CVE-2026-27524: OpenClaw prototype pollution

CISO Take

OpenClaw versions before 2026.2.21 contain a prototype pollution flaw (CWE-1321) in the /debug set override path, enabling any low-privileged user with debug access to inject __proto__, constructor, or prototype keys and corrupt shared JavaScript object prototypes at runtime. While the CVSS score is medium (4.3), this vulnerability sits at the 86th EPSS percentile, meaning it is more likely to be exploited than 86% of published CVEs — and OpenClaw's track record of 396 CVEs in the same package signals systemic code quality issues that warrant elevated scrutiny. In an AI agent context, a command gate bypass does not stay contained: once authorization checks evaluate against adversary-controlled prototype values, restricted agent operations — privileged tool calls, sensitive workflows, system-level commands — become accessible to any user who can reach the debug endpoint. Upgrade to 2026.2.21 immediately; if patching is blocked, restrict /debug set to hardened admin accounts and audit agent permission grants for unauthorized debug access.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Risk is moderate-to-elevated in AI agent deployments despite the medium CVSS score. The low privileges required (PR:L) and network-accessible attack vector mean any developer or service account with debug permissions is a potential threat actor — no admin escalation needed before reaching the debug endpoint. The integrity impact is bounded to command gate bypass rather than data exfiltration or model corruption, but within agentic pipelines where agents autonomously chain tool calls, that bypass can cascade to unrestricted command execution. The package's 396-CVE history and only 4 downstream dependents limits external blast radius, but the 86th EPSS percentile and the openly published patch commit mean a working exploit is straightforward to derive. Organizations running OpenClaw in internal developer environments or CI/CD pipelines should treat this as P2 remediation.

How does the attack unfold?

Initial Access

Attacker authenticates to the OpenClaw agent using low-privilege credentials — a developer account, compromised service account, or any user with /debug set permissions — no admin escalation required.

AML.T0012

Exploitation

Attacker sends a crafted /debug set override payload containing prototype-reserved keys (__proto__, constructor, or prototype) that OpenClaw fails to sanitize before applying to the runtime override object.

AML.T0049

Defense Evasion

Polluted prototype properties propagate through JavaScript's prototype chain, causing the agent's command gate authorization checks to evaluate adversary-controlled values, silently bypassing role-based access restrictions.

AML.T0107

Impact

Attacker invokes previously restricted agent commands — privileged tool calls, sensitive configuration reads, or system-level operations — that the compromised command gate now permits without enforcement.

AML.T0053

Initial Access

Attacker authenticates to the OpenClaw agent using low-privilege credentials — a developer account, compromised service account, or any user with /debug set permissions — no admin escalation required.

AML.T0012

Exploitation

Attacker sends a crafted /debug set override payload containing prototype-reserved keys (__proto__, constructor, or prototype) that OpenClaw fails to sanitize before applying to the runtime override object.

AML.T0049

Defense Evasion

Polluted prototype properties propagate through JavaScript's prototype chain, causing the agent's command gate authorization checks to evaluate adversary-controlled values, silently bypassing role-based access restrictions.

AML.T0107

Impact

Attacker invokes previously restricted agent commands — privileged tool calls, sensitive configuration reads, or system-level operations — that the compromised command gate now permits without enforcement.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.2.21 or later (patch commit fbb79d4013000552d6a2c23b9613d8b3cb92f6b6).
Restrict: If immediate patching is blocked, revoke /debug set permissions from all non-admin accounts; this is the single access control gate protecting the vulnerable path.
Detect: Audit /debug set call logs for payloads containing __proto__, constructor, or prototype as key names — any such pattern indicates active exploitation attempts and should trigger an alert.
Validate: Audit agent permission grants and reset agent configurations to known-good baselines in case the command gate was already bypassed before detection.
Inventory: Identify any internal tooling or CI pipelines that depend on OpenClaw and apply the patch upstream before re-enabling those integrations.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.1.6 - AI system security

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain AI risk management

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-27524?

OpenClaw versions before 2026.2.21 contain a prototype pollution flaw (CWE-1321) in the /debug set override path, enabling any low-privileged user with debug access to inject __proto__, constructor, or prototype keys and corrupt shared JavaScript object prototypes at runtime. While the CVSS score is medium (4.3), this vulnerability sits at the 86th EPSS percentile, meaning it is more likely to be exploited than 86% of published CVEs — and OpenClaw's track record of 396 CVEs in the same package signals systemic code quality issues that warrant elevated scrutiny. In an AI agent context, a command gate bypass does not stay contained: once authorization checks evaluate against adversary-controlled prototype values, restricted agent operations — privileged tool calls, sensitive workflows, system-level commands — become accessible to any user who can reach the debug endpoint. Upgrade to 2026.2.21 immediately; if patching is blocked, restrict /debug set to hardened admin accounts and audit agent permission grants for unauthorized debug access.

Is CVE-2026-27524 actively exploited?

No confirmed active exploitation of CVE-2026-27524 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-27524?

1. Patch: Upgrade OpenClaw to 2026.2.21 or later (patch commit fbb79d4013000552d6a2c23b9613d8b3cb92f6b6). 2. Restrict: If immediate patching is blocked, revoke /debug set permissions from all non-admin accounts; this is the single access control gate protecting the vulnerable path. 3. Detect: Audit /debug set call logs for payloads containing __proto__, constructor, or prototype as key names — any such pattern indicates active exploitation attempts and should trigger an alert. 4. Validate: Audit agent permission grants and reset agent configurations to known-good baselines in case the command gate was already bypassed before detection. 5. Inventory: Identify any internal tooling or CI pipelines that depend on OpenClaw and apply the patch upstream before re-enabling those integrations.

What systems are affected by CVE-2026-27524?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agentic pipelines, AI agent orchestration, multi-agent systems.

What is the CVSS score for CVE-2026-27524?

CVE-2026-27524 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagentic pipelinesAI agent orchestrationmulti-agent systems

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.1.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authorized /debug set callers can inject __proto__, constructor, or prototype keys to manipulate object prototypes and bypass command gate restrictions.

Exploitation Scenario

An attacker with low-privilege access to an OpenClaw-powered AI agent — such as an internal developer, a compromised CI service account, or a threat actor who phished a user with debug permissions — issues a /debug set override call with a payload containing {'__proto__': {'isAdmin': true}} or {'constructor': {'prototype': {'allowedCommands': ['*']}}}. This pollutes the shared JavaScript object prototype, causing subsequent command gate authorization checks to read adversary-controlled values from the prototype chain instead of the legitimate role-based access control list. The attacker can then invoke previously restricted agent commands — privileged tool calls, sensitive configuration reads, or system-level operations — without triggering the intended access controls. Given OpenClaw's documented skills ecosystem and prior abuse of that ecosystem to deliver credential stealers (AIID #1368), an adversary could chain this with malicious skill invocation to execute code outside the intended agent sandbox with minimal detection footprint.

Weaknesses (CWE)

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'): The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

[Implementation] By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
[Architecture and Design] By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Source: MITRE CWE corpus.