CVE-2026-22217 OpenClaw CVE debrief

Who should care

Organizations running OpenClaw version 2026.2.22 on Node.js environments, particularly those with multi-user systems or shared development environments where directory permissions may be misconfigured. System administrators managing Homebrew or similar package manager installations should prioritize this update due to the common use of /opt/homebrew/bin as a trusted-prefix directory.

Technical summary

The vulnerability exists in OpenClaw's shell-env component where trusted-prefix fallback logic for resolving the $SHELL environment variable can be abused. When $SHELL contains a path within a writable trusted-prefix directory (e.g., /opt/homebrew/bin), an attacker with sufficient local access can place a malicious binary at that location. OpenClaw's process will then execute this attacker-controlled binary when performing shell operations. The attack requires local access and low privileges but can result in high integrity impact within the application context. The fix in version 2026.2.23 addresses the fallback logic to prevent this execution path.

Defensive priority

medium

Recommended defensive actions

• Upgrade OpenClaw to version 2026.2.23 or later to address the shell-env trusted-prefix fallback vulnerability
• Review and restrict write permissions on trusted-prefix directories such as /opt/homebrew/bin to prevent attacker-controlled binary placement
• Audit environment variable configurations, particularly $SHELL, on systems running OpenClaw to ensure they point to legitimate binaries
• Monitor for unexpected process executions within the OpenClaw process context that may indicate exploitation attempts
• Validate that security controls prevent unprivileged users from modifying critical environment variables used by OpenClaw

Evidence notes

The vulnerability affects OpenClaw running on Node.js, specifically versions from 2026.2.22 up to but not including 2026.2.23. The CVSS 4.0 vector indicates local attack vector with low attack complexity, requiring low privileges but no user interaction. The weakness is classified as CWE-829: Inclusion of Functionality from Untrusted Control Sphere.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.