CVE-2026-26320: OpenClaw macOS Client RCE Vulnerability

CVE-2026-26320 Overview

CVE-2026-26320 is a user interface misrepresentation vulnerability [CWE-451] in the OpenClaw macOS desktop client, a personal AI assistant application. The flaw resides in how the openclaw:// URL scheme handles openclaw://agent deep links without an unattended key. The confirmation dialog truncates the displayed message at 240 characters but executes the entire payload after the user clicks "Run." Attackers can pad messages with whitespace to push malicious content outside the visible preview. The OpenClaw macOS desktop client remains in beta at the time of disclosure. Affected versions include 2026.2.6 through 2026.2.13.

Critical Impact
A successful attack can lead to arbitrary command execution on the victim's macOS host, depending on the user's configured tool approvals and allowlists for the OpenClaw agent.

Affected Products

OpenClaw macOS desktop client versions 2026.2.6 through 2026.2.13
Apple macOS (host operating system for the affected client)
OpenClaw Node.js application package

Discovery Timeline

2026-02-19 - CVE-2026-26320 published to NVD
2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-26320

Vulnerability Analysis

The OpenClaw macOS client registers the openclaw:// custom URL scheme to handle agent deep links from browsers and other applications. When a deep link of the form openclaw://agent arrives without a valid unattended key, the client presents a confirmation dialog so the user can review the requested agent action. The dialog renders only the first 240 characters of the message in its preview area. However, the underlying execution path passes the full, untruncated message to the agent runtime once the user clicks "Run."

This discrepancy between displayed content and executed content creates a classic user interface misrepresentation condition. The vulnerability is social-engineering mediated: a user must visit an attacker-controlled page and approve the prompt for exploitation to succeed. Successful exploitation depends on the victim's configured tool approvals, which can extend agent actions into arbitrary command execution on the host.

Root Cause

The root cause is a divergence between the confirmation dialog's rendering logic and the agent's execution logic. The dialog applies a 240-character display cap without truncating the payload that gets dispatched to the agent. Whitespace padding inside the message is preserved during execution but visually pushes attacker content past the preview window. This is tracked as CWE-451: User Interface (UI) Misrepresentation of Critical Information.

Attack Vector

An attacker hosts a webpage or sends a link that triggers an openclaw://agent?message=... deep link. The attacker crafts the message so the first 240 characters appear benign — for example, a routine summarization request — followed by extensive whitespace and then a malicious instruction. macOS dispatches the URL to the OpenClaw client, which displays the truncated benign preview. If the user clicks "Run," the agent executes the full payload, including the hidden instruction. The resulting actions may invoke any tool the user has pre-approved, which can include shell commands or file system operations.

No verified public exploit code is available for CVE-2026-26320. Technical details are documented in GitHub Security Advisory GHSA-7q2j-c4q5-rm27 and the fix commit.

Detection Methods for CVE-2026-26320

Indicators of Compromise

Outbound clicks from browsers immediately followed by OpenClaw agent process activity referencing openclaw://agent URLs.
Unexpected child processes spawned by the OpenClaw client, including shell interpreters such as /bin/sh, /bin/bash, or osascript.
macOS Unified Log entries showing LaunchServices opening the openclaw:// scheme from untrusted parent applications.

Detection Strategies

Monitor process ancestry where the OpenClaw client is the parent of command-line utilities, file modification tools, or network clients such as curl and nc.
Inspect URL scheme handler invocations on macOS endpoints, correlating browser activity with subsequent OpenClaw deep link processing.
Hunt for OpenClaw client versions in the affected range (2026.2.6 through 2026.2.13) across managed macOS fleets.

Monitoring Recommendations

Alert on agent confirmation events followed by sensitive tool invocations within short time windows.
Capture and retain macOS Endpoint Security Framework telemetry for ES_EVENT_TYPE_NOTIFY_OPEN and ES_EVENT_TYPE_NOTIFY_EXEC events involving the OpenClaw binary.
Track installed OpenClaw versions through software inventory and flag any host that has not upgraded to 2026.2.14 or later.

How to Mitigate CVE-2026-26320

Immediate Actions Required

Upgrade the OpenClaw macOS desktop client to version 2026.2.14 or later, which contains the fix.
Audit the user's configured tool approvals and allowlists, removing any approvals that grant the agent shell or arbitrary command execution.
Instruct users not to approve unexpected "Run OpenClaw agent?" prompts that appear while browsing untrusted websites.

Patch Information

The issue is fixed in OpenClaw 2026.2.14. The corrective change is published in the v2026.2.14 release notes and applied through commit 28d9dd7. The vendor's full disclosure is available in GHSA-7q2j-c4q5-rm27.

Workarounds

Use unattended deep links only with a valid key reserved for trusted personal automations.
Disable or unregister the openclaw:// URL scheme handler on macOS until the client is patched.
Restrict the agent's tool allowlist to read-only, non-destructive operations while the client remains on a vulnerable version.

bash

# Verify the installed OpenClaw client version on macOS
/Applications/OpenClaw.app/Contents/MacOS/OpenClaw --version

# Inspect the registered handler for the openclaw:// URL scheme
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister \
  -dump | grep -i "openclaw://"