CVE-2026-22168: Openclaw RCE Vulnerability

CVE-2026-22168 Overview

CVE-2026-22168 is a command injection vulnerability in OpenClaw versions prior to 2026.2.21. The flaw resides in the system.run function, where the approval text shown to operators does not match the command actually executed. Authenticated operators can append trailing arguments after cmd.exe /c to execute arbitrary commands on trusted Windows nodes. Audit logs reflect only the benign approved command, creating an integrity gap between approval and execution. The vulnerability is tracked as CWE-88: Improper Neutralization of Argument Delimiters in a Command.

Critical Impact
Authenticated attackers can smuggle malicious arguments through cmd.exe /c to execute arbitrary commands on Windows nodes while audit trails record only the approved benign command.

Affected Products

OpenClaw versions prior to 2026.2.21
OpenClaw distributed via Node.js package channels
Deployments using system.run for Windows command execution

Discovery Timeline

2026-03-18 - CVE-2026-22168 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-22168

Vulnerability Analysis

The vulnerability stems from an approval-integrity mismatch in OpenClaw's system.run implementation. When an operator approves a command, the user-facing approval text displays only a sanitized or benign representation. The underlying execution path passes the command to cmd.exe /c without validating that trailing arguments match the approved text.

Attackers with operator credentials can append shell metacharacters and additional commands after the approved string. The Windows command interpreter parses the full argument list and executes the smuggled payload. Because the audit log captures only the approval text, defenders lose visibility into the actual commands executed on trusted nodes.

This class of flaw falls under [CWE-88], where argument delimiters are improperly neutralized before being passed to a downstream component. The result is local command execution on Windows hosts with mismatched audit records.

Root Cause

The root cause is the failure to enforce a one-to-one binding between approved command text and the argument vector passed to cmd.exe. OpenClaw constructs the execution string by concatenation rather than parameterized invocation. The approval workflow validates one representation while a different, attacker-controlled string reaches the shell.

Attack Vector

Exploitation requires authenticated operator-level access to an OpenClaw instance. The attacker submits a command for approval that appears benign but contains trailing arguments designed to be interpreted by cmd.exe /c. Once approval is granted, the trailing payload executes on the target Windows node with the privileges of the OpenClaw runtime.

The vulnerability is described in detail in the VulnCheck Command Injection Advisory and the GitHub Security Advisory GHSA-5v6x-rfc3-7qfr.

Detection Methods for CVE-2026-22168

Indicators of Compromise

Process creation events showing cmd.exe /c invocations from the OpenClaw service account with arguments not matching the approval log
Discrepancies between OpenClaw audit log entries and Windows Security Event ID 4688 process creation records
Unexpected child processes spawned by the OpenClaw Node.js runtime on Windows nodes
Outbound network connections initiated by processes launched through system.run that exceed the scope of approved actions

Detection Strategies

Correlate OpenClaw approval logs with Windows process creation telemetry to identify command-line mismatches
Alert on cmd.exe /c invocations originating from the OpenClaw process tree that include shell metacharacters such as &, |, &&, or ;
Hunt for trailing argument patterns following expected benign commands in command-line audit data

Monitoring Recommendations

Enable Windows command-line auditing (Event ID 4688 with command-line logging) on all nodes managed by OpenClaw
Forward OpenClaw application logs and Windows Sysmon Event ID 1 records to a central analytics platform for correlation
Baseline normal system.run activity and alert on deviations in command structure or frequency

How to Mitigate CVE-2026-22168

Immediate Actions Required

Upgrade OpenClaw to version 2026.2.21 or later on all nodes
Audit operator accounts and revoke unnecessary system.run privileges
Review historical system.run invocations against Windows process creation logs for prior abuse
Rotate credentials for service accounts used by OpenClaw on Windows nodes

Patch Information

The fix is delivered in OpenClaw 2026.2.21. The remediation commit is published at GitHub Commit 6007941. Administrators should consult the GitHub Security Advisory GHSA-5v6x-rfc3-7qfr for upgrade guidance and verification steps.

Workarounds

Restrict system.run access to a minimal set of trusted operators until the patch is applied
Block or filter shell metacharacters in command submissions through an upstream proxy or wrapper
Disable Windows node integrations that rely on cmd.exe /c execution paths where feasible
Implement out-of-band verification of approved commands against executed commands on each node

bash

# Verify installed OpenClaw version meets the fixed release
npm list openclaw
# Expected output: openclaw@2026.2.21 or later