CVE-2026-22169: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-22169 is an allowlist bypass vulnerability in OpenClaw (npm package) versions prior to 2026.2.22 that allows high-privileged local attackers to execute unauthorized external programs by abusing the --compress-program option of sort when it is explicitly added to the tools.exec.safeBins configuration. The vulnerability was disclosed on March 18, 2026, with a patch planned in version 2026.2.22. It carries a CVSS v3.1 base score of 6.7 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is classified under CWE-78 (OS Command Injection) and CWE-15 (External Control of System or Configuration Setting). OpenClaw's tools.exec.safeBins feature is designed to restrict which external binaries agents may invoke; however, when sort is explicitly added to this allowlist, the --compress-program option of GNU sort can be used to invoke an arbitrary external executable as a compression helper, effectively bypassing the allowlist enforcement. The fix, committed as 57fbbaebca4d34d17549accf6092ae26eb7b605c, moves --compress-program from the permitted flags list to the blockedFlags list in exec-safe-bin-policy.ts, and adds explicit test cases to prevent regression (GitHub Commit, GitHub Advisory). Exploitation requires that sort be non-default explicitly added to tools.exec.safeBins, making this a non-default configuration issue (GitHub Advisory).

Successful exploitation allows a high-privileged local attacker to execute arbitrary external programs outside the intended allowlist, resulting in high impact to confidentiality, integrity, and availability of the affected system. An attacker could read sensitive data, modify application or system files, or disrupt service availability. The scope is limited to the vulnerable component (unchanged scope), and there is no evidence of lateral movement potential beyond the local system (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.04%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges and a non-default configuration where sort has been explicitly added to tools.exec.safeBins, significantly limiting the attack surface (Feedly, GitHub Advisory).

1. Precondition check: Confirm that the target OpenClaw instance is running a version ≤2026.2.21-2 and that sort has been explicitly added to tools.exec.safeBins in the tools.exec configuration (non-default).
2. Identify the exec interface: Locate the agent or API surface through which tools.exec commands can be submitted, requiring high-privilege access to the OpenClaw environment.
3. Craft malicious command: Construct a command invoking sort with the --compress-program flag pointing to an arbitrary external executable, e.g., sort --compress-program=sh or sort --compress-program=/path/to/malicious-binary.
4. Submit command: Submit the crafted command through the OpenClaw exec interface. Because --compress-program was previously in the allowed flags list, the safeBins policy check passes and the external program is invoked.
5. Achieve code execution: The specified external program (e.g., sh) is executed by sort as a compression helper, granting the attacker arbitrary command execution outside the intended allowlist (GitHub Advisory, GitHub Commit).

• Logs: OpenClaw execution logs showing sort invoked with --compress-program argument; unexpected child process spawns from the OpenClaw agent process.
• Process: Unusual processes (e.g., sh, bash, or other binaries) spawned as children of the sort process, which itself is a child of the OpenClaw Node.js process.
• Configuration: Presence of sort in the tools.exec.safeBins configuration on systems running OpenClaw ≤2026.2.21-2, indicating potential exposure.
• File System: Unexpected files created or modified in directories accessible to the OpenClaw service account following sort execution events (GitHub Advisory).

Upgrade OpenClaw to version 2026.2.22 or later, which blocks --compress-program in the sort safe-bin policy (GitHub Commit). As an immediate workaround, remove sort from tools.exec.safeBins if it is not strictly required, eliminating the attack vector entirely. Additionally, audit the tools.exec.safeBins configuration to ensure only necessary tools are included, and restrict modification of this configuration to authorized administrators only (GitHub Advisory, Feedly).

The vulnerability was reported by researcher @tdjackey and acknowledged by the OpenClaw maintainer steipete in the GitHub Security Advisory. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (GitHub Advisory).