CVE-2026-22217: OpenClaw $SHELL env hijack enables

CISO Take

OpenClaw versions prior to 2026.2.23 allow a low-privileged local attacker to execute arbitrary binaries within the AI agent's process context by planting a malicious binary in a writable trusted-prefix directory — such as /opt/homebrew/bin on macOS — and exploiting the shell-env component's trusted-prefix fallback logic for the $SHELL variable. Despite a moderate CVSS of 6.1, this vulnerability ranks in the top 97th percentile of EPSS likelihood with zero user interaction or special skills required to exploit it. With 396 prior CVEs against this package and documented real-world abuse of OpenClaw's skills ecosystem for credential theft (AIID #1368), the blast radius for AI agent deployments is significant: an attacker gaining execution in OpenClaw's process context inherits access to all its credentials, API keys, and connected tools. Upgrade to OpenClaw 2026.2.23 immediately; in the interim, lock down write permissions on trusted-prefix directories and audit $SHELL environment variable handling in any automated agent pipeline.

Sources: NVD EPSS GitHub Advisory ATLAS AIID

What is the risk?

Risk is elevated beyond the CVSS 6.1 medium rating in AI agent contexts. Attack complexity is low — no specialized AI/ML knowledge required — and only local low-privilege access is needed, making exploitation accessible to commodity threat actors. The integrity impact is high (I:H), and AI agents typically run with broad system permissions including credential access and external API connectivity. OpenClaw's historically poor security posture (396 CVEs) and the documented weaponization of its skills ecosystem for credential theft in the wild significantly raise the practical likelihood of exploitation. On macOS developer workstations running Homebrew, /opt/homebrew/bin is writable by the local user by default, removing any practical barrier to dropping a malicious binary.

How does the attack unfold?

Initial Access

Attacker obtains low-privilege local access to a system running OpenClaw, for example via a malicious skill installed from ClawHub, a compromised developer dependency, or an existing foothold on the machine.

AML.T0010.001

Environment Staging

Attacker drops a malicious binary named after the expected shell into a writable trusted-prefix directory (/opt/homebrew/bin on macOS) and positions it to be resolved by OpenClaw's trusted-prefix fallback logic for the $SHELL variable.

AML.T0050

Code Execution

OpenClaw's shell-env component triggers its trusted-prefix fallback, resolves and executes the attacker's malicious binary in place of the legitimate shell, achieving arbitrary code execution within the OpenClaw process context.

AML.T0112.000

Credential & Lateral Movement

With code running inside OpenClaw's process, the attacker harvests API keys, credentials, and agent configuration data, then pivots to connected LLM APIs, databases, and cloud services the agent is authorized to access.

AML.T0083

Initial Access

Attacker obtains low-privilege local access to a system running OpenClaw, for example via a malicious skill installed from ClawHub, a compromised developer dependency, or an existing foothold on the machine.

AML.T0010.001

Environment Staging

Attacker drops a malicious binary named after the expected shell into a writable trusted-prefix directory (/opt/homebrew/bin on macOS) and positions it to be resolved by OpenClaw's trusted-prefix fallback logic for the $SHELL variable.

AML.T0050

Code Execution

OpenClaw's shell-env component triggers its trusted-prefix fallback, resolves and executes the attacker's malicious binary in place of the legitimate shell, achieving arbitrary code execution within the OpenClaw process context.

AML.T0112.000

Credential & Lateral Movement

With code running inside OpenClaw's process, the attacker harvests API keys, credentials, and agent configuration data, then pivots to connected LLM APIs, databases, and cloud services the agent is authorized to access.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.2.23 or later immediately — the vendor commit ff10fe8b91670044a6bb0cd85deb736a0ec8fb55 addresses the trusted-prefix fallback logic.
Directory hardening: Restrict write permissions on trusted-prefix directories (chmod o-w /opt/homebrew/bin and equivalent paths); ensure only privileged users can write to any directory on the $PATH resolved by OpenClaw.
Environment pinning: Audit and explicitly pin the $SHELL variable in all OpenClaw process environments; avoid inheriting ambient user shell values in agent runtimes.
Detection: Deploy EDR rules to alert on unexpected child process execution spawned from OpenClaw processes, particularly binaries in /opt/homebrew/bin or similar user-writable PATH entries.
Skills audit: Review all installed OpenClaw skills for malicious content — per AIID #1368, approximately 17% of community skills in the ClawHub ecosystem were assessed as malicious in early 2026.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent Framework AML.T0010.001 - AI Software AML.T0050 - Command and Scripting Interpreter AML.T0083 - Credentials from AI Agent Configuration AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.4 - AI system security controls

NIST AI RMF

MANAGE-2.2 - Mechanisms for managing AI risks to trustworthiness

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-22217?

OpenClaw versions prior to 2026.2.23 allow a low-privileged local attacker to execute arbitrary binaries within the AI agent's process context by planting a malicious binary in a writable trusted-prefix directory — such as /opt/homebrew/bin on macOS — and exploiting the shell-env component's trusted-prefix fallback logic for the $SHELL variable. Despite a moderate CVSS of 6.1, this vulnerability ranks in the top 97th percentile of EPSS likelihood with zero user interaction or special skills required to exploit it. With 396 prior CVEs against this package and documented real-world abuse of OpenClaw's skills ecosystem for credential theft (AIID #1368), the blast radius for AI agent deployments is significant: an attacker gaining execution in OpenClaw's process context inherits access to all its credentials, API keys, and connected tools. Upgrade to OpenClaw 2026.2.23 immediately; in the interim, lock down write permissions on trusted-prefix directories and audit $SHELL environment variable handling in any automated agent pipeline.

Is CVE-2026-22217 actively exploited?

No confirmed active exploitation of CVE-2026-22217 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22217?

1. Patch: Upgrade OpenClaw to version 2026.2.23 or later immediately — the vendor commit ff10fe8b91670044a6bb0cd85deb736a0ec8fb55 addresses the trusted-prefix fallback logic. 2. Directory hardening: Restrict write permissions on trusted-prefix directories (chmod o-w /opt/homebrew/bin and equivalent paths); ensure only privileged users can write to any directory on the $PATH resolved by OpenClaw. 3. Environment pinning: Audit and explicitly pin the $SHELL variable in all OpenClaw process environments; avoid inheriting ambient user shell values in agent runtimes. 4. Detection: Deploy EDR rules to alert on unexpected child process execution spawned from OpenClaw processes, particularly binaries in /opt/homebrew/bin or similar user-writable PATH entries. 5. Skills audit: Review all installed OpenClaw skills for malicious content — per AIID #1368, approximately 17% of community skills in the ClawHub ecosystem were assessed as malicious in early 2026.

What systems are affected by CVE-2026-22217?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI agent deployments, AI-assisted developer tooling, multi-agent pipelines, CI/CD with AI agents.

What is the CVSS score for CVE-2026-22217?

CVE-2026-22217 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI agent deploymentsAI-assisted developer toolingmulti-agent pipelinesCI/CD with AI agents

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0050 Command and Scripting Interpreter

AML.T0083 Credentials from AI Agent Configuration

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8.4

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-controlled binaries by exploiting trusted-prefix fallback logic for the $SHELL variable. An attacker can influence the $SHELL environment variable on systems with writable trusted-prefix directories such as /opt/homebrew/bin to execute arbitrary binaries in the OpenClaw process context.

Exploitation Scenario

An attacker with a low-privilege foothold on a macOS developer machine — obtained, for example, via a malicious OpenClaw skill distributed through ClawHub — creates a malicious binary named after the expected shell (e.g., zsh) and places it in /opt/homebrew/bin, which is writable by the local user under a default Homebrew installation. The attacker either manipulates the $SHELL environment variable directly or relies on OpenClaw's trusted-prefix fallback logic to resolve the shell binary from /opt/homebrew/bin before the system path. The next time OpenClaw's shell-env component invokes the shell — which occurs automatically during agent task execution — it runs the attacker's binary in the OpenClaw process context. From this position, the attacker exfiltrates API keys, LLM credentials, and agent configuration data, then pivots laterally to connected databases, cloud services, and any LLM APIs the agent is authorized to access.

Weaknesses (CWE)

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.