CVE-2026-29607: OpenClaw auth bypass enables

CISO Take

OpenClaw prior to 2026.2.22 contains an authorization bypass where approval allowlists are persisted at the wrapper level rather than validated against the actual command payload, allowing an attacker to get a benign system.run command approved once and then silently substitute arbitrary payloads on subsequent calls without triggering re-approval. Although exploitation requires high privileges and user interaction (CVSS 6.8 Medium), the EPSS percentile places this in the top 66% of likely-exploited vulnerabilities, and successful exploitation yields full confidentiality, integrity, and availability impact on hosts running OpenClaw gateway and node execution flows — a particularly acute risk given AIID #1368 documented active abuse of the OpenClaw skills ecosystem just weeks before this CVE was published. With no public exploit yet available but a patch already released, the remediation window is open: upgrade to OpenClaw 2026.2.22 immediately, and if patching is not feasible, restrict system.run tool permissions to least-privilege and audit existing wrapper allowlist entries for signs of pre-positioned persistence.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium-severity by CVSS (6.8), but contextually elevated for AI agent deployments. This vulnerability directly undermines the trust model of agentic approval workflows: once a wrapper entry is allowlisted, the security check is permanently bypassable for that wrapper, creating a persistent backdoor in the agent's authorization layer. High privileges are required to seed the initial allowlist entry, but in AI agent environments where operators routinely hold elevated access, this bar may be lower than it appears. The 396 prior CVEs in this package signal a historically poor security posture, and the EPSS score at the 66th percentile suggests moderate real-world exploitation probability relative to the broader CVE population.

How does the attack unfold?

Privilege Acquisition

Attacker obtains high-privilege access to the OpenClaw agent environment, sufficient to submit commands for allow-always wrapper approval.

AML.T0012

Authorization Seeding

Attacker submits a benign system.run command and obtains a persistent allow-always wrapper allowlist entry, caching approval at the wrapper level rather than against the command payload.

AML.T0053

Defense Bypass

On subsequent invocations, attacker substitutes a malicious payload; the cached wrapper-level allowlist entry bypasses re-validation of the actual command content.

AML.T0107

Remote Code Execution

Malicious payload executes on the gateway or node-host under the agent's runtime identity, enabling credential theft, lateral movement, or persistent compromise of downstream AI infrastructure.

AML.T0050

Privilege Acquisition

Attacker obtains high-privilege access to the OpenClaw agent environment, sufficient to submit commands for allow-always wrapper approval.

AML.T0012

Authorization Seeding

Attacker submits a benign system.run command and obtains a persistent allow-always wrapper allowlist entry, caching approval at the wrapper level rather than against the command payload.

AML.T0053

Defense Bypass

On subsequent invocations, attacker substitutes a malicious payload; the cached wrapper-level allowlist entry bypasses re-validation of the actual command content.

AML.T0107

Remote Code Execution

Malicious payload executes on the gateway or node-host under the agent's runtime identity, enabling credential theft, lateral movement, or persistent compromise of downstream AI infrastructure.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR High

UI Required

S Unchanged

C High

I High

A High

What should I do?

4 steps

Patch: Upgrade to OpenClaw >= 2026.2.22 immediately (fix commit 24c954d972400f508814532dea0e4dcb38418bb0).
Workaround if patching is delayed: disable allow-always wrapper configurations entirely and require per-invocation payload validation rather than cached wrapper-level approval.
Detection: audit OpenClaw allowlist persistence entries for unexpected system.run wrappers; monitor agent execution logs for system.run calls where the live payload diverges from the originally approved command.
Containment: run OpenClaw agents with least-privilege OS identities and enforce network segmentation to limit RCE blast radius to the agent node.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration AML.T0107 - Exploitation for Defense Evasion AML.T0110 - AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.1 - AI system authorization and access control

NIST AI RMF

MANAGE 2.2 - Mechanisms exist to sustain effectiveness of AI risk management

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-29607?

OpenClaw prior to 2026.2.22 contains an authorization bypass where approval allowlists are persisted at the wrapper level rather than validated against the actual command payload, allowing an attacker to get a benign system.run command approved once and then silently substitute arbitrary payloads on subsequent calls without triggering re-approval. Although exploitation requires high privileges and user interaction (CVSS 6.8 Medium), the EPSS percentile places this in the top 66% of likely-exploited vulnerabilities, and successful exploitation yields full confidentiality, integrity, and availability impact on hosts running OpenClaw gateway and node execution flows — a particularly acute risk given AIID #1368 documented active abuse of the OpenClaw skills ecosystem just weeks before this CVE was published. With no public exploit yet available but a patch already released, the remediation window is open: upgrade to OpenClaw 2026.2.22 immediately, and if patching is not feasible, restrict system.run tool permissions to least-privilege and audit existing wrapper allowlist entries for signs of pre-positioned persistence.

Is CVE-2026-29607 actively exploited?

No confirmed active exploitation of CVE-2026-29607 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-29607?

1. Patch: Upgrade to OpenClaw >= 2026.2.22 immediately (fix commit 24c954d972400f508814532dea0e4dcb38418bb0). 2. Workaround if patching is delayed: disable allow-always wrapper configurations entirely and require per-invocation payload validation rather than cached wrapper-level approval. 3. Detection: audit OpenClaw allowlist persistence entries for unexpected system.run wrappers; monitor agent execution logs for system.run calls where the live payload diverges from the originally approved command. 4. Containment: run OpenClaw agents with least-privilege OS identities and enforce network segmentation to limit RCE blast radius to the agent node.

What systems are affected by CVE-2026-29607?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI orchestration platforms, multi-agent pipelines.

What is the CVSS score for CVE-2026-29607?

CVE-2026-29607 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI orchestration platformsmulti-agent pipelines

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

AML.T0107 Exploitation for Defense Evasion

AML.T0110 AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.1

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval checks by persisting wrapper-level allowlist entries instead of validating inner executable intent. Remote attackers can approve benign wrapped system.run commands and subsequently execute different payloads without approval, enabling remote code execution on gateway and node-host execution flows.

Exploitation Scenario

An attacker with high-privilege access to an OpenClaw environment crafts a benign system.run command (e.g., 'echo ok') and submits it for allow-always approval, obtaining a persistent wrapper-level allowlist entry. On subsequent executions, the attacker substitutes a malicious payload — a reverse shell, credential harvester, or exfiltration script — in place of the approved command. Because authorization is checked against the wrapper identity rather than the actual command content, the malicious payload executes on the gateway or node-host without triggering re-approval. In AI agent contexts this enables exfiltration of API keys and model configurations stored in the agent environment, lateral movement to adjacent AI infrastructure, or deployment of persistent backdoors in automated agentic pipelines.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.