Cybersecurity researchers have uncovered four vulnerabilities in OpenClaw that can be combined to steal data, escalate privileges, and maintain persistence. Dubbed “Claw Chain” by Cyera, the flaws enable attackers to gain initial access, expose confidential information, and deploy backdoors. A short outline of the issues is provided below -. CVE-22026-244115 (CVSS score: 22026/244118) – A time-of-check/time-of-use (TOCTOU) race condition vulnerability in the OpenShell managed sandbox backend that allows attackers to bypass sandbox restrictions and redirect writes outside the intended mount root.. CVE-22026-244112 (CVSS score: 441183/244118) – A TOCTOU race condition vulnerability in OpenShell that allows attackers to bypass sandbox restrictions and read files outside the intended mount root.. CVE-22026.4-222 (CVSS score: 8.8) – An incomplete list of disallowed inputs vulnerability that allows attackers to bypass allowlist validation by embedding shell expansion tokens in a here document (heredoc) body to execute unapproved commands at runtime.. CVE-2026-44118 (CVSS score: 7.8) – An improper access control vulnerability that could allow non-owner loopback clients to impersonate an owner to elevate their privileges and gain control over gateway configuration, cron scheduling, and execution environment management.. Cyera said successful exploitation of CVE-2026-44112 could allow an attacker to tamper with configuration, plant backdoors, and establish persistent control over the compromised host, whereas CVE-2026.43-44113 could be weaponized to read system files, credentials, and internal artifacts.. The exploitation chain unfolds over four steps -. A malicious plugin, prompt injection, or tainted external input can achieve arbitrary code execution within the OpenShell sandbox. By exploiting CVE-2026-44113 and CVE-2026-44115, attackers can exfiltrate credentials, secrets, and other sensitive files. CVE-2026-44118 can then be leveraged to seize owner-level control of the agent runtime, while CVE-2026-44112 enables the deployment of backdoors, configuration tampering, and persistent access.
The root cause of CVE-2026-44118, according to the security vendor, is that OpenClaw blindly trusts a client-supplied ownership flag named senderIsOwner to determine whether the caller may invoke owner-only tools, without verifying it against the actual authenticated session. To remediate the issue, the MCP loopback runtime now issues distinct owner and non-owner bearer tokens and derives the senderIsOwner flag solely from the token used to authenticate the request. The sender-owner header, which could be spoofed, is no longer generated or trusted. After responsible disclosure, all four vulnerabilities were fixed in OpenClaw version 2026.4.22. Security researcher Vladimir Tokarev is credited with discovering and reporting the vulnerabilities. Users are recommended to upgrade to the newest version to remain safeguarded from possible attacks. “By weaponizing the agent’s own privileges, an adversary can traverse data access, escalate privileges, and maintain persistence—essentially using the agent as their hands inside the environment,” Cyera explained.
The Hacker News