CVE-2026-100580 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a persistent cron job that executes attacker-selected commands with the privileges of the OpenClaw process user, resulting in access to host files and credentials and impact to scheduled service availability. The issue is limited to cron jobs created or edited through the model-facing cron tool; direct CLI and authorized Gateway scheduling surfaces are trusted operator controls. Fixed in 2026.7.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in OpenClaw versions prior to 2026.7.1 represents a critical logic flaw within the agent-facing shell-execution guard, specifically concerning how case sensitivity is handled during payload validation and subsequent normalization. The core technical failure lies in the discrepancy between the initial security check performed on incoming payloads from model-enabled agents and the final processing step that converts these inputs into operational cron jobs. When an attacker provides a mixed-case payload kind to the agent-facing interface, the existing guard mechanism fails to recognize it as malicious or restricted because its case-sensitive string matching does not account for variations in letter casing. Consequently, this malformed input bypasses the intended security controls and is subsequently normalized by the system into a standard command job structure without triggering appropriate rejection protocols. This architectural oversight allows an adversary who has gained control over a tool-enabled agent to inject arbitrary commands that are then persisted as scheduled tasks within the OpenClaw environment.
From an operational impact perspective, this vulnerability enables persistent remote code execution with elevated privileges. Since cron jobs execute under the context of the user account running the OpenClaw process, successful exploitation grants the attacker full access to host files and credentials associated with that specific privilege level. This leads to a complete compromise of system confidentiality and integrity, as sensitive data can be exfiltrated or modified at will. Furthermore, the ability to create persistent cron jobs allows for long-term persistence on the compromised host, ensuring that malicious activities continue even after initial access vectors are remediated or sessions are terminated. The availability impact is also significant, as attackers can schedule resource-intensive commands or destructive operations that degrade service performance or cause denial of conditions for legitimate users and scheduled services dependent on the OpenClaw infrastructure.
This flaw aligns with CWE-20 Improper Input Validation, where the system fails to adequately sanitize or validate input data before processing it into a critical subsystem. Additionally, the exploitation technique maps directly to MITRE ATT&CK T1053 Scheduled Task/Job, specifically the cron variant, which describes how adversaries use scheduled tasks for persistence and privilege escalation. The attack vector leverages CWE-78 Improper Neutralization of Special Elements used in an OS Command by exploiting a logic error rather than a simple injection flaw, highlighting the importance of case-insensitive validation or canonicalization before security checks are applied.
To mitigate this vulnerability, organizations must immediately upgrade OpenClaw to version 2026.7.1 or later, where the normalization process has been corrected to enforce consistent casing during validation. In environments where immediate patching is not feasible, administrators should restrict access to model-facing tools and ensure that only authorized operators can interact with agent interfaces capable of triggering cron job creation. Implementing strict input filtering at the gateway level to normalize case before it reaches the internal logic layer can also serve as a compensating control. Regular auditing of scheduled tasks and monitoring for unusual command execution patterns associated with the OpenClaw process user will help detect any potential exploitation attempts that may have occurred prior to remediation.