Which versions of Openclaw are affected by CVE-2026-22169?

CVE-2026-22169 presents moderate security risk, a OS command injection vulnerability rated CVSS 7.1.. A patch is available.

How to fix or mitigate CVE-2026-22169?

Within 7 days: Identify all affected systems running an allowlist bypass vulnerability in the safeBins configurat and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

Openclaw CVE-2026-22169

Q: What is the CVSS score of CVE-2026-22169?

CVE-2026-22169 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12710 HIGH

OS Command Injection (CWE-78)

2026-03-18 VulnCheck

GHSA-vmqr-rc7x-3446

Command Injection Openclaw

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 02:30 euvd

EUVD-2026-12710

Analysis Generated

Mar 18, 2026 - 02:30 vuln.today

Patch released

Mar 18, 2026 - 02:30 nvd

Patch available

CVE Published

Mar 18, 2026 - 01:34 nvd

HIGH 7.1

DescriptionCVE.org

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option. When sort is explicitly added to tools.exec.safeBins, remote attackers can bypass intended safe-bin approval constraints by leveraging the compress-program parameter to execute unauthorized external programs.

AnalysisAI

OpenClaw versions before 2026.2.22 allow local attackers with high privileges to execute arbitrary commands through a safeBins allowlist bypass in the compress-program option, enabling unauthorized external program execution despite security constraints. The vulnerability exploits improper validation of the sort tool configuration to circumvent intended access controls. A patch is available to remediate this command injection flaw.

Technical ContextAI

The vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command, aka OS Command Injection), stemming from inadequate validation of the compress-program parameter within OpenClaw's safeBins configuration mechanism. OpenClaw (as identified via CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) implements a safeBins allowlist to restrict which external helper programs can be invoked during processing operations. The flaw occurs when the sort tool is explicitly added to tools.exec.safeBins; attackers can then abuse the compress-program option to bypass the intended approval constraints and invoke unauthorized external programs. This represents a classic case of authentication/authorization bypass through parameter injection, where a trusted configuration option becomes a vector for privilege escalation or lateral movement.

RemediationAI

Upgrade OpenClaw to version 2026.2.22 or later, which includes the fix committed at https://github.com/openclaw/openclaw/commit/57fbbaebca4d34d17549accf6092ae26eb7b605c. Organizations unable to patch immediately should review their safeBins configuration and explicitly remove the sort utility from tools.exec.safeBins unless it is absolutely required; additionally, enforce the principle of least privilege for accounts running OpenClaw processes to minimize the window of opportunity for exploitation. Network-level controls should restrict access to OpenClaw instances to trusted administrative users and services only.