CVE-2026-26320: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26320 is a UI misrepresentation vulnerability in the OpenClaw macOS desktop client (a personal AI assistant) that allows an attacker to conceal a malicious agent message payload behind a truncated confirmation dialog. Affected versions span 2026.2.6 through 2026.2.13 (npm package openclaw); version 2026.2.14 contains the fix. The vulnerability was published on February 15, 2026, by reporter Cillian-Collins, and added to the GitHub Advisory Database on February 17, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, OpenClaw Advisory).

The root cause is classified as CWE-451 (User Interface Misrepresentation of Critical Information). When the OpenClaw macOS client handles an openclaw://agent deep link without an unattended key, it displayed only the first 240 characters of the message in the confirmation dialog but executed the full message upon user approval. An attacker could craft a deep link where benign-looking text fills the first 240 characters, followed by whitespace padding to push a malicious payload beyond the visible preview area. The fix (commit 28d9dd7) introduces a DeepLinkAgentPolicy that enforces a strict 240-character hard limit for unkeyed deep links — blocking execution entirely if the message exceeds this limit — and also strips delivery/routing parameters (deliver, to, channel) from unkeyed links to reduce exfiltration risk (GitHub Advisory, Fix Commit).

Successful exploitation can lead to arbitrary command execution on the victim's macOS system, contingent on the user's configured tool approvals and allowlists within OpenClaw. The primary impact is high integrity loss — an attacker can cause the AI agent to perform unauthorized actions (e.g., file manipulation, data exfiltration, or system commands) that the user did not knowingly authorize. Confidentiality and availability are not directly impacted by the vulnerability itself, but the scope of harm depends heavily on what tools the user has enabled in their OpenClaw configuration (GitHub Advisory, OpenClaw Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.061% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim must click a malicious openclaw:// deep link (e.g., embedded in a webpage) and approve the spoofed confirmation dialog (GitHub Advisory).

1. Craft the malicious deep link: Construct an openclaw://agent URL where the message parameter begins with innocuous-looking text (≤240 characters visible in the dialog), followed by a large block of whitespace characters, and then a hidden malicious payload (e.g., a shell command to exfiltrate data or execute a reverse shell).
2. Deliver the link to the target: Embed the crafted openclaw:// URL in a webpage, phishing email, or other medium that the target user is likely to visit or click.
3. Trigger the deep link: When the victim visits the malicious page or clicks the link in a browser, macOS invokes the registered openclaw:// URL scheme handler, opening the OpenClaw desktop client.
4. Social-engineer approval: The OpenClaw confirmation dialog displays only the first 240 characters of the message (the benign portion), prompting the user with "Run OpenClaw agent?". The victim, seeing only the harmless preview, clicks "Run".
5. Execute the hidden payload: OpenClaw executes the full message — including the hidden malicious portion — via the AI agent. Depending on the user's configured tool allowlists, this may result in arbitrary command execution, file access, or data exfiltration on the macOS host (GitHub Advisory, OpenClaw Advisory).

• Network: Unexpected outbound connections from the OpenClaw process to unknown external hosts shortly after a deep link was triggered; unusual data transfers that may indicate exfiltration.
• Logs: macOS system logs (Console.app or log show) showing openclaw://agent deep link invocations with unusually long message parameters containing large whitespace blocks; OpenClaw application logs recording agent runs initiated via deep link.
• Process: Unexpected child processes spawned by the OpenClaw agent (e.g., shell commands, curl, python, or other tools) that were not explicitly initiated by the user.
• File System: New or modified files in user directories (e.g., ~/.openclaw/, ~/Desktop/, or /tmp/) created around the time of a deep link invocation; unexpected scripts or executables dropped by the agent.

The vulnerability is fixed in OpenClaw version 2026.2.14; users should upgrade immediately via npm update openclaw or by downloading the latest macOS client release (Release Notes). As interim mitigations: do not approve unexpected "Run OpenClaw agent?" prompts triggered while browsing untrusted websites, and restrict use of unattended deep links to those with a valid key parameter for trusted personal automations only. The fix enforces a hard 240-character message limit for unkeyed deep links (blocking execution rather than truncating the preview) and strips delivery/routing parameters (deliver, to, channel) from unkeyed links (GitHub Advisory, Fix Commit).

The vulnerability was reported by security researcher Cillian-Collins and published by orlyjamie (an OpenClaw maintainer) on February 15, 2026. The fix was included in a large security-focused release (v2026.2.14) that addressed over 60 security issues across the OpenClaw platform, which received community attention (BeyondMachines). No broader media coverage or notable independent researcher commentary specific to CVE-2026-26320 has been identified.