PT-2026-5722 · Openclaw · Openclaw

Berkdedekarginoglu · CVE-2026-24763 · Published 2026-02-02 · Updated 2026-06-06

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.1.29

Description A command injection issue exists in the Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An authenticated user with the ability to control environment variables can influence command execution within the container context, potentially leading to the execution of unintended commands, access to the container filesystem, and exposure of sensitive data. Over 135,000 instances are exposed to the internet, with approximately 63% being vulnerable.

Recommendations Update to version 2026.1.29.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-05649

CVE-2026-24763

GHSA-MC68-Q9JW-2H3V

Affected Products

Openclaw

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24763.json · Exploit
• https://github.com/openclaw/openclaw/commit/771f23d36b95ec2204cc9a0054045f5d8439ea75 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mc68-q9jw-2h3v · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05649 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24763 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mc68-q9jw-2h3v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24763 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.1.29 · Note
• https://github.com/clawdbot/clawdbot/security/advisories/GHSA-mc68-q9jw-2h3v · Note
• https://i.redd.it/rz0nyuy4iamg1.png · Reddit Post
• https://twitter.com/rwsanders/status/2034301118663241840 · Twitter Post
• https://twitter.com/pulsepatchio/status/2019064699539829012 · Twitter Post
• https://twitter.com/CoyoteSecure/status/2022786173551415375 · Twitter Post
• https://reddit.com/r/cybersecurity/comments/1r16yb4/135000_openclaw_instances_exposed_to_the_internet · Reddit Post