CVE-2026-22169: OpenClaw safeBins allowlist bypass

CISO Take

OpenClaw, an AI agent framework that gives LLM-driven agents controlled shell access, ships a safeBins allowlist meant to restrict which external programs an agent can invoke — but a flaw in how the sort command's compress-program option is validated lets an attacker leverage an already-allowlisted sort entry to chain in arbitrary external programs, fully defeating the sandbox. The blast radius is narrow today (only 4 known downstream dependents, EPSS at 0.00197 — near-zero absolute exploitation probability despite the 'top 90th percentile' framing, no public exploit or Nuclei template, and CISA's SSVC verdict is TRACK, not act-now), but the technical severity is real: CVSS 6.7 with confidentiality, integrity, and availability all rated High once triggered, since it yields arbitrary command execution as the agent process. This matters most for teams running OpenClaw agents under high-privilege service accounts or in CI/CD contexts where sort was enabled as a 'safe' utility. Patch to OpenClaw 2026.2.22 or later; until then, audit tools.exec.safeBins for sort and remove it, and monitor agent process trees for unexpected children spawned via compress-program.

Sources: NVD GitHub Advisory EPSS ATLAS VulnCheck CISA

What is the risk?

Medium overall risk. The CVSS 6.7 score with full CIA impact reflects a genuine sandbox-escape once triggered, but the attack requires PR:H (attacker already needs high local privileges) and a specific misconfiguration (sort explicitly added to safeBins) — a narrow deployment precondition, not a default-exposed flaw. No public exploit code, no Nuclei template, no KEV listing, and CISA SSVC rates it TRACK rather than Act. EPSS of 0.00197 is effectively negligible in absolute terms. Package risk score of 0/100 and absent OpenSSF Scorecard data indicate limited maturity signal for the ecosystem generally. Net assessment: a real privilege-escalation/sandbox-bypass bug worth patching on a normal cycle, not an emergency, unless combined with another vulnerability that grants the prerequisite high-privilege foothold.

How does the attack unfold?

Privileged local foothold

Attacker already holds high-privilege local access to a host running an OpenClaw agent, e.g. via a compromised service account.

AML.T0012

Tool invocation abuse

Attacker invokes the agent's allowlisted sort tool and passes a crafted compress-program parameter pointing to an arbitrary program.

AML.T0053

Allowlist bypass / command execution

The unvalidated compress-program parameter causes the agent to execute the unauthorized external program, bypassing safeBins restrictions.

AML.T0050

Full host compromise

The attacker gains arbitrary command execution with the agent process's privileges, achieving full loss of confidentiality, integrity, and availability.

AML.T0112.000

Privileged local foothold

Attacker already holds high-privilege local access to a host running an OpenClaw agent, e.g. via a compromised service account.

AML.T0012

Tool invocation abuse

Attacker invokes the agent's allowlisted sort tool and passes a crafted compress-program parameter pointing to an arbitrary program.

AML.T0053

Allowlist bypass / command execution

The unvalidated compress-program parameter causes the agent to execute the unauthorized external program, bypassing safeBins restrictions.

AML.T0050

Full host compromise

The attacker gains arbitrary command execution with the agent process's privileges, achieving full loss of confidentiality, integrity, and availability.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR High

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade to OpenClaw >= 2026.2.22 (fix in commit 57fbbae). If immediate upgrade isn't possible: remove sort from tools.exec.safeBins, or enforce a policy layer that strips/denies the --compress-program flag before it reaches the shell. Audit all agent safeBins configurations for other utilities with pass-through 'helper program' style options (--exec, -exec, --compress-program, etc.), since the same allowlist-bypass class could recur elsewhere. For detection, alert on child processes spawned by sort that resolve to binaries outside the intended allowlist, and monitor process ancestry for OpenClaw agent processes spawning unexpected executables. Since PR:H is a precondition, also review why the executing account holds elevated privileges and apply least-privilege as a compensating control.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Plugin AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-22169?

OpenClaw, an AI agent framework that gives LLM-driven agents controlled shell access, ships a safeBins allowlist meant to restrict which external programs an agent can invoke — but a flaw in how the sort command's compress-program option is validated lets an attacker leverage an already-allowlisted sort entry to chain in arbitrary external programs, fully defeating the sandbox. The blast radius is narrow today (only 4 known downstream dependents, EPSS at 0.00197 — near-zero absolute exploitation probability despite the 'top 90th percentile' framing, no public exploit or Nuclei template, and CISA's SSVC verdict is TRACK, not act-now), but the technical severity is real: CVSS 6.7 with confidentiality, integrity, and availability all rated High once triggered, since it yields arbitrary command execution as the agent process. This matters most for teams running OpenClaw agents under high-privilege service accounts or in CI/CD contexts where sort was enabled as a 'safe' utility. Patch to OpenClaw 2026.2.22 or later; until then, audit tools.exec.safeBins for sort and remove it, and monitor agent process trees for unexpected children spawned via compress-program.

Is CVE-2026-22169 actively exploited?

No confirmed active exploitation of CVE-2026-22169 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22169?

Upgrade to OpenClaw >= 2026.2.22 (fix in commit 57fbbae). If immediate upgrade isn't possible: remove sort from tools.exec.safeBins, or enforce a policy layer that strips/denies the --compress-program flag before it reaches the shell. Audit all agent safeBins configurations for other utilities with pass-through 'helper program' style options (--exec, -exec, --compress-program, etc.), since the same allowlist-bypass class could recur elsewhere. For detection, alert on child processes spawned by sort that resolve to binaries outside the intended allowlist, and monitor process ancestry for OpenClaw agent processes spawning unexpected executables. Since PR:H is a precondition, also review why the executing account holds elevated privileges and apply least-privilege as a compensating control.

What systems are affected by CVE-2026-22169?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, sandboxed tool execution, CI/CD agentic pipelines.

What is the CVSS score for CVE-2026-22169?

CVE-2026-22169 has a CVSS v3.1 base score of 6.7 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

agent frameworkssandboxed tool executionCI/CD agentic pipelines

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option. When sort is explicitly added to tools.exec.safeBins, remote attackers can bypass intended safe-bin approval constraints by leveraging the compress-program parameter to execute unauthorized external programs.

Exploitation Scenario

An attacker who already holds high (but not full admin) privileges on a host running an OpenClaw agent — for example, a compromised CI service account or a malicious insider with limited shell access — finds that the agent's tools.exec.safeBins allowlist includes sort for legitimate data-processing tasks. The attacker invokes the agent's sort tool with a crafted --compress-program argument pointing at an arbitrary binary or script; because compress-program isn't validated against the allowlist, the agent executes it with the same permissions as the agent process. From there the attacker achieves full compromise of confidentiality, integrity, and availability on the host — reading credentials or config the agent can access, tampering with agent state or connected tool configurations, or pivoting to other systems reachable under the agent's identity.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.