Four OpenClaw Flaws Let Attackers Steal Data, Escalate Privileges and Persist
Four critical vulnerabilities in OpenClaw, collectively named Claw Chain, can be chained to achieve data theft, privilege escalation, and persistent backdoor access. Cyera researchers detail a four-step exploitation sequence that uses the AI agent's own runtime privileges against the environment.
Developer at keyboard with security vulnerability warnings on a terminal monitor and a network vulnerability diagram on a second screen
Security researchers at Cyera have disclosed four vulnerabilities in OpenClaw that can be chained in sequence to achieve data theft, privilege escalation, and persistent backdoor access. The vulnerability set, collectively named Claw Chain, was disclosed on 15 May 2026 and has been fully patched in OpenClaw version 2026.4.22.
The Four Vulnerabilities
The four flaws span two categories: sandbox escape and access control failure. The most severe, CVE-2026-44112 (CVSS 9.6), is a time-of-check/time-of-use (TOCTOU) race condition in the OpenShell managed sandbox backend. It allows an attacker to bypass sandbox restrictions and redirect file writes outside the intended mount root, enabling backdoor installation and configuration tampering.
CVE-2026-44113 (CVSS 7.7) exploits a similar TOCTOU race condition to read files, including credentials, secrets, and internal configuration artefacts, from outside the mount root. CVE-2026-44115 (CVSS 8.8) is an incomplete input validation flaw that allows attackers to bypass OpenShell's allowlist by embedding shell expansion tokens inside a heredoc body, executing unapproved commands at runtime. CVE-2026-44118 (CVSS 7.8) is an improper access control vulnerability that allows non-owner loopback clients to impersonate the owner role, gaining control over gateway configuration, cron scheduling, and execution environment management.
The Four-Step Exploitation Chain
The exploitation chain unfolds in four sequential steps. First, a malicious plugin, prompt injection, or compromised external input gains code execution inside the OpenShell sandbox. Second, CVE-2026-44113 and CVE-2026-44115 are used together to expose credentials, secrets, and sensitive files. Third, CVE-2026-44118 is exploited to obtain owner-level control of the agent runtime. Fourth, CVE-2026-44112 is used to plant backdoors, modify configuration, and establish persistence.
"By weaponising the agent's own privileges, an adversary moves through data access, privilege escalation, and persistence using the agent as their hands inside the environment. Each step looks like normal agent behaviour to traditional controls, broadening blast radius and making detection significantly harder." - Cyera
The Root Cause
The root cause of CVE-2026-44118 is particularly significant from a design perspective. OpenClaw was trusting a client-controlled flag (senderIsOwner) to determine whether a caller was authorised for owner-only operations, without verifying it against the authenticated session. The fix separates owner and non-owner bearer tokens and derives senderIsOwner exclusively from which token authenticated the request. The spoofable sender-owner header has been removed entirely.
This is not the first time OpenClaw has faced serious security scrutiny. An earlier critical vulnerability, CVE-2026-25253, disclosed in February 2026, allowed any website a user visited to silently open a WebSocket connection to the OpenClaw gateway and brute-force the password to gain full agent control. A separate CrowdStrike analysis of OpenClaw's enterprise risk noted that when agents run on corporate hardware connected to SaaS applications, email, and file systems, a compromised agent is functionally equivalent to a compromised workstation.
What GCC Enterprise Teams Must Do Now
For enterprise security teams across the GCC and MENA region deploying AI-powered agents or agentic workflows, Claw Chain is a concrete case study in why agent runtimes must be treated as privileged infrastructure rather than productivity tools. The broader adoption of agentic AI across the Gulf, including in financial services, government automation, and enterprise IT, makes this risk category directly relevant.
Security teams should confirm that all instances of OpenClaw have been updated to version 2026.4.22, audit the privilege boundaries of any AI agent framework operating in or near production systems, and review which SaaS integrations and file system paths are accessible to deployed agents. The discovery was credited to security researcher Vladimir Tokarev. Full CVE details and the OpenClaw advisory are available for technical review.
Omar Al-Hakeem
Senior Cyber Threat Analyst | MENA RegionOmar Al-Hakeem is a cybersecurity researcher specializing in threat intelligence, ransomware trends, and nation-state activity across the Middle East and North Africa. With over 12 years of experience in SOC operations and incident response, he provides deep technical breakdowns of emerging attacks and regional cyber risks. At MENA Cyber Wire, Omar focuses on real-world threat analysis and actionable defense strategies for enterprises and startups.