PT-2026-5722 · Openclaw · Openclaw

Berkdedekarginoglu · Published 2026-02-02 · Updated 2026-03-18 · CVE-2026-24763

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.1.29

Description OpenClaw, formerly Clawdbot, a personal AI assistant, had a command injection issue in its Docker sandbox execution mechanism. This was due to unsafe handling of the PATH environment variable when building shell commands. An authenticated user who could control environment variables could influence command execution within the container. The issue could lead to the execution of unintended commands inside the container, access to the container filesystem and environment variables, exposure of sensitive data, and an increased risk in misconfigured or privileged container environments.

Recommendations Update to version 2026.1.29.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-05649

CVE-2026-24763

GHSA-MC68-Q9JW-2H3V

Affected Products

Openclaw

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24763.json · Exploit
• https://github.com/openclaw/openclaw/commit/771f23d36b95ec2204cc9a0054045f5d8439ea75 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mc68-q9jw-2h3v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24763 · Security Note
• https://bdu.fstec.ru/vul/2026-05649 · Security Note
• https://osv.dev/vulnerability/GHSA-mc68-q9jw-2h3v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24763 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.1.29 · Note
• https://github.com/clawdbot/clawdbot/security/advisories/GHSA-mc68-q9jw-2h3v · Note
• https://twitter.com/rwsanders/status/2034301118663241840 · Twitter Post
• https://i.redd.it/rz0nyuy4iamg1.png · Reddit Post
• https://t.me/cveNotify/151938 · Telegram Post
• https://reddit.com/r/better_claw/comments/1rqqyeg/every_openclaw_security_incident_on_one_timeline · Reddit Post
• https://twitter.com/dicky_ibrohim/status/2021229421907071273 · Twitter Post