PT-2026-21338 · Openclaw+1 · Openclaw+1

Aether-Ai-Agent · Published 2026-02-18 · Updated 2026-03-09 · CVE-2026-27487

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.13 and below

Description The OpenClaw application, a personal AI assistant, is susceptible to an OS command injection issue on macOS. The Claude CLI keychain credential refresh process constructs a shell command using security add-generic-password -w ... to write an updated JSON blob to the Keychain. Because OAuth tokens, which are user-controlled data, are used in this process, an attacker could potentially inject arbitrary OS commands. The fix involves using execFileSync("security", argv) to avoid shell invocation and passing the keychain payload as a literal argument.

Recommendations Versions 2026.2.13 and below should be updated to version 2026.2.14 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-27487

GHSA-4564-PVR2-QQ4H

Affected Products

Openclaw

Apple Macos

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27487.json · Exploit
• https://github.com/openclaw/openclaw/commit/b908388245764fb3586859f44d1dff5372b19caf · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-4564-pvr2-qq4h · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/66d7178f2d6f9d60abad35797f97f3e61389b70c · Patch
• https://github.com/openclaw/openclaw/commit/9dce3d8bf83f13c067bc3c32291643d2f1f10a06 · Patch
• https://osv.dev/vulnerability/GHSA-4564-pvr2-qq4h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27487 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27487 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14 · Note
• https://github.com/openclaw/openclaw/pull/15924 · Note
• https://twitter.com/CVEnew/status/2025154161361170533 · Twitter Post
• https://twitter.com/cybersecdummies/status/2025192317649649810 · Twitter Post
• https://twitter.com/Mohammed__Wasif/status/2030827090413846855 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025162697113760053 · Twitter Post