CVE-2026-62229

Executive Summary

CVE-2026-62229 is a high-severity authorization bypass vulnerability in OpenClaw versions prior to 2026.5.18. The flaw resides in the exec allowlist glob matching mechanism, enabling lower-trust callers to execute actions that exceed their intended authorization when the affected feature is enabled. Successful exploitation results in full compromise of confidentiality, integrity, and availability (CVSS 8.8), making immediate patching a critical priority for organizations running affected OpenClaw deployments.

Technical Analysis

Vulnerability Class: Path Traversal / Authorization Bypass (CWE-22)

The vulnerability stems from improper validation of input paths against allowlist glob patterns implemented within OpenClaw's exec authorization mechanism. When an application uses glob patterns (e.g., *, ?, [] wildcards) to define which executables or actions are permitted for a given trust level, the matching logic fails to account for path traversal sequences or crafted path normalization.

Attack Mechanism:

The NVD description indicates that "attackers can craft input paths that traverse the allowlist glob patterns." This suggests the core issue is a failure to canonicalize or normalize input paths before matching them against the allowlist. Specifically:

• The allowlist defines a set of permitted glob patterns (e.g., /usr/bin/safe_*)
• The matching engine compares attacker-supplied input against these patterns
• A crafted input such as /usr/bin/safe_tool/../../bin/unsafe or an encoded representation (e.g., URL-encoded or double-encoded slashes, backslash variants, null bytes) may bypass the glob comparator
• The traversal component allows the effective path to resolve outside the allowlisted scope

This is a classic authorization bypass via path equivalence — the glob matcher sees one string while the underlying execution engine resolves another. The impact described ("execute or persist unauthorized actions") indicates both one-shot command execution and the ability to install persistent artifacts.

Attack Surface:

• Precondition: The exec allowlist feature must be enabled (explicitly stated in the NVD description: "when the affected feature is enabled")
• Authentication: Requires only low-privileged access (CVSS PR:L), meaning an authenticated lower-trust caller within the OpenClaw environment
• Network: Exploitable remotely (AV:N) without user interaction (UI:N)
• Scope: Unchanged (S:U) — the compromise is contained within the OpenClaw environment's security boundary

Technical Detail Limitation: The NVD description does not specify the exact glob matching library, the specific API endpoints, or the precise input validation routines affected. Insufficient technical detail is available to enumerate exact function names or parameter handling. The analysis above is grounded in the vulnerability class (CWE-22) and the described glob traversal mechanism.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class and NVD description.

Step 1: Reconnaissance & Target Identification

The attacker, possessing low-privilege authenticated access to an OpenClaw instance, first identifies whether the exec allowlist feature is enabled. This may be accomplished by observing error messages, reviewing configuration artifacts accessible at the current trust level, or attempting known-allowlisted commands and observing response differentials. The attacker also enumerates which action types are governed by the glob allowlist versus other authorization mechanisms (e.g., RBAC roles, API keys) to confirm this is the correct bypass vector.

Step 2: Triggering the Flaw Class

The attacker crafts an input path designed to evade glob pattern matching while resolving to a disallowed target. Since the flaw is in glob matching, the attacker tests variants:

• Path Traversal Sequences: Injecting ../ components that cancel out to bypass allowlist path prefixes
• Encoding Obfuscation: URL encoding, double-encoding, or Unicode normalization that confuses the matcher but is normalized by the execution layer
• Alternative Separators: Backslashes on Windows or mixed separators on POSIX systems

Example at the class level: If the allowlist permits /opt/openclaw/actions/*.sh, an input of /opt/openclaw/actions/../../bin/evil.sh may pass the glob check (because the literal string begins with the allowed prefix and matches the *.sh pattern) yet resolve to /bin/evil.sh when executed.

Step 3: Payload/Execution Method

The attacker submits the crafted path through the OpenClaw action execution interface. Because the allowlist check is bypassed, the execution engine processes the request without re-validating the resolved path. The attacker can then:

• Execute arbitrary commands with the privileges of the OpenClaw service account, potentially escalating to full system compromise
• Persist unauthorized actions by writing executable payloads to directories that survive restarts or by modifying OpenClaw's own configuration to maintain access

Step 4: Post-Exploitation Impact

With successful execution, the attacker achieves:

• Confidentiality compromise (C:H): Reading sensitive files, credentials, and data accessible to the OpenClaw process
• Integrity compromise (I:H): Modifying application state, injecting malicious code, altering monitored actions
• Availability compromise (A:H): Disrupting service, deleting critical resources, or using the foothold to pivot to connected systems

The lower-trust to higher-trust privilege escalation is the core business impact — the authorization boundary intended by the allowlist is entirely negated.

Impact Assessment

CVSS:3.1 — 8.8 (High) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Business Impact:

• Affected Systems: All OpenClaw deployments running versions prior to 2026.5.18 with the exec allowlist feature enabled; OSV package status indicates the vulnerability is unfixed for the / package across all versions (0→unfixed)
• Blast Radius: Any environment where OpenClaw orchestrates or executes actions on behalf of multiple trust tiers — including CI/CD pipelines, automation servers, or security operations platforms; the trust-boundary breach propagates to anything the OpenClaw process can access
• Exploitation Likelihood: EPSS score of 0.00446 (36.7th percentile) indicates low current exploit activity, but the low Attack Complexity and high impact make this an attractive target once awareness spreads; no CISA KEV listing and no public PoC at the time of writing
• Reputational & Compliance: Unauthorized code execution in an automation platform may violate compliance frameworks (PCI DSS, SOC 2, FedRAMP) that require strict access controls and audit trails

Detection Guidance

Detection of this vulnerability requires identifying anomalous path traversal attempts in OpenClaw's action execution requests, unexpected subprocess/execution behavior, and unusual file-system access patterns falling outside allowlisted scope.

Sigma Rule

title: OpenClaw Exec Allowlist Glob Traversal Attempt
id: 4f2c1a9e-3b7d-4c5f-9a2b-6d8e1f0a2c4d
status: experimental
description: Detects path traversal attempts against OpenClaw exec allowlist glob matching
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-62229
author: Valtersit Threat Intelligence
date: 2026/06/01
logsource:
    category: process_creation
    product: linux
detection:
    selection_openclaw:
        Image|endswith:
            - '/openclaw'
            - '/openclawd'
    selection_traversal:
        CommandLine|contains:
            - '../'
            - '..\\'
            - '%2e%2e'
            - '%252e%252e'
            - '..;'
    selection_encoded:
        CommandLine|contains:
            - '%00'
            - '%2f'
            - '%5c'
    condition: selection_openclaw and (selection_traversal or selection_encoded)
level: high
falsepositives:
    - Legitimate use of relative paths by trusted administrators
    - Authorized file system operations outside the allowlist
tags:
    - attack.t1190
    - cve.2026.62229
    - cwe.22

YARA Rule

rule CVE_2026_62229_OpenClaw_Glob_Traversal
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect path traversal payloads targeting OpenClaw exec allowlist glob matching"
        cve = "CVE-2026-62229"
        date = "2026-06-01"
        severity = "high"
    strings:
        $traversal_dotdot = "../"
        $traversal_backslash = "..\\"
        $traversal_encoded1 = "%2e%2e%2f"
        $traversal_encoded2 = "%252e%252e%252f"
        $traversal_unicode = "..%c0%af"
        $null_byte = "%00"
        $openclaw_ref1 = "/openclaw/actions/" ascii
        $openclaw_ref2 = "exec_allowlist" ascii
        $openclaw_ref3 = "allowlist_glob" ascii
    condition:
        any of ($traversal_*) and any of ($openclaw_ref*) and filesize < 10MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-62229 - OpenClaw Exec Allowlist Glob Traversal Attempt";
    flow:established,to_server;
    content:"openclaw"; http_uri; nocase;
    pcre:"/(?:\.\.\/|\.\.\\|%2e%2e[%2f\\]|%252e%252e[%252f%255c])/i";
    sid:20266229;
    rev:1;
    metadata:created_at 2026_06_01, updated_at 2026_06_01, cve CVE-2026-62229, cwe CWE-22;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-62229;
    reference:url,valtersit.com/cve-2026-62229;
    classtype:attempted-admin;
    priority:1;
)

Elastic Detection

sequence by host.id with maxspan=30s
  [process where event.type == "start" and
     (process.name : "openclaw*" or process.executable : "*openclaw*") and
     process.command_line : ("*../*", "*..\\*", "*%2e%2e*", "*%252e%252e*")]
  [file where event.type in ("create", "write") and
     file.path : ("/*", "/tmp/*", "/var/tmp/*") and
     not file.path : ("/opt/openclaw/actions/*", "/usr/bin/safe_*")]

Splunk SPL Query

index=main sourcetype=process_creation
  (Image="*openclaw*" OR CommandLine="*openclaw*")
  AND (CommandLine="*../*" OR CommandLine="*..\\*"
       OR CommandLine="*%2e%2e*" OR CommandLine="*%252e%252e*")
  OR (index=main sourcetype=linux_sysmon OR sourcetype=auditd
      AND CommandLine="*openclaw*" AND CommandLine="*traversal*")
| stats count by _time, host, user, CommandLine, process.id
| sort _time
| where count > 0

Wazuh OSSEC Rule

<group name="openclaw,">
  <rule id="463132" level="12">
    <decoded_as>json</decoded_as>
    <field name="CommandLine">\.\./|\.\.\\|%2e%2e|%252e%252e</field>
    <field name="Image">openclaw</field>
    <description>CVE-2026-62229 - OpenClaw exec allowlist glob traversal attempt detected</description>
    <group>local,pci_dss_10.6.1,soc2_se@</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 4/4 (CONFIRMED) — Fix verified by 3+ independent sources (NVD, CNA, OSV).

1. Immediate Mitigations (until patching)

• Disable the exec allowlist feature if it is not operationally critical — the NVD description explicitly states the vulnerability only exists "when the affected feature is enabled"
• Restrict authentication — Change credentials for all lower-trust callers; the CVSS vector requires low-privilege access, so tighten account provisioning
• Network segmentation — Place OpenClaw behind a WAF that filters path traversal payloads (../, encoded variants, null bytes)
• Monitor aggressively — Deploy the detection rules above; watch for anomalous subprocess execution and file writes outside the intended allowlist scope

2. Patch/Upgrade Steps

• Upgrade to OpenClaw 2026.5.18 or later as soon as possible. Patch sources (NVD, CNA, OSV) confirm the fix is available in this release
• The vendor advisory (referenced via NVD/CNA) provides the canonical upgrade path; follow standard OpenClaw upgrade procedures
• Validate configuration after upgrade — the fix may change glob matching behavior; review all allowlist definitions to ensure they still permit intended actions
• Regression testing — Verify all legitimate actions execute correctly post-upgrade

3. Long-Term Hardening

• Adopt least-privilege architecture — Reduce the number of lower-trust callers that can reach the exec interface; the vulnerability demonstrates the danger of overly broad trust tiers
• Implement defense-in-depth for path validation — Even with the glob allowlist fixed, add canonicalization checks (resolve symlinks, normalize paths) before executing any action
• Centralized audit logging — Ensure all OpenClaw exec requests are logged to a SIEM for retroactive analysis
• Regular vulnerability scanning — Incorporate OpenClaw version checks into automated patch management
• Review trust-tier design — Revisit the trust model: if lower-trust callers exist, they should never be able to reach privileged exec mechanisms without additional layers of authorization

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-62229 — Official NVD record with CVSS vector, CWE-22 classification, and patch confirmation.
2. CNA Advisory: Vendor security bulletin confirming vulnerability and fix version 2026.5.18 (referenced via NVD/CNA metadata).
3. OSV Entry: OSV package record confirming the / package with version range 0→unfixed and patch status.
4. Valtersit Threat Intelligence: https://valtersit.com/cve-2026-62229 — This report and ongoing CVE coverage.
5. MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique mapping.

Threat Actor Activity: No known threat actor campaigns or exploits-in-the-wild evidence associated with CVE-2026-62229 at the time of writing. EPSS score of 0.00446 (36.7th percentile) and absence from CISA KEV indicate the vulnerability is not currently under active exploitation. However, the low attack complexity and high impact warrant immediate patching before weaponization occurs.