CVE-2026-62203: OpenClaw env var filter gap enables

CISO Take

OpenClaw, an AI agent framework that brokers host-level command execution, ships an environment-variable filter on its host exec feature that fails to block rustup startup variables (RUSTUP_HOME, CARGO_HOME, RUSTUP_TOOLCHAIN), letting a lower-trust caller or a configured input path redirect toolchain resolution to an attacker-controlled binary and run code with authorization beyond what they were granted. This is a network-reachable, low-complexity, no-user-interaction flaw (CVSS 8.8: AV:N/AC:L/PR:L/UI:N, full confidentiality/integrity/availability impact) in a framework whose entire value proposition is safely brokering privilege between trust tiers, so any deployment that lets multiple callers, plugins, or agent sessions share a host-exec-capable OpenClaw instance is exposed to privilege escalation and persistence, not just isolated crashes. There is no EPSS score, no public PoC, no Nuclei template, and it is not (yet) in CISA KEV, so real-world exploitation data is thin — but both the vendor advisory (GHSA-wxh3-g47h-q3mc) and the VulnCheck writeup describe the escalation path as directly reproducible from an incomplete denylist (CWE-184). Patch to OpenClaw 2026.6.6 or later wherever host exec is reachable by lower-privileged callers; until patched, strip or hard-allowlist rustup/cargo environment variables at the process-spawn boundary and audit host exec logs for unexpected RUSTUP_HOME/CARGO_HOME/RUSTUP_TOOLCHAIN values or toolchain binaries resolving outside your standard install path.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High severity (CVSS 8.8) with a fully network-exploitable, low-complexity path and no user interaction required — the classic profile for rapid weaponization once a PoC surfaces. Exploitability today is tempered by the absence of EPSS scoring, a public exploit, or a Nuclei template, and by the requirement that the attacker already hold some caller access (low privileges) or control a configured input path — this is a privilege-escalation/sandbox-escape bug, not a fully unauthenticated remote exploit. The impact ceiling is severe (C:H/I:H/A:H): full host compromise is achievable if the filtered environment variables reach an exec() that resolves and runs a rustup/cargo toolchain. Any multi-tenant or multi-trust-tier OpenClaw deployment (shared agent instances, plugin marketplaces, CI-style agent runners) should treat this as urgent even without in-the-wild confirmation, since the underlying CWE-184 class (incomplete denylist) is trivial to rediscover once attackers know to look at rustup-specific variable names.

How does the attack unfold?

Entry via lower-trust caller

An attacker with restricted caller access or control over a configured input path submits data that sets rustup-related environment variables ahead of a host exec call.

AML.T0053

Filter bypass

OpenClaw's incomplete environment variable denylist (CWE-184) fails to strip RUSTUP_HOME/CARGO_HOME/RUSTUP_TOOLCHAIN, allowing the attacker-controlled values through to the exec call.

Privileged code execution

Host exec resolves the poisoned toolchain path and runs the attacker's binary with the privileges of the host exec context, exceeding the caller's authorized level.

AML.T0112.000

Persistence and impact

The redirected toolchain configuration persists across further invocations, giving the attacker a durable foothold and full confidentiality/integrity/availability compromise of the host.

AML.T0081

Entry via lower-trust caller

An attacker with restricted caller access or control over a configured input path submits data that sets rustup-related environment variables ahead of a host exec call.

AML.T0053

Filter bypass

OpenClaw's incomplete environment variable denylist (CWE-184) fails to strip RUSTUP_HOME/CARGO_HOME/RUSTUP_TOOLCHAIN, allowing the attacker-controlled values through to the exec call.

Privileged code execution

Host exec resolves the poisoned toolchain path and runs the attacker's binary with the privileges of the host exec context, exceeding the caller's authorized level.

AML.T0112.000

Persistence and impact

The redirected toolchain configuration persists across further invocations, giving the attacker a durable foothold and full confidentiality/integrity/availability compromise of the host.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch OpenClaw to version 2026.6.6 or later immediately in any environment where host exec is reachable by lower-trust callers. 2) Until patched, implement a hard allowlist (not denylist) for environment variables passed into host exec subprocess calls, explicitly excluding RUSTUP_HOME, CARGO_HOME, RUSTUP_TOOLCHAIN, RUSTUP_UPDATE_ROOT, and any other rustup/cargo-prefixed variables from caller-controlled input. 3) Run host exec in a minimally-privileged, isolated execution context (container/sandbox with no ambient toolchain access) so that even a successful variable-injection cannot reach a real rustup/cargo installation. 4) Detection: audit host exec invocation logs for unexpected RUSTUP_HOME/CARGO_HOME/RUSTUP_TOOLCHAIN values, or for toolchain binaries resolving from paths outside the standard rustup install location. 5) Review any configured input paths that feed into host exec for injectable environment-variable content.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

Clause 8.2 - Operational planning and control

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62203?

OpenClaw, an AI agent framework that brokers host-level command execution, ships an environment-variable filter on its host exec feature that fails to block rustup startup variables (RUSTUP_HOME, CARGO_HOME, RUSTUP_TOOLCHAIN), letting a lower-trust caller or a configured input path redirect toolchain resolution to an attacker-controlled binary and run code with authorization beyond what they were granted. This is a network-reachable, low-complexity, no-user-interaction flaw (CVSS 8.8: AV:N/AC:L/PR:L/UI:N, full confidentiality/integrity/availability impact) in a framework whose entire value proposition is safely brokering privilege between trust tiers, so any deployment that lets multiple callers, plugins, or agent sessions share a host-exec-capable OpenClaw instance is exposed to privilege escalation and persistence, not just isolated crashes. There is no EPSS score, no public PoC, no Nuclei template, and it is not (yet) in CISA KEV, so real-world exploitation data is thin — but both the vendor advisory (GHSA-wxh3-g47h-q3mc) and the VulnCheck writeup describe the escalation path as directly reproducible from an incomplete denylist (CWE-184). Patch to OpenClaw 2026.6.6 or later wherever host exec is reachable by lower-privileged callers; until patched, strip or hard-allowlist rustup/cargo environment variables at the process-spawn boundary and audit host exec logs for unexpected RUSTUP_HOME/CARGO_HOME/RUSTUP_TOOLCHAIN values or toolchain binaries resolving outside your standard install path.

Is CVE-2026-62203 actively exploited?

No confirmed active exploitation of CVE-2026-62203 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62203?

1) Patch OpenClaw to version 2026.6.6 or later immediately in any environment where host exec is reachable by lower-trust callers. 2) Until patched, implement a hard allowlist (not denylist) for environment variables passed into host exec subprocess calls, explicitly excluding RUSTUP_HOME, CARGO_HOME, RUSTUP_TOOLCHAIN, RUSTUP_UPDATE_ROOT, and any other rustup/cargo-prefixed variables from caller-controlled input. 3) Run host exec in a minimally-privileged, isolated execution context (container/sandbox with no ambient toolchain access) so that even a successful variable-injection cannot reach a real rustup/cargo installation. 4) Detection: audit host exec invocation logs for unexpected RUSTUP_HOME/CARGO_HOME/RUSTUP_TOOLCHAIN values, or for toolchain binaries resolving from paths outside the standard rustup install location. 5) Review any configured input paths that feed into host exec for injectable environment-variable content.

What systems are affected by CVE-2026-62203?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool invocation, host command execution pipelines.

What is the CVSS score for CVE-2026-62203?

CVE-2026-62203 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool invocationhost command execution pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0112.000 Local AI Agent

Compliance Controls Affected

ISO 42001: Clause 8.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization level.

Exploitation Scenario

An attacker with lower-trust caller access to an OpenClaw-based agent deployment (e.g., a restricted plugin, a sandboxed sub-agent, or a user submitting input through a configured ingestion path) sets a rustup-related environment variable such as RUSTUP_HOME or CARGO_HOME to point at an attacker-controlled directory. When OpenClaw's host exec feature later invokes a rustup/cargo-driven toolchain resolution step, its environment filter — built on an incomplete denylist — fails to strip these variables, so the exec resolves and runs the attacker's planted binary instead of the legitimate toolchain. The attacker's code now executes with the privileges of the host exec context, which exceeds their originally granted authorization level, and the redirected toolchain path can persist across subsequent invocations, giving the attacker a durable foothold beyond the single session that triggered the bug.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs Primary CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.