CVE-2026-26320: OpenClaw macOS Client RCE Vulnerability

CVE-2026-26320 Overview

CVE-2026-26320 is a User Interface Confusion vulnerability affecting the OpenClaw macOS desktop client, a personal AI assistant application. The vulnerability exists in how the application handles openclaw:// URL scheme deep links, specifically within the confirmation dialog that displays agent messages to users before execution.

The OpenClaw macOS desktop client registers the openclaw:// URL scheme for deep link handling. When processing openclaw://agent deep links without an unattended key parameter, the application displays a confirmation dialog that previously showed only the first 240 characters of the message content while executing the full message after user approval. This truncation behavior creates an opportunity for attackers to craft malicious payloads that appear benign in the preview but contain hidden malicious commands.

Critical Impact

Attackers can pad messages with whitespace to hide malicious payloads beyond the 240-character preview limit, potentially leading to arbitrary command execution when users approve seemingly innocent prompts.

Affected Products

• OpenClaw macOS Desktop Client versions 2026.2.6 through 2026.2.13
• OpenClaw macOS Desktop Client (beta versions)

Discovery Timeline

• 2026-02-19 - CVE-2026-26320 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-26320

Vulnerability Analysis

This vulnerability is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information). The core issue stems from a mismatch between what users see in the confirmation dialog and what the application actually executes.

When a user clicks on a malicious openclaw://agent deep link, the confirmation dialog renders only the first 240 characters of the message payload. However, the underlying execution engine processes the complete message content regardless of what was displayed. This creates a classic "what you see is not what you get" scenario that can be exploited through social engineering.

The attack is particularly effective because the confirmation prompt asks users to approve running an OpenClaw agent, which by design has access to various system capabilities depending on the user's configured tool approvals and allowlists. If a user has granted broad permissions to the agent, the hidden malicious payload could leverage those permissions to execute arbitrary commands.

Root Cause

The root cause is improper input handling in the UI rendering logic of the confirmation dialog. The application truncates the displayed message to 240 characters for UI presentation purposes but fails to apply the same truncation to the executed payload. This design flaw violates the principle that security-critical user decisions should be based on complete and accurate information.

The vulnerability exists because:

1. The confirmation dialog has a fixed display limit of 240 characters
2. No visual indication warns users that the message has been truncated
3. The execution path processes the full message content regardless of display truncation
4. Whitespace characters are valid padding that remains invisible in the truncated preview

Attack Vector

An attacker can exploit this vulnerability by crafting a specially formatted deep link URL containing a benign-looking message in the first 240 characters followed by whitespace padding and a malicious payload. The attack flow proceeds as follows:

1. The attacker creates a malicious openclaw://agent deep link with a hidden payload
2. The link is distributed through phishing emails, malicious websites, or other social engineering channels
3. When a victim clicks the link, the OpenClaw macOS client intercepts it
4. The confirmation dialog displays only the innocent-looking first 240 characters
5. The user, seeing a harmless prompt, clicks "Run" to approve
6. The application executes the full message including the hidden malicious commands
7. Depending on the user's tool approvals, this can lead to arbitrary command execution

The attack requires network access to deliver the malicious link and user interaction to approve the prompt, making it a social engineering-mediated vulnerability.

Detection Methods for CVE-2026-26320

Indicators of Compromise

• Unusual or unexpected "Run OpenClaw agent?" confirmation dialogs appearing during web browsing
• Deep link URLs containing excessive whitespace characters or unusually long query parameters
• OpenClaw agent activity logs showing commands that weren't visible in confirmation prompts
• Network traffic containing openclaw://agent URLs from untrusted external sources

Detection Strategies

• Monitor for openclaw:// URL scheme invocations from web browsers or external applications
• Implement endpoint detection rules to flag deep links with message parameters exceeding 240 characters
• Analyze OpenClaw agent execution logs for discrepancies between user-approved and executed commands
• Deploy web filtering to block known malicious domains hosting crafted deep links

Monitoring Recommendations

• Enable detailed logging for OpenClaw agent activities and deep link handling
• Configure SentinelOne endpoint protection to monitor URL scheme handler registrations and invocations
• Implement user behavior analytics to detect unusual patterns of agent approvals
• Set up alerts for OpenClaw process spawning unexpected child processes or network connections

How to Mitigate CVE-2026-26320

Immediate Actions Required

• Upgrade OpenClaw macOS desktop client to version 2026.2.14 or later immediately
• Instruct users to reject unexpected "Run OpenClaw agent?" prompts, especially when browsing untrusted websites
• Review and restrict tool approvals and allowlists configured for OpenClaw agents
• Consider temporarily disabling the openclaw:// URL scheme handler until patching is complete

Patch Information

The vulnerability has been fixed in OpenClaw version 2026.2.14. The patch addresses the UI truncation issue by ensuring the confirmation dialog accurately represents the full message content before execution.

For detailed patch information, refer to:

• GitHub Security Advisory GHSA-7q2j-c4q5-rm27
• GitHub Release v2026.2.14
• GitHub Commit with Fix

Workarounds

• Use unattended deep links only with a valid key parameter for trusted personal automations
• Avoid clicking openclaw:// links from untrusted sources or unfamiliar websites
• Configure restrictive tool approvals to limit potential damage from unauthorized agent execution
• Implement organizational policies requiring manual verification of agent commands before approval

# Verify installed OpenClaw version on macOS
# Ensure version is 2026.2.14 or later
/Applications/OpenClaw.app/Contents/MacOS/openclaw --version

# Review current URL scheme handler registration
# Check for openclaw:// scheme handling
plutil -p ~/Library/Preferences/com.openclaw.app.plist | grep -i url