CVE-2026-22175: OpenClaw allowlist bypass lets agents

CISO Take

OpenClaw's 'allow-always' exec approval grants can be circumvented because the allowlist matches on the invoking shell wrapper rather than the actual payload, so an attacker who gets a benign multiplexer command like busybox or toybox sh -c approved once can reuse that same wrapper to smuggle in arbitrary commands that were never reviewed. This matters because OpenClaw is an autonomous AI agent with local exec capability, so a bypass of its execution guardrails is a direct path to arbitrary code execution on any host running it, not a theoretical policy gap. The blast radius is currently modest (4 known downstream dependents) and there is no public exploit, no Nuclei template, and CISA's SSVC decision is TRACK rather than Act, with EPSS still very low (0.00333) — this is not being actively exploited today. That said, the affected package already carries 425 other CVEs and an unscored OpenSSF footprint, signaling weak security engineering discipline that increases the odds of this or a related bypass being chained with something else. Patch to OpenClaw 2026.2.23 or later immediately, and until then treat any allow-always exec approval as compromised — audit approval logs for repeated busybox/toybox/sh -c invocations and require explicit per-command review rather than wrapper-level allowlisting.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

CVSS 7.1 (high) reflects a network-exploitable, low-complexity bypass of an execution control with high confidentiality impact but no direct integrity/availability loss from the CVE itself — though the true impact ceiling is higher once you consider what code actually runs once approval is bypassed. Real-world exploitation likelihood is currently low: EPSS is 0.00333, there is no CISA KEV listing, no public PoC, no scanner template, and SSVC lands at TRACK (monitor, don't rush). The risk driver is architectural rather than immediate — this is a security-control-bypass class of bug (CWE-184, incomplete denylist/allowlist matching) in an AI agent whose entire safety model depends on humans being able to trust stored approval decisions. Any environment where OpenClaw is granted broad or persistent 'allow-always' exec permissions for shell wrappers should treat this as high-priority patching even though exploitation-in-the-wild is not yet observed.

How does the attack unfold?

Initial approval

A user grants 'allow-always' trust to a benign command wrapped in a recognized multiplexer shell (e.g., busybox sh -c) inside OpenClaw's allowlist mode.

AML.T0084

Allowlist bypass

An attacker (via poisoned input, compromised dependency, or malicious instruction) crafts a new command using the same wrapper signature but a different payload.

AML.T0107

Arbitrary execution

OpenClaw matches the wrapper against the stored allowlist rule and executes the substituted payload without further human review.

AML.T0053

Impact

The attacker achieves arbitrary code execution under the agent's privileges, enabling credential theft, data exfiltration, or further host compromise.

AML.T0112.000

Initial approval

A user grants 'allow-always' trust to a benign command wrapped in a recognized multiplexer shell (e.g., busybox sh -c) inside OpenClaw's allowlist mode.

AML.T0084

Allowlist bypass

An attacker (via poisoned input, compromised dependency, or malicious instruction) crafts a new command using the same wrapper signature but a different payload.

AML.T0107

Arbitrary execution

OpenClaw matches the wrapper against the stored allowlist rule and executes the substituted payload without further human review.

AML.T0053

Impact

The attacker achieves arbitrary code execution under the agent's privileges, enabling credential theft, data exfiltration, or further host compromise.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I Low

A None

What should I do?

1 step

Upgrade to OpenClaw 2026.2.23 or later, which fixes the wrapper-recognition gap per the vendor advisory and linked patch commit. Until patched, avoid granting 'allow-always' approval to any command that invokes busybox, toybox, or other unrecognized shell multiplexers — require per-invocation review for these instead of blanket trust. Audit existing stored allowlist entries for wrapper-based rules and revoke any that grant broad standing trust to a shell interpreter rather than a specific command. For detection, monitor OpenClaw's exec logs for busybox/toybox sh -c invocations with argument patterns that differ from the originally-approved command, and alert on any allowlist hit where the wrapped payload wasn't part of the initial approval context.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - AI system operation and monitoring

NIST AI RMF

MANAGE-2.3 - Mechanisms for AI system decommission/override are established

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-22175?

OpenClaw's 'allow-always' exec approval grants can be circumvented because the allowlist matches on the invoking shell wrapper rather than the actual payload, so an attacker who gets a benign multiplexer command like busybox or toybox sh -c approved once can reuse that same wrapper to smuggle in arbitrary commands that were never reviewed. This matters because OpenClaw is an autonomous AI agent with local exec capability, so a bypass of its execution guardrails is a direct path to arbitrary code execution on any host running it, not a theoretical policy gap. The blast radius is currently modest (4 known downstream dependents) and there is no public exploit, no Nuclei template, and CISA's SSVC decision is TRACK rather than Act, with EPSS still very low (0.00333) — this is not being actively exploited today. That said, the affected package already carries 425 other CVEs and an unscored OpenSSF footprint, signaling weak security engineering discipline that increases the odds of this or a related bypass being chained with something else. Patch to OpenClaw 2026.2.23 or later immediately, and until then treat any allow-always exec approval as compromised — audit approval logs for repeated busybox/toybox/sh -c invocations and require explicit per-command review rather than wrapper-level allowlisting.

Is CVE-2026-22175 actively exploited?

No confirmed active exploitation of CVE-2026-22175 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22175?

Upgrade to OpenClaw 2026.2.23 or later, which fixes the wrapper-recognition gap per the vendor advisory and linked patch commit. Until patched, avoid granting 'allow-always' approval to any command that invokes busybox, toybox, or other unrecognized shell multiplexers — require per-invocation review for these instead of blanket trust. Audit existing stored allowlist entries for wrapper-based rules and revoke any that grant broad standing trust to a shell interpreter rather than a specific command. For detection, monitor OpenClaw's exec logs for busybox/toybox sh -c invocations with argument patterns that differ from the originally-approved command, and alert on any allowlist hit where the wrapped payload wasn't part of the initial approval context.

What systems are affected by CVE-2026-22175?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, CI/CD automation via AI agents, developer tooling with AI agent exec access.

What is the CVSS score for CVE-2026-22175?

CVE-2026-22175 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksCI/CD automation via AI agentsdeveloper tooling with AI agent exec access

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through unrecognized multiplexer shell wrappers like busybox and toybox sh -c commands. Attackers can exploit this by invoking arbitrary payloads under the same multiplexer wrapper to satisfy stored allowlist rules, bypassing intended execution restrictions.

Exploitation Scenario

A developer using OpenClaw in allowlist mode approves a routine command wrapped in `busybox sh -c "npm test"` and marks it allow-always, intending to trust that specific test invocation going forward. An attacker who can influence agent input (e.g., via a poisoned repository file, a malicious tool response, or a compromised dependency the agent reads) crafts a new instruction that reuses the same `busybox sh -c` wrapper but substitutes an arbitrary payload, such as exfiltrating credentials or writing a backdoor. Because OpenClaw's allowlist matches on the wrapper signature rather than the full command, the stored allow-always grant fires and the malicious payload executes without further human review, giving the attacker code execution under the agent's privileges.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.