Openclaw Windows Node
Monthly
Arbitrary code execution on OpenClaw Windows Node hosts before version 2026.7.1 is achievable by an attacker who already holds gateway or agent access to a node, because the system.run tool's environment-variable sanitizer maintains an incomplete denylist (CWE-184). The attacker supplies variables such as GIT_CONFIG_*, GIT_PAGER, DOTNET_STARTUP_HOOKS, or JAVA_TOOL_OPTIONS alongside a request that runs an allowlisted tool (git, dotnet, java), causing that otherwise-permitted tool to load and execute attacker-controlled code or commands when it is next invoked; this requires the attacker to pass the tool's own arguments unchanged, which is why the attack-complexity/attack-requirements component is elevated. Exploitation is not remote-unauthenticated-it presumes prior gateway or agent access (PR:L), it is Windows-only, and it depends on at least one of git, dotnet, or java being present and reachable through system.run. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released a fixed build.
OpenClaw Windows Node versions before 2026.7.1 allow an authenticated caller holding a gateway/agent session to escalate to arbitrary command execution on the Windows host by abusing the system.execApprovals.set capability. The rule validator fails to reject allow rules whose executable (first whitespace-delimited token) contains a wildcard, so patterns such as '*.*', '*.exe', '*e*' or 'c*' are accepted and effectively grant blanket approval that the default-deny policy would otherwise block; subsequent system.run calls then execute arbitrary programs - including the LOLBins mshta, rundll32 and certutil - with no operator check or user prompt. Exploitation requires an existing network connection to the gateway/agent interface (CVSS 4.0 PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.7), no public exploit code was identified at time of analysis, and the vendor has released a fixed version.
Memory exhaustion in OpenClaw Windows Node versions before 2026.7.1 lets a connected gateway peer crash the node process by streaming an unbounded sequence of WebSocket continuation frames that never set the EndOfMessage flag, driving limitless growth of the inbound message accumulation buffer until the process dies. The vulnerability is authenticated (CVSS PR:L) because the attacker must already hold a gateway session on the node's gateway WebSocket transport rather than merely reach an exposed port, and the impact is confined to availability - a process crash with no code execution, privilege escalation, or data exposure. No public exploit code has been identified at time of analysis, and the vendor has shipped 2026.7.1, which caps accumulated inbound messages at 32M UTF-16 characters and closes offending sockets with a MessageTooBig status.
Arbitrary command execution on Windows hosts is achievable through OpenClaw Windows Node versions prior to 2026.7.1, where the system.run exec-approval policy can be evaded by an authenticated connected gateway or agent holding the PR:L role. The ExecShellWrapperParser fails to split commands on pipe operators or extract command-substitution/subexpression syntax, so a denied command placed behind an allowed prefix (for example `benign | denied` or `echo $(denied)`) is never surfaced to the allow/deny ruleset and executes anyway; the failure only yields a bypass where a restrictive exec-approval policy is actually configured, and the impact is confined to Windows targets. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch 2026.7.1 is available.
Silent capture of screen contents, webcam images, and device geolocation is possible in OpenClaw Windows Node before 2026.7.1-3 because the NodeService capture handlers performed these operations without the one-time consent gate that screen.record and camera.clip already enforced. An attacker who is, or who controls, a gateway or agent already connected to the node's WebSocket interface can invoke screen.snapshot, camera.snap, and location.get to covertly screenshot the desktop, photograph the user, and read physical location - for camera.snap and location.get without even a user-visible indicator - requiring no interaction from the victim. This is a genuine but moderate-severity privacy vulnerability affecting only pre-2026.7.1-3 builds; authentication is required in the sense that the attacker must already hold node-agent/gateway connectivity (CVSS:4.0 PR:L), and no public exploit code was identified at time of analysis.
Server-side request forgery in OpenClaw Windows Node through 2026.9.4 allows an attacker who already holds gateway or agent access to invoke the canvas.present capability and make the node's WebView issue requests to localhost, RFC1918 private ranges, link-local/cloud-metadata addresses, CGNAT and Tailscale (100.64/10) services from the user's machine - destinations that canvas.navigate would reject through its URL risk evaluation, which canvas.present bypasses entirely. The prerequisite is an authenticated control channel to the node (CVSS vector PR:L), so this is not exploitable by anonymous external attackers and yields only limited confidentiality and integrity impact (VC:L/VI:L, no availability impact); a prompt-injected but legitimately connected agent is a realistic delivery path. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but it is a genuine, bounded SSRF risk in deployments that expose the gateway/agent channel. An upstream fix commit exists, though a tagged released version is not independently confirmed in the supplied data.
Arbitrary code execution on OpenClaw Windows Node hosts before version 2026.7.1 is achievable by an attacker who already holds gateway or agent access to a node, because the system.run tool's environment-variable sanitizer maintains an incomplete denylist (CWE-184). The attacker supplies variables such as GIT_CONFIG_*, GIT_PAGER, DOTNET_STARTUP_HOOKS, or JAVA_TOOL_OPTIONS alongside a request that runs an allowlisted tool (git, dotnet, java), causing that otherwise-permitted tool to load and execute attacker-controlled code or commands when it is next invoked; this requires the attacker to pass the tool's own arguments unchanged, which is why the attack-complexity/attack-requirements component is elevated. Exploitation is not remote-unauthenticated-it presumes prior gateway or agent access (PR:L), it is Windows-only, and it depends on at least one of git, dotnet, or java being present and reachable through system.run. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released a fixed build.
OpenClaw Windows Node versions before 2026.7.1 allow an authenticated caller holding a gateway/agent session to escalate to arbitrary command execution on the Windows host by abusing the system.execApprovals.set capability. The rule validator fails to reject allow rules whose executable (first whitespace-delimited token) contains a wildcard, so patterns such as '*.*', '*.exe', '*e*' or 'c*' are accepted and effectively grant blanket approval that the default-deny policy would otherwise block; subsequent system.run calls then execute arbitrary programs - including the LOLBins mshta, rundll32 and certutil - with no operator check or user prompt. Exploitation requires an existing network connection to the gateway/agent interface (CVSS 4.0 PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.7), no public exploit code was identified at time of analysis, and the vendor has released a fixed version.
Memory exhaustion in OpenClaw Windows Node versions before 2026.7.1 lets a connected gateway peer crash the node process by streaming an unbounded sequence of WebSocket continuation frames that never set the EndOfMessage flag, driving limitless growth of the inbound message accumulation buffer until the process dies. The vulnerability is authenticated (CVSS PR:L) because the attacker must already hold a gateway session on the node's gateway WebSocket transport rather than merely reach an exposed port, and the impact is confined to availability - a process crash with no code execution, privilege escalation, or data exposure. No public exploit code has been identified at time of analysis, and the vendor has shipped 2026.7.1, which caps accumulated inbound messages at 32M UTF-16 characters and closes offending sockets with a MessageTooBig status.
Arbitrary command execution on Windows hosts is achievable through OpenClaw Windows Node versions prior to 2026.7.1, where the system.run exec-approval policy can be evaded by an authenticated connected gateway or agent holding the PR:L role. The ExecShellWrapperParser fails to split commands on pipe operators or extract command-substitution/subexpression syntax, so a denied command placed behind an allowed prefix (for example `benign | denied` or `echo $(denied)`) is never surfaced to the allow/deny ruleset and executes anyway; the failure only yields a bypass where a restrictive exec-approval policy is actually configured, and the impact is confined to Windows targets. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch 2026.7.1 is available.
Silent capture of screen contents, webcam images, and device geolocation is possible in OpenClaw Windows Node before 2026.7.1-3 because the NodeService capture handlers performed these operations without the one-time consent gate that screen.record and camera.clip already enforced. An attacker who is, or who controls, a gateway or agent already connected to the node's WebSocket interface can invoke screen.snapshot, camera.snap, and location.get to covertly screenshot the desktop, photograph the user, and read physical location - for camera.snap and location.get without even a user-visible indicator - requiring no interaction from the victim. This is a genuine but moderate-severity privacy vulnerability affecting only pre-2026.7.1-3 builds; authentication is required in the sense that the attacker must already hold node-agent/gateway connectivity (CVSS:4.0 PR:L), and no public exploit code was identified at time of analysis.
Server-side request forgery in OpenClaw Windows Node through 2026.9.4 allows an attacker who already holds gateway or agent access to invoke the canvas.present capability and make the node's WebView issue requests to localhost, RFC1918 private ranges, link-local/cloud-metadata addresses, CGNAT and Tailscale (100.64/10) services from the user's machine - destinations that canvas.navigate would reject through its URL risk evaluation, which canvas.present bypasses entirely. The prerequisite is an authenticated control channel to the node (CVSS vector PR:L), so this is not exploitable by anonymous external attackers and yields only limited confidentiality and integrity impact (VC:L/VI:L, no availability impact); a prompt-injected but legitimately connected agent is a realistic delivery path. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but it is a genuine, bounded SSRF risk in deployments that expose the gateway/agent channel. An upstream fix commit exists, though a tagged released version is not independently confirmed in the supplied data.