CVE-2026-25593: OpenClaw AI Assistant RCE Vulnerability

CVE-2026-25593 Overview

CVE-2026-25593 is a command injection vulnerability affecting OpenClaw, a personal AI assistant application. Prior to version 2026.1.20, an unauthenticated local client could exploit the Gateway WebSocket API to write configuration settings via config.apply and set unsafe cliPath values. These malicious values were subsequently used during command discovery operations, enabling command injection with the privileges of the gateway user.

Critical Impact

Local attackers can achieve command injection without authentication, potentially leading to full system compromise with gateway user privileges.

Affected Products

• OpenClaw versions prior to 2026.1.20

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-25593 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-25593

Vulnerability Analysis

This vulnerability falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw exists in OpenClaw's Gateway WebSocket API, which fails to properly validate or sanitize configuration values before they are used in system command execution contexts.

The attack is exploitable locally without requiring authentication, which significantly lowers the barrier to exploitation. While the local access requirement limits the attack surface compared to network-based vulnerabilities, it remains dangerous in shared computing environments, compromised local networks, or scenarios where an attacker has already established initial access to a system.

Root Cause

The root cause is insufficient input validation in the configuration handling mechanism. When the config.apply endpoint receives configuration data through the WebSocket API, the cliPath parameter values are not properly sanitized before being used in command discovery operations. This allows attackers to inject arbitrary shell commands that execute with the privileges of the OpenClaw gateway process.

Attack Vector

The attack leverages local access to the system where OpenClaw is running. An attacker connects to the Gateway WebSocket API without authentication and submits a malicious configuration payload via the config.apply function. By crafting a specially formatted cliPath value containing shell metacharacters or command sequences, the attacker can inject arbitrary commands that execute when OpenClaw performs its command discovery routine.

The vulnerability mechanism involves the following steps:

1. Attacker establishes a WebSocket connection to the Gateway API
2. Attacker sends a config.apply request with a malicious cliPath value
3. OpenClaw stores the configuration without proper validation
4. During command discovery, the unsanitized cliPath is passed to a shell execution context
5. The injected commands execute with gateway user privileges

For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-25593

Indicators of Compromise

• Unusual WebSocket connections to the OpenClaw Gateway API from unexpected local processes
• Suspicious modifications to OpenClaw configuration files, particularly changes to cliPath values
• Unexpected child processes spawned by the OpenClaw gateway process
• Anomalous shell commands executed under the gateway user account

Detection Strategies

• Monitor WebSocket API access logs for unauthenticated config.apply requests
• Implement file integrity monitoring on OpenClaw configuration files
• Deploy endpoint detection rules to identify command injection patterns in process creation events
• Review gateway process activity for unusual command execution patterns

Monitoring Recommendations

• Enable detailed logging for the OpenClaw Gateway WebSocket API
• Configure alerts for configuration changes occurring outside normal administrative windows
• Monitor for shell metacharacters (;, |, &, $(), backticks) in configuration values
• Implement process tree monitoring to detect suspicious child processes of the gateway service

How to Mitigate CVE-2026-25593

Immediate Actions Required

• Upgrade OpenClaw to version 2026.1.20 or later immediately
• Restrict local access to systems running OpenClaw to authorized users only
• Review current OpenClaw configurations for any signs of tampering
• Audit system logs for potential exploitation attempts prior to patching

Patch Information

The vulnerability is fixed in OpenClaw version 2026.1.20. Users should upgrade to this version or later to remediate the vulnerability. The fix implements proper input validation and sanitization for configuration values passed through the Gateway WebSocket API, preventing command injection via malicious cliPath values.

For additional details, see the GitHub Security Advisory.

Workarounds

• Implement network segmentation to limit local access to systems running OpenClaw
• Apply principle of least privilege to the gateway user account to minimize impact of potential exploitation
• Consider disabling the Gateway WebSocket API if not required for your deployment
• Deploy application-level firewall rules to restrict access to the configuration endpoints