CVE-2026-22176: OpenClaw cmd injection

CISO Take

OpenClaw versions prior to 2026.2.19 contain a command injection flaw in how Windows Scheduled Task scripts are generated: environment variable values are written unquoted to gateway.cmd, allowing any local user with low privileges to inject shell metacharacters and execute arbitrary commands when the task fires. With attack complexity rated low and EPSS placing this in the top 54% of exploited vulnerabilities, the barrier to exploitation is minimal for any attacker who has already obtained local access — a realistic scenario in agent-heavy deployment environments where multiple services share infrastructure. No public exploit or KEV designation currently exists, which moderately limits immediate risk, but the 4 downstream dependents and prevalence of OpenClaw in AI agent workflows make this a meaningful exposure. Upgrade to OpenClaw 2026.2.19 or later immediately; if patching is delayed, sanitize environment variable inputs and audit existing gateway.cmd files for unexpected metacharacters such as &, |, ^, %, or !.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium risk overall, elevated in AI agent deployments where OpenClaw orchestrates recurring Windows Scheduled Tasks on shared infrastructure. The local attack vector limits remote exploitation, but in multi-tenant agent environments or CI/CD pipelines where service accounts are shared, local access is readily achievable via lateral movement. The combination of low privilege requirement and low complexity makes this trivially weaponizable once an attacker has any foothold on the host. The absence of a public exploit and KEV listing tempers immediate urgency, but the predictable exploitation pattern — injecting & or | into env var values — means future weaponization is likely as the package grows in adoption.

How does the attack unfold?

Local Access

Attacker obtains low-privileged local access to a Windows host running OpenClaw via a compromised service account, shared CI/CD runner, or lateral movement from a separately exploited system.

AML.T0012

Config Injection

Attacker injects shell metacharacters (e.g., & or |) into an environment variable value consumed by OpenClaw's scheduled task generator — via a writable config file, influenced API response, or shared data store.

AML.T0081

Command Execution

When OpenClaw writes gateway.cmd with the unquoted set KEY=VALUE pattern and the Windows Scheduled Task fires, cmd.exe interprets the metacharacter as a command separator and executes the injected payload at task privilege level.

AML.T0050

Impact

Attacker achieves arbitrary command execution with scheduled task privileges, enabling persistence, credential theft, lateral movement to connected agent infrastructure, or full disruption of AI agent workflows.

AML.T0048

Local Access

Attacker obtains low-privileged local access to a Windows host running OpenClaw via a compromised service account, shared CI/CD runner, or lateral movement from a separately exploited system.

AML.T0012

Config Injection

Attacker injects shell metacharacters (e.g., & or |) into an environment variable value consumed by OpenClaw's scheduled task generator — via a writable config file, influenced API response, or shared data store.

AML.T0081

Command Execution

When OpenClaw writes gateway.cmd with the unquoted set KEY=VALUE pattern and the Windows Scheduled Task fires, cmd.exe interprets the metacharacter as a command separator and executes the injected payload at task privilege level.

AML.T0050

Impact

Attacker achieves arbitrary command execution with scheduled task privileges, enabling persistence, credential theft, lateral movement to connected agent infrastructure, or full disruption of AI agent workflows.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

4 steps

Patch: Upgrade OpenClaw to version 2026.2.19 or later per vendor advisory GHSA-pj5x-38rw-6fph. The fix is in commit dafe52e8, which addresses the unquoted assignment issue in gateway.cmd generation.
Workaround: Until patched, avoid passing environment variable values that originate from external, user-supplied, or untrusted input into OpenClaw's task generation. Implement input validation to strip or reject shell metacharacters (&, |, ^, %, !) from any values before they reach OpenClaw configuration.
Detection: Audit existing gateway.cmd files on Windows hosts running OpenClaw for unexpected metacharacters or anomalous commands. Monitor Windows Event IDs 4698 and 4702 (scheduled task creation/modification) for anomalies. Review process creation logs (Event ID 4688 or Sysmon Event ID 1) for unexpected child processes spawned by OpenClaw scheduled tasks.
Scope: Enumerate downstream packages depending on OpenClaw (4 known dependents) and assess their inherited exposure before declaring the environment clean.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent Framework AML.T0010.001 - AI Software AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Information security in AI system development

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain treatment of the risks over time

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-22176?

OpenClaw versions prior to 2026.2.19 contain a command injection flaw in how Windows Scheduled Task scripts are generated: environment variable values are written unquoted to gateway.cmd, allowing any local user with low privileges to inject shell metacharacters and execute arbitrary commands when the task fires. With attack complexity rated low and EPSS placing this in the top 54% of exploited vulnerabilities, the barrier to exploitation is minimal for any attacker who has already obtained local access — a realistic scenario in agent-heavy deployment environments where multiple services share infrastructure. No public exploit or KEV designation currently exists, which moderately limits immediate risk, but the 4 downstream dependents and prevalence of OpenClaw in AI agent workflows make this a meaningful exposure. Upgrade to OpenClaw 2026.2.19 or later immediately; if patching is delayed, sanitize environment variable inputs and audit existing gateway.cmd files for unexpected metacharacters such as &, |, ^, %, or !.

Is CVE-2026-22176 actively exploited?

No confirmed active exploitation of CVE-2026-22176 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22176?

1. Patch: Upgrade OpenClaw to version 2026.2.19 or later per vendor advisory GHSA-pj5x-38rw-6fph. The fix is in commit dafe52e8, which addresses the unquoted assignment issue in gateway.cmd generation. 2. Workaround: Until patched, avoid passing environment variable values that originate from external, user-supplied, or untrusted input into OpenClaw's task generation. Implement input validation to strip or reject shell metacharacters (&, |, ^, %, !) from any values before they reach OpenClaw configuration. 3. Detection: Audit existing gateway.cmd files on Windows hosts running OpenClaw for unexpected metacharacters or anomalous commands. Monitor Windows Event IDs 4698 and 4702 (scheduled task creation/modification) for anomalies. Review process creation logs (Event ID 4688 or Sysmon Event ID 1) for unexpected child processes spawned by OpenClaw scheduled tasks. 4. Scope: Enumerate downstream packages depending on OpenClaw (4 known dependents) and assess their inherited exposure before declaring the environment clean.

What systems are affected by CVE-2026-22176?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI workflow automation, model inference scheduling.

What is the CVSS score for CVE-2026-22176?

CVE-2026-22176 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.64%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI workflow automationmodel inference scheduling

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through environment variable values containing metacharacters like &, |, ^, %, or ! to achieve command execution when the scheduled task script is generated and executed.

Exploitation Scenario

An attacker with low-privileged local access to a Windows host — gained via a compromised service account, shared CI/CD runner, or lateral movement from another vulnerability — identifies that OpenClaw is deployed as an AI agent orchestrator running scheduled tasks. The attacker locates or influences a configuration file or API response that feeds environment variable values into OpenClaw's task generator, injecting a payload such as `legitimate_value & net user backdoor P@ssw0rd123 /add & net localgroup administrators backdoor /add`. When OpenClaw writes gateway.cmd with the unquoted `set KEY=legitimate_value & net user backdoor...` pattern and the scheduled task executes, cmd.exe interprets the & as a command separator and runs all three commands sequentially. The attacker now has a local administrator account, giving them persistent elevated access to the AI agent host and full control over its agent workflows, credentials, and connected data sources.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.