CVE-2026-29608: OpenClaw argv rewrite bypasses

CISO Take

CVE-2026-29608 allows an attacker with low local privileges to execute arbitrary code through OpenClaw's system.run node-host by pre-positioning a malicious script in the agent's working directory — the approval dialog shows the operator a benign command, but argv rewriting causes OpenClaw to run the attacker's script instead. The strategic concern for CISOs is that this attack specifically nullifies the human-in-the-loop approval control, the core governance safeguard for agentic AI deployments; operators believe they are authorizing a known action while a completely different payload executes. Despite a 6.7 CVSS, EPSS places this in the top 97th percentile of exploitation likelihood, and the package carries 396 other CVEs signaling systemic quality issues. Apply the patch from commit dded569 immediately, restrict OpenClaw working directories to ACL-enforced read-only paths as a workaround, and audit process execution logs for argv discrepancies between approval records and actual kernel-visible arguments.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

The CVSS 6.7 medium score understates operational risk in AI agent deployments. Attack Complexity:High reflects the file system write prerequisite, but shared developer workstations, CI runners, and container-based agent platforms commonly provide exactly this access to low-privilege users or co-tenants. The CIA impact triple — Confidentiality:High, Integrity:High, Availability:High — reflects full compromise potential once triggered. The approval-bypass nature is a force multiplier: organizations that have accepted residual risk on the assumption that human oversight contains agentic execution are now operating without that control. EPSS top 97th percentile indicates active research interest ahead of a likely public exploit. Not in CISA KEV but the absence of active exploitation evidence should not be confused with low urgency given the attack's stealth characteristics.

How does the attack unfold?

Pre-positioning

Attacker with low local privileges writes a malicious executable to OpenClaw's working directory, named to shadow a command the agent commonly invokes via system.run.

AML.T0099

Approval Deception

OpenClaw surfaces the original benign command text in the operator approval dialog; the operator grants approval unaware that argv rewriting will substitute the attacker's local script at execution time.

AML.T0107

Unauthorized Execution

system.run resolves the command via the working directory and executes the attacker's script under the agent's privilege context instead of the approved binary.

AML.T0053

Impact

Attacker achieves full CIA compromise — credential exfiltration from environment variables, backdoor installation in build artifacts, or lateral movement to cloud APIs and databases accessible from the agent's session.

AML.T0112.000

Pre-positioning

Attacker with low local privileges writes a malicious executable to OpenClaw's working directory, named to shadow a command the agent commonly invokes via system.run.

AML.T0099

Approval Deception

OpenClaw surfaces the original benign command text in the operator approval dialog; the operator grants approval unaware that argv rewriting will substitute the attacker's local script at execution time.

AML.T0107

Unauthorized Execution

system.run resolves the command via the working directory and executes the attacker's script under the agent's privilege context instead of the approved binary.

AML.T0053

Impact

Attacker achieves full CIA compromise — credential exfiltration from environment variables, backdoor installation in build artifacts, or lateral movement to cloud APIs and databases accessible from the agent's session.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.7 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR Low

UI Required

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Apply commit dded569626b0d8e7bdab10b5e7528b6caf73a0f1 or the first tagged release that includes it per the vendor advisory at GHSA-h3rm-6x7g-882f.
Workaround (pre-patch): Enforce read-only working directories for OpenClaw processes via OS ACLs, AppArmor profiles, or SELinux policy — deny write access to the cwd for any process outside the OpenClaw service account.
Hardening: Run OpenClaw in a minimal-privilege OCI container with a read-only filesystem mount for the working directory and a separate writable scratch volume isolated per-invocation.
Detection: Deploy auditd or eBPF-based process tracing to capture actual argv at execve() and compare against approval audit logs — divergence is a high-fidelity indicator.
Privilege hygiene: Verify OpenClaw does not run with access to cloud credentials, API keys, or secret stores beyond its minimum operational need.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Plugin AML.T0011 - User Execution AML.T0053 - AI Agent Tool Invocation AML.T0099 - AI Agent Tool Data Poisoning AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 14 - Human oversight Article 9 - Risk management system

ISO 42001

A.10 - AI system security

NIST AI RMF

GOVERN 6.1 - Organizational risk policies for AI

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-29608?

CVE-2026-29608 allows an attacker with low local privileges to execute arbitrary code through OpenClaw's system.run node-host by pre-positioning a malicious script in the agent's working directory — the approval dialog shows the operator a benign command, but argv rewriting causes OpenClaw to run the attacker's script instead. The strategic concern for CISOs is that this attack specifically nullifies the human-in-the-loop approval control, the core governance safeguard for agentic AI deployments; operators believe they are authorizing a known action while a completely different payload executes. Despite a 6.7 CVSS, EPSS places this in the top 97th percentile of exploitation likelihood, and the package carries 396 other CVEs signaling systemic quality issues. Apply the patch from commit dded569 immediately, restrict OpenClaw working directories to ACL-enforced read-only paths as a workaround, and audit process execution logs for argv discrepancies between approval records and actual kernel-visible arguments.

Is CVE-2026-29608 actively exploited?

No confirmed active exploitation of CVE-2026-29608 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-29608?

1. Patch: Apply commit dded569626b0d8e7bdab10b5e7528b6caf73a0f1 or the first tagged release that includes it per the vendor advisory at GHSA-h3rm-6x7g-882f. 2. Workaround (pre-patch): Enforce read-only working directories for OpenClaw processes via OS ACLs, AppArmor profiles, or SELinux policy — deny write access to the cwd for any process outside the OpenClaw service account. 3. Hardening: Run OpenClaw in a minimal-privilege OCI container with a read-only filesystem mount for the working directory and a separate writable scratch volume isolated per-invocation. 4. Detection: Deploy auditd or eBPF-based process tracing to capture actual argv at execve() and compare against approval audit logs — divergence is a high-fidelity indicator. 5. Privilege hygiene: Verify OpenClaw does not run with access to cloud credentials, API keys, or secret stores beyond its minimum operational need.

What systems are affected by CVE-2026-29608?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, CI/CD automation pipelines, developer workstation AI assistants, multi-tenant AI execution environments.

What is the CVSS score for CVE-2026-29608?

CVE-2026-29608 has a CVSS v3.1 base score of 6.7 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworksCI/CD automation pipelinesdeveloper workstation AI assistantsmulti-tenant AI execution environments

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0053 AI Agent Tool Invocation

AML.T0099 AI Agent Tool Data Poisoning

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 14, Article 9

ISO 42001: A.10

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text.

Exploitation Scenario

An insider or compromised low-privilege account on a CI runner writes a shell script named to shadow a common system command (e.g., 'ls', 'git', or a frequently-approved tool) into the working directory of an OpenClaw workflow. When an automated pipeline or developer session triggers a system.run action calling that command, OpenClaw's approval dialog surfaces the benign original command string to the operator. The operator approves. OpenClaw's argv rewriting mechanism resolves the command via the working directory first, executing the attacker's script instead of the system binary. The script exfiltrates CI environment variables (cloud credentials, API tokens, signing keys) to an external endpoint, injects a backdoor into build artifacts, or pivots laterally to adjacent services accessible from the CI environment — all under the cover of an operator-sanctioned action.

Weaknesses (CWE)

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE-88 — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'): The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

[Implementation] Where possible, avoid building a single string that contains the command and its arguments. Some languages or frameworks have functions that support specifying independent arguments, e.g. as an array, which is used to automatically perform the appropriate quoting or escaping while building the command. For example, in PHP, escapeshellarg() can be used to escape a single argument to system(), or exec() can be called with an array of arguments. In C, code can often be refactored from using system() - which accepts a single string - to using exec(), which requires separate function arguments for each parameter.
[Architecture and Design] Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application. Perform input validation at well-defined interfaces.

Source: MITRE CWE corpus.