CVE-2026-22168: OpenClaw cmd.exe argument smuggling

CISO Take

OpenClaw's system.run tool lets authenticated operators submit Windows commands for human approval, but versions before 2026.2.21 only show the reviewer the leading, benign-looking portion of a cmd.exe /c invocation while silently executing attacker-supplied trailing arguments as well — a classic CWE-88 argument injection wrapped in an AI agent's approval workflow. This matters less for who can trigger it (it needs an already-authenticated operator, PR:L) than for what it breaks: the audit trail itself, since the approval log and the actual executed command diverge, meaning post-incident review of a compromised trusted node won't show what really ran. EPSS sits at just 0.4% (67th percentile) with no public exploit, no Nuclei template, and CISA SSVC scored it TRACK — this is not being mass-exploited today. Given only 4 downstream dependents and no KEV listing, prioritize this as a scheduled patch rather than an emergency one, but treat it seriously in any deployment where system.run is exposed to lower-trust operators or CI/CD-style automation: upgrade to OpenClaw >= 2026.2.21 and reconcile OS-level process logs (Sysmon) against OpenClaw's own approval log for any historical mismatches.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS vulncheck.com

What is the risk?

CVSS 6.5 (Medium) reflects a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, but the score (C:H/I:N/A:N) understates the practical exposure — the description confirms actual local command execution on the host, which typically implies integrity/availability impact the vector doesn't capture, likely because the scorer treated 'authorized operator with restricted approval' as the baseline. Exploitation likelihood is low today: EPSS 0.4% (top 67th percentile, not high), no public PoC, no Nuclei template, not in CISA KEV, and CISA's own SSVC decision is TRACK (monitor, not urgent remediation). The real risk driver is trust erosion: any node running an unpatched OpenClaw system.run tool cannot be fully trusted to have an accurate audit trail, which matters disproportionately for AI agent deployments where operators already have broad automation privileges.

How does the attack unfold?

Authenticated access

An operator with existing, low-privilege authenticated access to the OpenClaw agent submits a system.run request for execution on a trusted Windows node.

AML.T0053

Argument smuggling

The operator crafts the request so the approval UI displays only a benign leading command while additional malicious arguments are appended after cmd.exe /c.

AML.T0050

Command execution

Once approved, OpenClaw executes the full command string including the hidden trailing arguments, achieving local command execution on the host.

AML.T0112.000

Audit evasion

The approval log records only the benign, reviewed command text, leaving no accurate trace of the actual malicious execution for detection or forensics.

AML.T0074

Authenticated access

An operator with existing, low-privilege authenticated access to the OpenClaw agent submits a system.run request for execution on a trusted Windows node.

AML.T0053

Argument smuggling

The operator crafts the request so the approval UI displays only a benign leading command while additional malicious arguments are appended after cmd.exe /c.

AML.T0050

Command execution

Once approved, OpenClaw executes the full command string including the hidden trailing arguments, achieving local command execution on the host.

AML.T0112.000

Audit evasion

The approval log records only the benign, reviewed command text, leaving no accurate trace of the actual malicious execution for detection or forensics.

AML.T0074

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade to OpenClaw 2026.2.21 or later, which addresses the underlying argument-injection flaw (see patch commit 6007941f04df1edcca679dd6c95949744fdbd4 in the GHSA advisory). Until patched, restrict which operators/roles can invoke system.run, and if possible disable or tightly allowlist cmd.exe /c invocations that accept operator-supplied trailing arguments. For detection, do not rely solely on OpenClaw's internal approval log — cross-reference OS-level process creation telemetry (Windows Sysmon Event ID 1, command-line auditing) against the approved command text for every system.run execution, flagging any divergence between the two as a potential exploitation attempt. Review historical system.run executions on trusted Windows nodes for suspicious trailing arguments following otherwise-benign approved commands.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Plugin AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0074 - Masquerading AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 12 - Record-keeping Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system event logging

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-22168?

OpenClaw's system.run tool lets authenticated operators submit Windows commands for human approval, but versions before 2026.2.21 only show the reviewer the leading, benign-looking portion of a cmd.exe /c invocation while silently executing attacker-supplied trailing arguments as well — a classic CWE-88 argument injection wrapped in an AI agent's approval workflow. This matters less for who can trigger it (it needs an already-authenticated operator, PR:L) than for what it breaks: the audit trail itself, since the approval log and the actual executed command diverge, meaning post-incident review of a compromised trusted node won't show what really ran. EPSS sits at just 0.4% (67th percentile) with no public exploit, no Nuclei template, and CISA SSVC scored it TRACK — this is not being mass-exploited today. Given only 4 downstream dependents and no KEV listing, prioritize this as a scheduled patch rather than an emergency one, but treat it seriously in any deployment where system.run is exposed to lower-trust operators or CI/CD-style automation: upgrade to OpenClaw >= 2026.2.21 and reconcile OS-level process logs (Sysmon) against OpenClaw's own approval log for any historical mismatches.

Is CVE-2026-22168 actively exploited?

No confirmed active exploitation of CVE-2026-22168 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22168?

Upgrade to OpenClaw 2026.2.21 or later, which addresses the underlying argument-injection flaw (see patch commit 6007941f04df1edcca679dd6c95949744fdbd4 in the GHSA advisory). Until patched, restrict which operators/roles can invoke system.run, and if possible disable or tightly allowlist cmd.exe /c invocations that accept operator-supplied trailing arguments. For detection, do not rely solely on OpenClaw's internal approval log — cross-reference OS-level process creation telemetry (Windows Sysmon Event ID 1, command-line auditing) against the approved command text for every system.run execution, flagging any divergence between the two as a potential exploitation attempt. Review historical system.run executions on trusted Windows nodes for suspicious trailing arguments following otherwise-benign approved commands.

What systems are affected by CVE-2026-22168?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool invocation / human-in-the-loop approval workflows, Windows-based agent automation nodes.

What is the CVSS score for CVE-2026-22168?

CVE-2026-22168 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool invocation / human-in-the-loop approval workflowsWindows-based agent automation nodes

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0074 Masquerading

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 12, Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign command. Attackers can smuggle malicious arguments through cmd.exe /c to achieve local command execution on trusted Windows nodes with mismatched audit logs.

Exploitation Scenario

An authenticated but lower-privileged OpenClaw operator submits a system.run request rendering as an innocuous command (e.g., 'cmd.exe /c dir') for a human reviewer's approval. Because the approval UI only reflects the leading portion of the command string, the operator appends additional shell arguments or command chaining after the visible text — arguments the reviewer never sees. The reviewer approves what looks benign, but OpenClaw executes the full trailing string via cmd.exe on a trusted Windows node, achieving local command execution. Because the approval-integrity mismatch also affects logging, the audit trail continues to show only the sanitized, approved command, letting the attacker's actual payload evade both real-time review and later incident forensics.

Weaknesses (CWE)

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE-88 — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'): The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

[Implementation] Where possible, avoid building a single string that contains the command and its arguments. Some languages or frameworks have functions that support specifying independent arguments, e.g. as an array, which is used to automatically perform the appropriate quoting or escaping while building the command. For example, in PHP, escapeshellarg() can be used to escape a single argument to system(), or exec() can be called with an array of arguments. In C, code can often be refactored from using system() - which accepts a single string - to using exec(), which requires separate function arguments for each parameter.
[Architecture and Design] Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application. Perform input validation at well-defined interfaces.

Source: MITRE CWE corpus.