AI Threat Alert
CVE-2026-62229: OpenClaw: glob bypass in exec allowlist enables auth bypass
HIGHOpenClaw versions before 2026.5.18 contain a flaw in how the exec allowlist matches glob patterns, letting a lower-trust caller craft input paths that slip past the intended authorization boundary and execute or persist actions they should never be permitted to run. This is not a niche edge case: OpenClaw is an AI coding/automation agent where the exec allowlist is the primary control separating trusted automation from untrusted input, so a bypass here effectively converts a scoped agent into one with unrestricted command execution — the CVSS 8.8 score (network vector, low complexity, low privileges required, no user interaction) reflects how easy this is to trigger. No EPSS score is published, the CVE is not in CISA KEV, and no public exploit or Nuclei template has surfaced yet, so confirmed mass exploitation is not established, but a network-reachable authorization bypass in an agentic exec path is exactly the class of bug that gets weaponized quickly once GHSA-34mr-7r3m-gfg7 details circulate. Patch to OpenClaw 2026.5.18 or later immediately; until patched, disable or tightly restrict the exec allowlist feature, audit existing glob patterns for traversal-style entries, and review execution logs for commands run outside the expected allowlisted set.
What is the risk?
High risk. CVSS 8.8 reflects a network-exploitable, low-complexity, low-privilege authorization bypass with full confidentiality, integrity, and availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit or scanner template yet — this is a freshly disclosed vulnerability (published 2026-07-17) so absence of exploitation evidence should not be read as absence of risk. Real-world exposure depends on whether an organization has the exec allowlist feature enabled and whether OpenClaw is reachable by lower-trust callers (external users, sub-agents, plugins, or automation triggers); deployments that use OpenClaw to gate command execution for less-trusted inputs face the highest exposure.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| OpenClaw | pip | — | No patch |
Do you use OpenClaw? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
1) Upgrade OpenClaw to 2026.5.18 or later immediately — this is the primary fix. 2) If immediate patching isn't possible, disable the exec allowlist-gated feature entirely or restrict OpenClaw's exec capability to a deny-by-default posture. 3) Audit existing allowlist glob patterns for traversal-style entries (../, symlink tricks, encoded path separators) and tighten scope to exact matches where feasible. 4) Review execution/audit logs for commands or actions that fall outside the expected allowlisted pattern set since the flaw was likely introduced. 5) Run OpenClaw under least-privilege (container/sandbox isolation, non-root user) so a successful bypass has limited blast radius. 6) Track GHSA-34mr-7r3m-gfg7 and the VulnCheck advisory for IOCs or exploitation updates.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-62229?
OpenClaw versions before 2026.5.18 contain a flaw in how the exec allowlist matches glob patterns, letting a lower-trust caller craft input paths that slip past the intended authorization boundary and execute or persist actions they should never be permitted to run. This is not a niche edge case: OpenClaw is an AI coding/automation agent where the exec allowlist is the primary control separating trusted automation from untrusted input, so a bypass here effectively converts a scoped agent into one with unrestricted command execution — the CVSS 8.8 score (network vector, low complexity, low privileges required, no user interaction) reflects how easy this is to trigger. No EPSS score is published, the CVE is not in CISA KEV, and no public exploit or Nuclei template has surfaced yet, so confirmed mass exploitation is not established, but a network-reachable authorization bypass in an agentic exec path is exactly the class of bug that gets weaponized quickly once GHSA-34mr-7r3m-gfg7 details circulate. Patch to OpenClaw 2026.5.18 or later immediately; until patched, disable or tightly restrict the exec allowlist feature, audit existing glob patterns for traversal-style entries, and review execution logs for commands run outside the expected allowlisted set.
Is CVE-2026-62229 actively exploited?
No confirmed active exploitation of CVE-2026-62229 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-62229?
1) Upgrade OpenClaw to 2026.5.18 or later immediately — this is the primary fix. 2) If immediate patching isn't possible, disable the exec allowlist-gated feature entirely or restrict OpenClaw's exec capability to a deny-by-default posture. 3) Audit existing allowlist glob patterns for traversal-style entries (../, symlink tricks, encoded path separators) and tighten scope to exact matches where feasible. 4) Review execution/audit logs for commands or actions that fall outside the expected allowlisted pattern set since the flaw was likely introduced. 5) Run OpenClaw under least-privilege (container/sandbox isolation, non-root user) so a successful bypass has limited blast radius. 6) Track GHSA-34mr-7r3m-gfg7 and the VulnCheck advisory for IOCs or exploitation updates.
What systems are affected by CVE-2026-62229?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI coding/automation agents, multi-agent orchestration, CI/CD automation pipelines using AI agents.
What is the CVSS score for CVE-2026-62229?
CVE-2026-62229 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.72%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0050 Command and Scripting Interpreter AML.T0053 AI Agent Tool Invocation AML.T0107 Exploitation for Defense Evasion Compliance Controls Affected
What are the technical details?
Original Advisory
OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended authorization. Attackers can craft input paths that traverse the allowlist glob patterns to execute or persist unauthorized actions when the affected feature is enabled.
Exploitation Scenario
An attacker with low-privilege access to an OpenClaw-integrated system — for example a user submitting tasks through a lower-trust API or webhook, or a sub-agent/plugin restricted to a narrow exec scope — crafts an input path designed to syntactically satisfy a permitted glob pattern in the exec allowlist while actually resolving, via path traversal characters or glob ambiguity, to a disallowed command or target. Because the authorization check happens at the glob-matching layer rather than against a canonicalized path or explicit command identity, the crafted input slips past the intended gate. OpenClaw then executes — or persists as a scheduled/triggered action — a command outside the caller's authorized scope, running with the full privilege of the OpenClaw process and potentially reading secrets, modifying files, or establishing persistence on the agent host.
Weaknesses (CWE)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References
Timeline
Related Vulnerabilities
CVE-2026-33579 9.9 OpenClaw: scope bypass escalates low-priv to admin
Same package: openclaw CVE-2026-32922 9.9 OpenClaw: privilege escalation to RCE via token scope bypass
Same package: openclaw CVE-2026-30741 9.8 OpenClaw: RCE via request-side prompt injection
Same package: openclaw CVE-2026-32038 9.8 OpenClaw: sandbox bypass enables container lateral movement
Same package: openclaw CVE-2026-53838 9.8 OpenClaw: approval scope bypass via reconnection state
Same package: openclaw