CVE-2026-26325Disclosure(openclaw / openclaw)

Status: High-severity vulnerability found by Cantina’s AI Code Analyzer in @OpenClaw (CVE-2026-26325). Our AI engine detected an allowlist bypass in OpenClaw's npm package. The flaw allows a mismatch between checked commands and executed commands. Full breakdown below: https://t.co/60nxmMzGep

Our AI Code Analyzer at Cantina just flagged a high vulnerability in the @OpenClaw npm package (CVE-2026-26325). The team promptly acknowledged and patched it. Early access to our tool is here: https://cantina.review/cantinacode787b04

High severity vulnerability in #OpenClaw (CVE-2026-26325) @cantinaxyz has discovered an allowlist bypass in the OpenClaw npm package. Because of this, the commands verified by the system may not match the actual executed commands. This creates a risk of executing unwanted commands and compromising security.

Okay, Sunday morning dev session complete, here's what we built this morning 💪🐺 Expand OpenClaw security coverage by implementing ten new CVE checks in the existing version and precondition analyzer model, with full test and doc updates. Added CVE checks: - CVE-2026-26324 (SSRF IPv4-mapped IPv6 guard bypass) - CVE-2026-26325 (http://system.run rawCommand/argv mismatch bypass) - CVE-2026-26316 (BlueBubbles webhook auth bypass) - CVE-2026-26326 (skills.status secret disclosure) - CVE-2026-27003 (Telegram token log exposure) - CVE-2026-27009 (Control UI stored XSS) - CVE-2026-26320 (deep-link prompt truncation/social engineering) - CVE-2026-27487 (macOS keychain refresh command injection) - CVE-2026-27486 (cleanup cross-process termination) - CVE-2026-27485 (skill packager symlink file disclosure) Implementation details: - Extend `_CVE_FIX_VERSIONS` with new fixed-version thresholds. - Add recursive config string/pattern helpers for indicator detection. - Add all new checks to `OpenClawSecurityAnalyzer.analyze(...)`. - Extend `_build_cve_check(...)` with optional `min_affected_version` handling for range-sensitive CVEs (used by CVE-2026-26320). - Keep existing status semantics: VULNERABLE/WARNING/SAFE/UNKNOWN. Tests: - Expand `tests/test_openclaw_security.py` to validate: - new CVE presence - version-threshold behavior - patched-version risky-config WARNING behavior - UNKNOWN behavior for all tracked CVEs Docs: - Update README OpenClaw coverage from 5 to 15 CVEs. - Add all new CVEs to "OpenClaw CVEs Covered" and "Checks Performed" tables. - Refresh OpenClaw example summary text. - Rewrite http://OpenClawCVEs.md with full 15-CVE coverage and per-check logic. Validation: - `python3 -m unittest tests/test_openclaw_security.py` (pass) - `python3 -m unittest discover -s tests` (pass, 31 tests)

We just disclosed a High-Severity vulnerability in @openclaw (CVE-2026-26325). If you are running `system(.)run` in a Node host configuration, you need to pay attention. Here is the immediate operational checklist: **1.** Search your manifests for `openclaw` package versions **2026.2.13** or older. If you find them, assume any `http://system.run` call is a potential bypass vector. **2.** The maintainers have released **v2026.2.14, which fixed the problem**. As a general rule, always update the software; more & more bugs are being fixed every day. **3.** Stop relying on regex for command validation. If your security check looks at Variable A, but your execution engine runs Variable B, you have a logic gap. **4.** Static analysis is great for syntax, but it fails at intent. We built our AI tool specifically to catch these "logic decouplings", where the code *looks* right but *acts* wrong. This CVE is just the tip of the iceberg. Our engine flagged **5 distinct vulnerabilities** in this single audit. We will release details on the other four findings shortly.

CVE-2026-26325 OpenClaw is a personal AI assistant. Prior to version 2026.2.14, a mismatch between `rawCommand` and `command[]` in the node host `http://system.run` handler could cause all… https://www.cve.org/CVERecord?id=CVE-2026-26325