Openclaw CVE-2026-22168

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network-accessible exploitation requiring low complexity and authenticated user privileges, with high confidentiality impact but no integrity or availability impact. However, this scoring appears conservative given the vulnerability's actual threat: authenticated operators can achieve arbitrary local command execution, which typically carries integrity and availability implications beyond information disclosure. The availability of a patch from the vendor and documented proof-of-concept references (GitHub advisory GHSA-5v6x-rfc3-7qfr and VulnCheck advisory) indicate active research and a clear exploitation path. Real-world risk is elevated because: (1) the attack requires only authenticated access, a lower barrier in managed environments; (2) the approval-audit mismatch creates a forensic blind spot that could hinder incident response; (3) exploitation is straightforward and non-interactive; and (4) Windows command execution can readily be escalated to system compromise. This should be prioritized as a real operational risk, not a theoretical high-CVSS issue.

An authenticated OpenClaw operator submits a system.run request to execute cmd.exe /c echo safe, which passes approval and is logged. However, the attacker appends a trailing argument such as cmd.exe /c echo safe & whoami & systeminfo, causing the benign approval log entry to record only the echo command while the actual execution runs the additional whoami and systeminfo commands. The approval audit trail shows only the benign echo command, masking the information gathering, while the operator gains access to sensitive system information and can use this as reconnaissance for further attacks. This scenario is straightforward given the low attack complexity and non-interactive nature of the exploit, making it likely to be discovered and exploited quickly once the vulnerability is public.