Critical OpenClaw AI Assistant Vulnerabilities Could Enable Credential Theft and Remote Code Execution
Security researchers have disclosed three high-severity vulnerabilities affecting the OpenClaw AI assistant that could allow attackers to steal sensitive credentials, escalate privileges, and execute arbitrary commands on vulnerable systems.
The issues, discovered by security researcher Chinmohan Nayak, have been fixed in OpenClaw version 2026.6.6. Organizations using earlier versions should upgrade immediately to reduce the risk of exploitation.
Overview of the Vulnerabilities
The security flaws impact multiple components of OpenClaw and could be exploited through external communication channels, including messaging platforms such as WhatsApp.
The disclosed vulnerabilities include:
- GHSA-hjr6-g723-hmfm (CVSS 8.8) – Operating system command injection.
- GHSA-9969-8g9h-rxwm (CVSS 8.8) – A second command injection vulnerability that could allow arbitrary command execution.
- GHSA-575v-8hfq-m3mc (CVSS 8.4) – A path traversal vulnerability that bypasses denylist protections and exposes sensitive files.
Together, these vulnerabilities present a serious security risk for organizations using vulnerable OpenClaw deployments.
Potential Impact
Successful exploitation could allow attackers to:
- Execute arbitrary operating system commands.
- Steal sensitive credentials stored on the host.
- Escalate privileges within the environment.
- Access confidential configuration files and authentication keys.
- Potentially escape containerized environments and compromise the underlying host.
If left unpatched, these issues could provide attackers with broad access to systems running OpenClaw.
Credential Theft Through Path Traversal
One of the most concerning vulnerabilities is the path traversal flaw, which allows attackers to access directories that should normally be restricted.
Depending on the system configuration, attackers may be able to mount directories containing valuable credentials, including:
- ~/.ssh (SSH keys)
- ~/.aws (AWS credentials)
- ~/.gnupg (GPG keys)
Exposure of these directories could enable unauthorized access to cloud infrastructure, source code repositories, production servers, and encrypted communications.
Risk of Full Host Compromise
Researchers also noted that mounting the /var directory may expose the Docker socket.
If the Docker socket becomes accessible, attackers may be able to escape container isolation and gain control of the underlying host system. This significantly increases the potential impact of the vulnerabilities, especially in production environments running containerized workloads.
Exploitation Through External Messages
A particularly notable aspect of these vulnerabilities is that they can be triggered through external messages sent via communication platforms such as WhatsApp.
This means an attacker may not require direct access to the server. Instead, a crafted message processed by an affected OpenClaw instance could trigger the vulnerable functionality, making internet-facing AI assistants especially attractive targets.
Patched Version
The vulnerabilities have been resolved in OpenClaw version 2026.6.6.
Organizations should verify the version currently deployed across all environments and upgrade any affected instances as soon as possible.
Recommended Mitigation Steps
In addition to upgrading, administrators should implement the following security measures:
- Update OpenClaw to version 2026.6.6 or later.
- Enable sandbox mode for non-primary sessions.
- Remove the exec tool from the allowlist for channel-facing AI agents whenever possible.
- Monitor systems for suspicious git clone commands using the ext:: protocol helper.
- Limit sensitive features to trusted operators only or disable them if they are not required.
- Apply the principle of least privilege by maintaining narrow channel and tool allowlists.
- Avoid sharing a single Gateway instance between untrusted users or workloads.
Final Thoughts
As AI assistants become increasingly integrated into enterprise workflows, they also become attractive targets for attackers. Vulnerabilities that enable command injection, path traversal, or credential theft can quickly lead to complete system compromise if left unaddressed.
Organizations using OpenClaw should prioritize upgrading to the latest patched release, review their deployment configurations, and implement layered security controls to minimize the attack surface. Proactive monitoring and strict access controls remain essential for securing AI-powered infrastructure.