CVE-2026-27576: 
Homebrew vulnerability analysis and mitigation

CVE-2026-27576 is an uncontrolled resource consumption vulnerability in OpenClaw, a personal AI assistant, affecting the Agent Client Protocol (ACP) bridge component. The ACP bridge failed to enforce size limits on incoming prompt text blocks, allowing oversized payloads to be assembled in memory before being forwarded to chat.send, potentially causing reduced responsiveness or denial of service. All versions up to and including 2026.2.17 (npm package) are affected; the issue was fixed in version 2026.2.19. It was disclosed on February 20, 2026, with a CVSS v3.1 base score of 4.0 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (Github Advisory).

The root cause is CWE-400 (Uncontrolled Resource Consumption) combined with CWE-20 (Improper Input Validation) in src/acp/event-mapper.ts and src/acp/translator.ts. The extractTextFromPrompt function accumulated text blocks from ACP prompt content without any byte-length check, allowing arbitrarily large strings to be concatenated in memory before a final size guard (which was also absent in earlier code paths) could reject them. Because ACP operates over local stdio, exploitation requires local access — typically through an IDE integration or similar local ACP client — and no network-facing attack path exists in the default configuration. The fix enforces a 2 MiB per-prompt limit block-by-block before concatenation, accounts for inter-block newline separator bytes, adds a defense-in-depth final check on the assembled message, and corrects a stale active-run session state bug that could occur when oversized prompts were rejected (Github Advisory, Patch Commit).

Successful exploitation causes the local OpenClaw ACP session to become unresponsive due to excessive memory consumption when processing oversized prompt payloads. Additionally, if the oversized text is forwarded to the underlying AI model before rejection, it may result in unexpectedly high model API usage and associated costs. There is no confidentiality or integrity impact, no privilege escalation, and no lateral movement potential, as the vulnerability is strictly local with availability impact only (Github Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation as of the disclosure date (Github Advisory). The EPSS score is approximately 0.006–0.007%, placing it in the 1st percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and at least low privileges, significantly limiting the attacker population to users with access to the local machine running OpenClaw.

1. Identify a vulnerable installation: Confirm the target machine is running OpenClaw npm package version ≤ 2026.2.17 with an ACP-connected local client (e.g., an IDE integration such as a VS Code extension).
2. Craft an oversized prompt payload: Prepare a prompt containing one or more text blocks whose total UTF-8 byte length exceeds 2 MiB (e.g., a string of 'a'.repeat(2 * 1024 * 1024 + 1)).
3. Submit via local ACP stdio interface: Send the oversized prompt through the local ACP stdio bridge — for example, by triggering a large file or document to be submitted as context through the IDE integration.
4. Trigger resource exhaustion: The ACP bridge assembles the full concatenated string in memory without size enforcement, consuming excessive memory and causing the OpenClaw process to become unresponsive or degrade in performance (Github Advisory, Patch Commit).

• Process: OpenClaw Node.js process exhibiting abnormally high memory consumption or becoming unresponsive after receiving a large prompt via an IDE integration.
• Logs: Application-level errors or hangs originating from src/acp/event-mapper.ts or src/acp/translator.ts; absence of a Prompt exceeds maximum allowed size error in versions ≤ 2026.2.17 when large inputs are submitted.
• Network/API: Unexpectedly large or costly AI model API calls forwarded from the ACP bridge, potentially visible in model provider usage dashboards.

Upgrade OpenClaw (npm) to version 2026.2.19 or later, which enforces a 2 MiB prompt-text limit block-by-block before concatenation, accounts for inter-block separator bytes, and adds a final defense-in-depth size check before chat.send (Github Advisory). As a workaround for those unable to upgrade immediately, restrict local access to the ACP bridge interface to trusted users only, and configure IDE integrations to avoid submitting unusually large files or documents as prompt context. The fix was delivered across commits 732e531, ebcf197, and 63e39d7 in the openclaw/openclaw repository (Patch Commit).