CVE-2026-22179: Openclaw

High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution syntax within double-quoted text to bypass security restrictions and execute arbitrary commands on the system.

Affected products

• Openclaw Openclaw: before 2026.2.22 (fixed in 2026.2.22)

Published 2026-03-18. Last modified 2026-06-17.