CVE-2026-62222: OpenClaw untrusted plugin loading

CISO Take

OpenClaw before version 2026.5.22 auto-loads plugins discovered during its setup-mode workspace scan without verifying their trust level (CWE-829), letting a lower-trust caller or anyone who controls a configured input path get code executed with the invoking agent process's privileges. There's no active-exploitation signal here — it's not in CISA KEV, there's no EPSS score, and no public exploit or Nuclei template exists — but the CVSS 7.8 (C:H/I:H/A:H) reflects that a successful trigger gives full confidentiality, integrity, and availability impact on the host, and downstream exposure is unverified (package risk score 0/100, dependents unknown). Because exploitation requires user interaction — an operator running setup-mode discovery against an untrusted workspace or repo — this is a trust-boundary failure in an AI agent's plugin loading flow rather than a remote unauthenticated bug, but it's exactly the class of agentic-AI supply-chain risk security teams should be modeling for as agent tooling spreads. Patch to OpenClaw 2026.5.22+ immediately; until then, never run setup-mode against workspaces or configured input paths you haven't reviewed, and audit existing agent hosts for unexpected plugin files or configs.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

CVSS 7.8 (local, low complexity, no privileges required, but user interaction required) with high impact across confidentiality, integrity, and availability. The attack requires the victim (or an automated pipeline acting on their behalf) to run OpenClaw's setup-mode discovery against a workspace or input path an attacker has influenced — this is a realistic scenario in shared-repo, CI, or onboarding workflows where 'trusted' workspaces aren't actually vetted. No evidence of active exploitation (no KEV listing, no EPSS score, no public PoC or scanner template), and package popularity/dependent count is unknown, so near-term mass exploitation is unlikely. However, the vulnerability class — automatic execution of untrusted code discovered via a scan — is straightforward to weaponize once understood, and the lack of telemetry on this package means blast radius can't be confidently bounded. Treat as high priority to patch, moderate priority for active threat-hunting.

How does the attack unfold?

Malicious plugin staging

A lower-trust caller places a crafted plugin in a shared repo or workspace path that will later be scanned by OpenClaw's setup-mode discovery.

AML.T0010.005

Untrusted auto-load

A legitimate user or CI job runs OpenClaw setup-mode against that workspace; discovery loads the plugin without validating its trust level.

AML.T0110

Authorization escalation

The loaded plugin executes or persists actions beyond the caller's intended authorization scope, potentially modifying agent configuration.

AML.T0081

Host compromise

The attacker achieves code execution with full confidentiality, integrity, and availability impact on the host running the agent.

AML.T0112.000

Malicious plugin staging

A lower-trust caller places a crafted plugin in a shared repo or workspace path that will later be scanned by OpenClaw's setup-mode discovery.

AML.T0010.005

Untrusted auto-load

A legitimate user or CI job runs OpenClaw setup-mode against that workspace; discovery loads the plugin without validating its trust level.

AML.T0110

Authorization escalation

The loaded plugin executes or persists actions beyond the caller's intended authorization scope, potentially modifying agent configuration.

AML.T0081

Host compromise

The attacker achieves code execution with full confidentiality, integrity, and availability impact on the host running the agent.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade to OpenClaw 2026.5.22 or later immediately. 2) Until patched, do not run setup-mode discovery against workspaces, repos, or configured input paths that haven't been reviewed by a trusted party — treat setup-mode the same as running arbitrary code from that source. 3) Audit existing OpenClaw installs for unexpected or unrecognized plugin files introduced via prior setup-mode runs. 4) Restrict who can write to paths OpenClaw scans during setup (repo write access, shared directories, CI checkout paths). 5) For detection, monitor process/file-execution telemetry on hosts running OpenClaw for child processes or file loads originating from plugin directories immediately after a setup-mode invocation.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Auth Bypass Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0011.002 - Poisoned AI Agent Tool AML.T0081 - Modify AI Agent Configuration AML.T0110 - AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Third-party and supplier relationships in the AI system lifecycle

NIST AI RMF

MANAGE-1.3 - Third-party and supply-chain risk response

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62222?

OpenClaw before version 2026.5.22 auto-loads plugins discovered during its setup-mode workspace scan without verifying their trust level (CWE-829), letting a lower-trust caller or anyone who controls a configured input path get code executed with the invoking agent process's privileges. There's no active-exploitation signal here — it's not in CISA KEV, there's no EPSS score, and no public exploit or Nuclei template exists — but the CVSS 7.8 (C:H/I:H/A:H) reflects that a successful trigger gives full confidentiality, integrity, and availability impact on the host, and downstream exposure is unverified (package risk score 0/100, dependents unknown). Because exploitation requires user interaction — an operator running setup-mode discovery against an untrusted workspace or repo — this is a trust-boundary failure in an AI agent's plugin loading flow rather than a remote unauthenticated bug, but it's exactly the class of agentic-AI supply-chain risk security teams should be modeling for as agent tooling spreads. Patch to OpenClaw 2026.5.22+ immediately; until then, never run setup-mode against workspaces or configured input paths you haven't reviewed, and audit existing agent hosts for unexpected plugin files or configs.

Is CVE-2026-62222 actively exploited?

No confirmed active exploitation of CVE-2026-62222 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62222?

1) Upgrade to OpenClaw 2026.5.22 or later immediately. 2) Until patched, do not run setup-mode discovery against workspaces, repos, or configured input paths that haven't been reviewed by a trusted party — treat setup-mode the same as running arbitrary code from that source. 3) Audit existing OpenClaw installs for unexpected or unrecognized plugin files introduced via prior setup-mode runs. 4) Restrict who can write to paths OpenClaw scans during setup (repo write access, shared directories, CI checkout paths). 5) For detection, monitor process/file-execution telemetry on hosts running OpenClaw for child processes or file loads originating from plugin directories immediately after a setup-mode invocation.

What systems are affected by CVE-2026-62222?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool/plugin ecosystems, developer/local agent tooling, CI/CD agent bootstrap pipelines.

What is the CVSS score for CVE-2026-62222?

CVE-2026-62222 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool/plugin ecosystemsdeveloper/local agent toolingCI/CD agent bootstrap pipelines

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0011.002 Poisoned AI Agent Tool

AML.T0081 Modify AI Agent Configuration

AML.T0110 AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-1.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level.

Exploitation Scenario

An attacker with lower-trust access to a shared repository or workspace (e.g., an external contributor, or someone who can influence a configured input path in a CI pipeline) plants a malicious plugin file structured to be picked up by OpenClaw's setup-mode discovery. A legitimate user or automated job then runs OpenClaw setup against that workspace as part of normal onboarding or CI bootstrap. Setup-mode discovery finds and loads the plugin without checking its trust level, executing the attacker's code with the invoking process's privileges — persisting a backdoor, exfiltrating credentials accessible to the agent, or performing actions beyond the original caller's intended authorization scope.

Weaknesses (CWE)

CWE-829 Inclusion of Functionality from Untrusted Control Sphere Primary CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.