CVE-2026-62199: OpenClaw env-var filtering bypass

CISO Take

OpenClaw, an AI agent framework, fails to fully filter interpreter startup environment variables in its host execution environment, letting a lower-trust caller or a configured input path smuggle crafted variables that trigger code execution or persist actions beyond the caller's intended authorization. It's a network-exploitable, no-user-interaction flaw (CVSS 8.8) that lets an attacker holding only low privileges pivot to full compromise of confidentiality, integrity, and availability on any host running the agent's exec feature — a serious concern for deployments where OpenClaw agents execute tools on behalf of less-trusted requesters. It is not yet in CISA KEV and no public exploit or Nuclei template exists, so exploitation likelihood today is unconfirmed rather than active, but the underlying CWE-184 root cause (incomplete denylist of disallowed inputs) is a well-understood, reliably weaponizable bug class once the specific variable names circulate from the GHSA-hjr6-g723-hmfm advisory. Patch to OpenClaw 2026.6.6 or later immediately; until patched, disable or restrict the host exec environment-filtering feature for lower-trust callers and monitor agent hosts for unexpected interpreter startup variables (e.g. PYTHONSTARTUP, NODE_OPTIONS, PERL5LIB) as a detection signal.

Sources: NVD GitHub Advisory CISA KEV ATLAS vulncheck.com

What is the risk?

High risk despite the absence of confirmed in-the-wild exploitation: the CVSS 8.8 score reflects network access, low attack complexity, low privileges required, no user interaction, and full compromise of confidentiality, integrity, and availability. The root cause — an incomplete filter (CWE-184) over interpreter startup environment variables — is a well-known and easily reproducible bug class once the specific variable names and injection path are known, which lowers the bar from 'theoretical' to 'trivial-to-weaponize' as soon as a PoC surfaces. No KEV listing, EPSS score, or public exploit/Nuclei template exists yet, so near-term opportunistic scanning is unlikely, but any organization running OpenClaw agents that accept input from lower-trust callers (multi-tenant agent deployments, exposed tool endpoints, or externally configured input paths) should treat this as urgent given the authorization-bypass-to-RCE chain.

How does the attack unfold?

Initial Access

A lower-trust caller or an externally configured input path reaches OpenClaw's enabled host exec environment feature.

AML.T0053

Exploitation

The caller supplies crafted interpreter startup environment variables that OpenClaw's incomplete filter fails to strip.

AML.T0050

Authorization Escalation

The injected variables cause code to execute or actions to persist beyond the caller's intended authorization scope.

AML.T0105

Impact

The attacker achieves full compromise of confidentiality, integrity, and availability on the agent's host.

AML.T0112.000

Initial Access

A lower-trust caller or an externally configured input path reaches OpenClaw's enabled host exec environment feature.

AML.T0053

Exploitation

The caller supplies crafted interpreter startup environment variables that OpenClaw's incomplete filter fails to strip.

AML.T0050

Authorization Escalation

The injected variables cause code to execute or actions to persist beyond the caller's intended authorization scope.

AML.T0105

Impact

The attacker achieves full compromise of confidentiality, integrity, and availability on the agent's host.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade to OpenClaw 2026.6.6 or later immediately — this is the primary and only complete fix per the vendor advisory. Where immediate patching isn't possible, disable the host exec environment-filtering feature if it isn't strictly required, or restrict which callers/input paths can reach it (remove lower-trust or externally configured callers from access to host exec). Audit and tighten any allowlist/denylist logic wrapping this feature rather than relying solely on OpenClaw's built-in filtering. For detection, monitor agent host processes for anomalous interpreter startup environment variables (PYTHONSTARTUP, PYTHONPATH, NODE_OPTIONS, PERL5LIB, RUBYOPT, etc.) being set by non-privileged callers, and alert on unexpected child-process spawns from the OpenClaw exec environment. Review logs for actions taken by lower-trust identities that exceed their configured authorization scope.

How is it classified?

Auth Bypass Code Execution Agent AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0105 - Escape to Host AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system security controls

NIST AI RMF

MANAGE 4.1 - Post-deployment AI risks are monitored and responded to

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62199?

OpenClaw, an AI agent framework, fails to fully filter interpreter startup environment variables in its host execution environment, letting a lower-trust caller or a configured input path smuggle crafted variables that trigger code execution or persist actions beyond the caller's intended authorization. It's a network-exploitable, no-user-interaction flaw (CVSS 8.8) that lets an attacker holding only low privileges pivot to full compromise of confidentiality, integrity, and availability on any host running the agent's exec feature — a serious concern for deployments where OpenClaw agents execute tools on behalf of less-trusted requesters. It is not yet in CISA KEV and no public exploit or Nuclei template exists, so exploitation likelihood today is unconfirmed rather than active, but the underlying CWE-184 root cause (incomplete denylist of disallowed inputs) is a well-understood, reliably weaponizable bug class once the specific variable names circulate from the GHSA-hjr6-g723-hmfm advisory. Patch to OpenClaw 2026.6.6 or later immediately; until patched, disable or restrict the host exec environment-filtering feature for lower-trust callers and monitor agent hosts for unexpected interpreter startup variables (e.g. PYTHONSTARTUP, NODE_OPTIONS, PERL5LIB) as a detection signal.

Is CVE-2026-62199 actively exploited?

No confirmed active exploitation of CVE-2026-62199 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62199?

Upgrade to OpenClaw 2026.6.6 or later immediately — this is the primary and only complete fix per the vendor advisory. Where immediate patching isn't possible, disable the host exec environment-filtering feature if it isn't strictly required, or restrict which callers/input paths can reach it (remove lower-trust or externally configured callers from access to host exec). Audit and tighten any allowlist/denylist logic wrapping this feature rather than relying solely on OpenClaw's built-in filtering. For detection, monitor agent host processes for anomalous interpreter startup environment variables (PYTHONSTARTUP, PYTHONPATH, NODE_OPTIONS, PERL5LIB, RUBYOPT, etc.) being set by non-privileged callers, and alert on unexpected child-process spawns from the OpenClaw exec environment. Review logs for actions taken by lower-trust identities that exceed their configured authorization scope.

What systems are affected by CVE-2026-62199?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, tool execution / sandboxing environments.

What is the CVSS score for CVE-2026-62199?

CVE-2026-62199 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

agent frameworkstool execution / sandboxing environments

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0105 Escape to Host

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions beyond the caller's intended authorization.

Exploitation Scenario

An attacker with only low-level, authenticated access to an OpenClaw-based agent deployment — for example, a lower-trust API caller or a tenant in a multi-tenant agent platform — crafts a request that supplies an interpreter startup environment variable (such as a Python or Node startup hook) that OpenClaw's exec environment filter fails to strip. Because the filter's denylist is incomplete (CWE-184), the crafted variable reaches the interpreter at process startup and executes attacker-controlled code the moment the host exec environment initializes, without any user interaction and over the network. The attacker's code now runs with the elevated authorization of the agent's host process rather than the caller's intended scope, letting them read, modify, or persist changes to data and configuration, pivot to other agent tools, or maintain a foothold that outlives the original low-trust session.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs Primary CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.