Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence

Ravie LakshmananMay 15, 2026Vulnerability / AI Security

Cybersecurity researchers have disclosed a set of four security flaws in OpenClaw that could be chained to achieve data theft, privilege escalation, and persistence.

The vulnerabilities, collectively dubbed

Claw Chain

by Cyera, can permit an attacker to establish a foothold, expose sensitive data, and plant backdoors. A brief description of the flaws is below –

• 
  CVE-2026-44112
  
  (CVSS score: 9.6/6.3) – A time-of-check/time-of-use (TOCTOU) race condition vulnerability in the
  OpenShell
  managed sandbox backend that allows attackers to bypass sandbox restrictions and redirect writes outside the intended mount root. 
• 
  CVE-2026-44113
  
  (CVSS score: 7.7/6.3) – A TOCTOU race condition vulnerability in OpenShell that allows attackers to bypass sandbox restrictions and read files outside the intended mount root.
• 
  CVE-2026-44115
  
  (CVSS score: 8.8) – An incomplete list of disallowed inputs vulnerability that allows attackers to bypass allowlist validation by embedding shell expansion tokens in a
  here document
  (heredoc) body to execute unapproved commands at runtime.
• 
  CVE-2026-44118
  
  (CVSS score: 7.8) – An improper access control vulnerability that could allow non-owner loopback clients to impersonate an owner to elevate their privileges and gain control over gateway configuration, cron scheduling, and execution environment management.

Cyera said successful exploitation of CVE-2026-44112 could allow an attacker to tamper with configuration, plant backdoors, and establish persistent control over the compromised host, whereas CVE-2026-44113 could be weaponized to read system files, credentials, and internal artifacts.

The exploitation chain unfolds over four steps –

• A malicious plugin, prompt injection, or compromised external input gains code execution inside the OpenShell sandbox.
• Leverage CVE-2026-44113 and CVE-2026-44115 to expose credentials, secrets, and sensitive files.
• Exploit CVE-2026-44118 to obtain owner-level control of the agent runtime.
• Use CVE-2026-44112 to plant backdoors or make configuration changes and set up persistence.

The root cause for CVE-2026-44118, per the cybersecurity company, stems from the fact that OpenClaw trusts a client-controlled ownership flag called senderIsOwner, which signals whether the caller is authorized for owner-only tools, without validating it against the authenticated session.

“The MCP loopback runtime now issues separate owner and non-owner bearer tokens and derives senderIsOwner exclusively from which token authenticated the request,” OpenClaw detailed the fixes in an advisory for the flaw. “The spoofable sender-owner header is no longer emitted or trusted.”

Following responsible disclosure, all four vulnerabilities have been addressed in OpenClaw version 2026.4.22. Security researcher…