Loading story…
Three high-severity flaws in the open-source AI coding assistant OpenClaw can be chained so that a single WhatsApp message leads to credential theft, privilege escalation, arbitrary code execution, and escape from the tool's Docker-based sandbox to the host. Researcher Chinmohan Nayak showed that attacker-crafted prompts disguised as normal debugging requests could exploit unsafe handling of untrusted input in OpenClaw 2026.6.1, including an environment-variable filter bypass, command execution via Git's ext:: transport helper, and a parent-directory bypass in sandbox bind mounts.
The sandbox bypass could expose sensitive material such as SSH keys, AWS credentials, GPG secrets, and even the Docker socket, enabling broader compromise without any prior foothold on the target system. The issues are tracked as GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, and GHSA-575v-8hfq-m3mc, and were fixed in OpenClaw 2026.6.6; users were urged to upgrade, enable sandbox mode for non-main sessions, restrict exec in tool allowlists, watch for malicious git clone activity involving the ext:: protocol, limit direct-message pairing from untrusted numbers, and rotate credentials if exposure is suspected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The three disclosed vulnerabilities, tracked as GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, and GHSA-575v-8hfq-m3mc, were fixed in OpenClaw version 2026.6.6. OpenClaw advised users to upgrade and apply mitigations such as enabling sandbox mode for non-main sessions and restricting exec in tool allowlists.
Researcher Chinmohan Nayak detailed three high-severity vulnerabilities in OpenClaw that can be chained from a single WhatsApp message to achieve credential theft, privilege escalation, arbitrary code execution, and host escape. The issues affect OpenClaw 2026.6.1 and include an environment variable filter bypass, Git ext:: transport command execution, and a sandbox parent-directory bypass.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the self-hosted **OpenClaw** AI agent can be manipulated through both phishing-style social engineering and prompt-injection-style inputs to expose sensitive data and perform attacker-directed actions. In Varonis Threat Labs simulations, an OpenClaw email agent connected to Gmail, browser tools, Google Workspace APIs, and internal data sources forwarded mock **AWS IAM keys**, database credentials, SSH details, and a synthetic customer export after receiving urgent or routine-looking messages impersonating trusted colleagues. The tests found the agent was better at spotting technical phishing indicators such as fake login pages, malicious links, and suspicious OAuth prompts than at verifying sender identity and resisting social pressure, and showed stricter phishing-aware settings still failed in some scenarios. Separate research from Imperva found hidden instructions embedded in shared contacts, vCards, and location pins were flattened into prompt text without being labeled untrusted, allowing the model in testing to download and execute a researcher-controlled script. OpenClaw reportedly patched that issue in version `2026.4.23`, and researchers also cited patched allowlist-bypass flaws in multiple messaging extensions. Across the findings, the common risk was agents that can read private data, ingest untrusted content, and send information outward; recommended mitigations included updating OpenClaw, restricting connector and outbound communication access, enforcing policy controls, and requiring **human approval** for high-risk actions.
Jun 29, 2026
OpenClaw disclosed several high-severity vulnerabilities that can lead to arbitrary code execution and security control bypass across recent releases. **CVE-2026-35641** affects versions before `2026.3.24` and lets a malicious local plugin or hook package use a crafted `.npmrc` file to override the `git` executable during `npm install`, resulting in arbitrary program execution. **CVE-2026-41349** affects versions before `2026.3.28` and allows low-privileged remote attackers to bypass execution approval through `config.patch`, silently disabling agentic consent protections. Belgium's Centre for Cybersecurity warned that multiple OpenClaw flaws can lead to RCE and urged immediate patching. Additional OpenClaw issues published shortly after expand the attack surface. **CVE-2026-41336** affects versions before `2026.3.31` and allows workspace `.env` files to override `OPENCLAW_BUNDLED_HOOKS_DIR`, causing trusted bundled hooks to be replaced with attacker-controlled code from untrusted workspaces. **CVE-2026-41352**, also fixed in `2026.3.31`, allows a device-paired node to bypass the node scope gate and execute arbitrary node commands on the host without proper pairing validation. Separately, the Node.js package **simple-git** disclosed **CVE-2026-6951**, an RCE flaw in versions before `3.36.0` caused by incomplete blocking of Git configuration options, allowing attackers to abuse `--config`, enable `protocol.ext.allow=always`, and trigger execution through an `ext::` clone source when untrusted input reaches the library's options.
Jun 29, 2026
OpenClaw disclosed several high-severity vulnerabilities affecting multiple releases, including authorization bypass in QQBot pre-dispatch slash commands, privilege escalation in the trusted-proxy Control UI WebSocket, and node authority expansion through pairing reconnection logic. The QQBot issue, tracked as **`CVE-2026-53834`** and mirrored in GitHub advisory **`GHSA-77pv-3w4q-vrj5`**, affects versions up to **`2026.4.26`** and allows senders to trigger slash-command handling before `allowFrom` policy checks are enforced. The vendor said the flaw is limited to the QQBot feature and its configuration, with the first stable fix released in **`2026.4.27`**.
Jun 29, 2026