PT-2026-21345 · Openclaw · Openclaw

Steipete · Published 2026-02-20 · Updated 2026-02-24 · CVE-2026-27576

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.17 and below

Description OpenClaw is a personal AI assistant. The ACP bridge component accepts excessively large prompt text blocks and constructs oversized prompt payloads before sending them to the chat.send function. This issue primarily impacts local ACP clients, such as IDE integrations, when processing unusually large inputs. The vulnerability stems from uncontrolled resource consumption due to the acceptance of oversized payloads. The ACP bridge is the component affected.

Recommendations Update to version 2026.2.19 or later.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-27576

GHSA-CXPW-2G23-2VGW

Affected Products

Openclaw

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27576.json · Exploit
• https://github.com/openclaw/openclaw/commit/63e39d7f57ac4ad4a5e38d17e7394ae7c4dd0b9c · Patch
• https://github.com/openclaw/openclaw/commit/ebcf19746f5c500a41817e03abecadea8655654a · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-cxpw-2g23-2vgw · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/8ae2d5110f6ceadef73822aa3db194fb60d2ba68 · Patch
• https://osv.dev/vulnerability/CVE-2026-27576 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cxpw-2g23-2vgw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27576 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.19 · Note
• https://reddit.com/r/VulnMatter/comments/1raarn5/resumen_diario_de_vulnerabilidades_20022026 · Reddit Post
• https://twitter.com/_cvereports/status/2025151174559588380 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025157577424642305 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rdh91b/resumen_diario_de_vulnerabilidades_24022026 · Reddit Post
• https://twitter.com/CVEnew/status/2025154159037571394 · Twitter Post