Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authorized /debug set callers can inject __proto__, constructor, or prototype keys to manipulate object prototypes and bypass command gate restrictions.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27524 Prototype Pollution Vulnerability in OpenClaw Versions Before 2026.2.21 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27524
Post summary
A prototype pollution vulnerability was disclosed for OpenClaw before version 2026.2.21; no PoC, exploit code, or patch information was mentioned.
⚡ New CVE Alert: CVE-2026-27524 📊 Severity: 3.1 🚨 Risk Level: Low 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-27524 #CVE-2026-27524 #CVE #Low #CyberSecurity #InfoSec https://t.co/2YUXOuR6Oq
Post summary
The tweet merely announces a low‑severity CVE with a link to its NVD entry, offering no further technical, exploit, or mitigation details.
CVE-2026-27524 OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authorized /de… https://www.cve.org/CVERecord?id=CVE-2026-27524
Post summary
CVE‑2026‑27524 is a prototype‑pollution vulnerability affecting OpenClaw prior to version 2026.2.21, exploitable via the /debug set override mechanism, but no PoC, exploit code, or active exploitation is reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |