PT-2026-31978 · Openclaw · Openclaw

Edward-X · Published 2026-03-30 · Updated 2026-04-10 · CVE-2026-35667

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions: OpenClaw versions prior to 2026.3.24

Description: OpenClaw versions before 2026.3.24 contain an incomplete fix for CVE-2026-27486. The !stop chat command uses an unpatched killProcessTree function from shell-utils.ts that sends SIGKILL immediately without a graceful SIGTERM shutdown. This can lead to data corruption, resource leaks, and skipped security-sensitive cleanup operations. The vulnerable function is located in src/agents/shell-utils.ts (lines 170–192) and is called by the !stop command handler in src/auto-reply/reply/bash-command.ts (lines 300-304). The issue arises because the !stop command imports the unpatched function instead of the corrected version in src/process/kill-tree.ts. A proof-of-concept demonstrates that the vulnerable function bypasses the graceful shutdown sequence, sending SIGKILL directly. This can affect processes writing to files, databases, or performing security-sensitive operations.

Recommendations: Update to OpenClaw version 2026.3.24 or later.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2026-35667

GHSA-3298-56P6-RPW2

Affected Products

Openclaw

References · 7

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3298-56p6-rpw2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35667 · Security Note
• https://osv.dev/vulnerability/GHSA-3298-56p6-rpw2 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-improper-process-termination-via-unpatched-killprocesstree-in-shell-utils-ts · Note
• https://twitter.com/CVEnew/status/2042710243872752040 · Twitter Post
• https://github.com/advisories/GHSA-jfv4-h8mc-jcp8 · Note