CVE-2026-62200: OpenClaw Git ext transport flaw

CISO Take

OpenClaw before version 2026.6.6 fails to properly filter its host execution environment, letting Git's rarely-used "ext::" transport scheme slip through and run arbitrary commands on the host. This matters because OpenClaw is an AI agent tool that routinely shells out to Git for cloning, fetching, or tool-discovery operations — a network-reachable, low-complexity path (CVSS 8.8, AV:N/AC:L/UI:N) means a lower-trust caller or a maliciously configured input, such as a poisoned repository URL fed to the agent, can execute or persist actions well beyond its intended authorization boundary. There is no CISA KEV listing, no EPSS score, and no known public exploit or Nuclei template yet, so this has not been weaponized in the wild as far as public data shows, but the low exploitation bar and the high blast radius of an AI agent with host exec access make it a strong candidate for opportunistic exploitation once technical details circulate. Patch to OpenClaw 2026.6.6 or later immediately; if patching is delayed, disable or restrict any feature that lets OpenClaw invoke Git against attacker-influenceable URLs and set `GIT_ALLOW_PROTOCOL` to an explicit allowlist that excludes `ext`. Detection teams should hunt for `git` child processes spawned by the OpenClaw process with `ext::` in the command line or unexpected shell invocations originating from the agent's exec environment.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk in practice despite the absence of confirmed active exploitation. The CVSS 8.8 vector reflects a network-reachable, low-complexity, no-user-interaction path to full compromise of confidentiality, integrity, and availability once a lower-trust input reaches the affected exec filtering. Privileges required is low, meaning the attacker only needs minimal standing access (e.g., ability to submit a URL or configuration value the agent processes) rather than pre-authenticated administrative access. The absence of EPSS scoring, KEV listing, public exploit code, and a Nuclei template indicates this is not yet under mass scanning or opportunistic exploitation, but Git ext-transport command injection is a well-understood technique class, so time-to-weaponization once details are public is likely short. Organizations running OpenClaw as an autonomous or semi-autonomous coding/ops agent with network-reachable input paths should treat this as urgent.

How does the attack unfold?

Entry point

A lower-trust caller or attacker-controlled configuration value supplies a Git URL/input path that OpenClaw's agent will process.

AML.T0053

Exploitation

The crafted URL uses Git's ext:: transport, which the flawed host exec filtering fails to block, causing the embedded command to execute.

AML.T0050

Authorization bypass / persistence

Actions execute or persist with privileges beyond what the calling context was authorized for, effectively escalating within the host.

AML.T0112.000

Impact

The attacker achieves code execution on the host running OpenClaw, enabling data theft, lateral movement, or persistent compromise.

Entry point

A lower-trust caller or attacker-controlled configuration value supplies a Git URL/input path that OpenClaw's agent will process.

AML.T0053

Exploitation

The crafted URL uses Git's ext:: transport, which the flawed host exec filtering fails to block, causing the embedded command to execute.

AML.T0050

Authorization bypass / persistence

Actions execute or persist with privileges beyond what the calling context was authorized for, effectively escalating within the host.

AML.T0112.000

Impact

The attacker achieves code execution on the host running OpenClaw, enabling data theft, lateral movement, or persistent compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade OpenClaw to 2026.6.6 or later immediately — this is the primary fix. 2) If immediate patching isn't possible, restrict Git protocol handling on any host running OpenClaw via GIT_ALLOW_PROTOCOL (explicit allowlist excluding ext) or equivalent transport filtering at the OS/network layer. 3) Audit any code paths where OpenClaw accepts externally-influenced repository URLs, package specifiers, or configuration that could reach a Git invocation, and add input validation ahead of the agent layer as defense-in-depth. 4) Run OpenClaw's exec environment with least privilege (dedicated non-root user, container/sandbox isolation, no unnecessary credentials in environment) so that even a successful ext-transport abuse has limited blast radius. 5) Detection: monitor for git subprocess invocations containing ext:: and for unexpected shell/process spawns originating from the OpenClaw process tree; alert on Git operations against URLs not matching an expected allowlist of remotes.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.3 - AI system operational security controls

NIST AI RMF

MANAGE-2.3 - Mechanisms are in place to monitor AI system exposure and vulnerabilities

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62200?

OpenClaw before version 2026.6.6 fails to properly filter its host execution environment, letting Git's rarely-used "ext::" transport scheme slip through and run arbitrary commands on the host. This matters because OpenClaw is an AI agent tool that routinely shells out to Git for cloning, fetching, or tool-discovery operations — a network-reachable, low-complexity path (CVSS 8.8, AV:N/AC:L/UI:N) means a lower-trust caller or a maliciously configured input, such as a poisoned repository URL fed to the agent, can execute or persist actions well beyond its intended authorization boundary. There is no CISA KEV listing, no EPSS score, and no known public exploit or Nuclei template yet, so this has not been weaponized in the wild as far as public data shows, but the low exploitation bar and the high blast radius of an AI agent with host exec access make it a strong candidate for opportunistic exploitation once technical details circulate. Patch to OpenClaw 2026.6.6 or later immediately; if patching is delayed, disable or restrict any feature that lets OpenClaw invoke Git against attacker-influenceable URLs and set `GIT_ALLOW_PROTOCOL` to an explicit allowlist that excludes `ext`. Detection teams should hunt for `git` child processes spawned by the OpenClaw process with `ext::` in the command line or unexpected shell invocations originating from the agent's exec environment.

Is CVE-2026-62200 actively exploited?

No confirmed active exploitation of CVE-2026-62200 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62200?

1) Upgrade OpenClaw to 2026.6.6 or later immediately — this is the primary fix. 2) If immediate patching isn't possible, restrict Git protocol handling on any host running OpenClaw via `GIT_ALLOW_PROTOCOL` (explicit allowlist excluding `ext`) or equivalent transport filtering at the OS/network layer. 3) Audit any code paths where OpenClaw accepts externally-influenced repository URLs, package specifiers, or configuration that could reach a Git invocation, and add input validation ahead of the agent layer as defense-in-depth. 4) Run OpenClaw's exec environment with least privilege (dedicated non-root user, container/sandbox isolation, no unnecessary credentials in environment) so that even a successful ext-transport abuse has limited blast radius. 5) Detection: monitor for `git` subprocess invocations containing `ext::` and for unexpected shell/process spawns originating from the OpenClaw process tree; alert on Git operations against URLs not matching an expected allowlist of remotes.

What systems are affected by CVE-2026-62200?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, coding/DevOps agents with Git integration, CI/CD-integrated agent pipelines, multi-tenant agent deployments.

What is the CVSS score for CVE-2026-62200?

CVE-2026-62200 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

agent frameworkscoding/DevOps agents with Git integrationCI/CD-integrated agent pipelinesmulti-tenant agent deployments

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0112.000 Local AI Agent

Compliance Controls Affected

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.

Exploitation Scenario

An attacker identifies an OpenClaw deployment where a lower-trust source — a webhook payload, a PR/issue body, an LLM tool-call argument, or a configuration file supplied by a less-trusted tenant — can influence a Git operation the agent performs. The attacker crafts a Git remote URL using the `ext::` transport scheme (e.g., `ext::sh -c 'attacker command'`), which under normal Git semantics executes an arbitrary local command instead of performing a network fetch. Because OpenClaw's host exec environment filtering does not adequately block this transport, the crafted URL reaches Git and the embedded command executes with the privileges of the OpenClaw process — well beyond the caller's intended authorization. From there the attacker has established code execution on the host, which they can use to exfiltrate secrets from the agent's environment, pivot to other systems reachable from that host, or persist by modifying the agent's configuration or tooling.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs Primary CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.