OpenClaw CVE-2026-100559

Exploitation requires an OpenClaw deployment before 2026.8.1 where the attacker can feed command input into an agent whose exec allowlist is the security boundary - i.e., a steered/running agent turn (UI:P) and a low-trust caller position in the command path (PR:L). The specific trigger is crafting input containing escaped newlines that the allowlist parser mis-tokenizes, causing it to validate only the visible portion while an appended hidden command executes. Limiting factors: an operator must be actively driving the agent, the attacker must already reach the command-input surface, and the flaw only matters where the allowlist prompt is relied on to gate execution; patched (2026.8.1+) installs are unaffected.

This is a genuine command-injection flaw (CWE-78) in OpenClaw's exec allowlist parser: escaped newlines desynchronize the parser so hidden commands slip past allowlist validation and run without the expected authorization prompt, yielding full host code execution (VC:H/VI:H/VA:H). The vendor CVSS 4.0 of 8.6 (AV:N/AC:L/PR:L/UI:P) is defensible for the technical impact, but the real-world risk is materially tempered by two gating factors baked into the vector: PR:L (the attacker/steered agent must already have a foothold in the low-trust command path) and UI:P (an operator/user must be driving an agent turn that processes the malicious input). No EPSS score, no CISA KEV listing, and no public exploit code accompany this record, so there is no evidence of active or automatable exploitation - the signal set is 'no public exploit identified at time of analysis.' Net: a high-CVSS, real-RCE bug whose practical priority is moderated by its niche footprint and the need for a pre-existing agent/allowlist context rather than a widespread, wormable threat. No conflicting signals in the data, though EPSS/KEV absence is simply missing data, not a low-risk confirmation.

An attacker who can supply command input to a steered OpenClaw agent (e.g., via a task, message, or tool argument the operator has partly allowlisted) embeds escaped newlines that confuse the exec allowlist parser. The parser validates only the visible prefix while the hidden trailing command executes on the host at the agent process's privileges, with no re-prompt shown to the operator. No public proof-of-concept is referenced in the available data.