyera Research, 2026-05-15)."
discovered_at: "2026-05-16T05:00:05Z"
event_date: 2026-05-15
run_id: 2026-05-16-5bc123a0
priority: high
immediate_action: null
tags:
  - vulnerabilities
  - ai-abuse
  - priv-esc
  - info-disclosure
  - patch-available
regions:
  - global
sectors:
  - technology
entities: []
cves:
  - id: CVE-2026-44112
    cvss: "9.6"
    epss: null
    type: priv-esc
    vector: local
    auth: post-auth
    status:
      - patch-available
  - id: CVE-2026-44113
    cvss: "7.7"
    epss: null
    type: priv-esc
    vector: local
    auth: post-auth
    status:
      - patch-available
  - id: CVE-2026-44115
    cvss: "8.8"
    epss: null
    type: priv-esc
    vector: local
    auth: post-auth
    status:
      - patch-available
  - id: CVE-2026-44118
    cvss: "7.8"
    epss: null
    type: priv-esc
    vector: local
    auth: post-auth
    status:
      - patch-available
sources:
  - url: "https://www.cyera.com/blog/claw-chain-cyera-research-unveil-four-chainable-vulnerabilities-in-openclaw"
    publisher: "Cyera Research, 2026-05-15"
    role: primary
  - url: "https://thehackernews.com/2026/05/four-openclaw-flaws-enable-data-theft.html"
    publisher: "The Hacker News, 2026-05-15"
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: null
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions:
  - "**Apply the OpenClaw / Clawdbot 2026-04-23 fixes (GHSA-5h3g-6xhh-rg6p / wppj-c6mr-83jj / r6xh-pqhr-v4xh / x3h8-jrgh-p8jx) or block OpenClaw instances from the internet; audit plugin supply chain.** The Claw Chain (CVE-2026-44112 CVSS 9.6 + CVE-2026-44115 / 44118 / 44113) requires code execution inside the sandbox boundary — but the chain's entry point (malicious plugin install, prompt injection, or supply-chain compromise of a plugin) is realistic for any environment running OpenClaw against untrusted inputs. Where the fix release cannot be deployed immediately, remove public internet exposure of the OpenClaw management interface; review installed plugins and rotate credentials accessible from the agent context."
migrated_from: briefs/2026-05-16.md
---

Cyera Research published on 2026-05-15 four chained vulnerabilities in OpenClaw (also marketed as Clawdbot), an autonomous AI-agent platform released in late 2025 with integrations including Microsoft Agent 365 ([Cyera Research, 2026-05-15](https://www.cyera.com/blog/claw-chain-cyera-research-unveil-four-chainable-vulnerabilities-in-openclaw) · [The Hacker News, 2026-05-15](https://thehackernews.com/2026/05/four-openclaw-flaws-enable-data-theft.html)). All four CVEs are fixed by the OpenClaw release dated 2026-04-23, addressed under GitHub Security Advisories GHSA-5h3g-6xhh-rg6p, GHSA-wppj-c6mr-83jj, GHSA-r6xh-pqhr-v4xh, and GHSA-x3h8-jrgh-p8jx. The defender-relevant detail is that an attacker who can obtain code execution **inside the OpenClaw managed sandbox** — achievable via a malicious plugin, prompt injection into the agent context, or supply-chain compromise of an OpenClaw plugin — can chain the four primitives to a full sandbox-escape → credential-harvest → owner-level agent control → file-disclosure sequence whose steps each mimic normal agent behaviour and so evade controls calibrated to "human-attacker" indicators. CVE-2026-44112 (CVSS 9.6, Critical) is a TOCTOU race in the OpenShell sandbox backend that lets the sandbox process win the filesystem write race and redirect writes outside the intended mount root, enabling host-filesystem tampering and persistent backdoor placement. CVE-2026-44115 (CVSS 8.8, High) is an incomplete allowlist in OpenClaw's command parser — shell-expansion tokens embedded in environment-variable names bypass the validation gate, leaking API keys, tokens, and credentials at execution time. CVE-2026-44118 (CVSS 7.8, High) trusts a client-controlled `senderIsOwner` flag in MCP loopback messages without validating against the authenticated session, allowing privilege escalation to owner-level agent control. CVE-2026-44113 (CVSS 7.7, High) is the companion TOCTOU read escape enabling file disclosure outside the sandbox root. Exposure is broad: Cyera cites ~65 K (Shodan) and ~180 K (ZoomEye) publicly accessible OpenClaw instances as of May 2026, summing to an estimated ~245 K exposed servers. No in-the-wild exploitation reported at disclosure. Detection: alert on the agent process writing files outside designated sandbox mount directories; flag MCP loopback messages with `senderIsOwner=true` from sources not matching the authenticated session; alert on environment-variable expansion in command strings at agent execution time.