PERMISSION/PROTOCOL
Back to incident tracker

2026-04-23

CriticalVendor post

OpenClaw ‘Claw Chain’ — Four chained CVEs expose 245,000 public AI agent servers to credential theft, privilege escalation, and persistence

Four chained CVEs in OpenClaw expose 245,000 public AI agent servers. Attackers can steal credentials, escalate to owner control, and install persistent backdoors using the agent’s own privileges.

OpenClawTool execution / MCPSandbox escape / privilege escalation / persistent backdoorOpenClaw agent runtime / OpenShell sandbox / host filesystem

What happened

Attacker gains sandbox foothold via malicious plugin or prompt injection, chains CVE-2026-44113 and CVE-2026-44115 to exfiltrate credentials and secrets, exploits CVE-2026-44118 to escalate to owner-level gateway control, then uses CVE-2026-44112 to install a persistent backdoor on the host.

Why it matters

Full host compromise: credential and secret theft, owner-level agent reconfiguration, and persistent backdoor installation. All approximately 245,000 exposed instances were potentially accessible to this chain prior to the April 23 patch.

Missing authorization check

Owner-level gateway operations (configuration changes, cron scheduling, execution management) should require an out-of-band authorization receipt that cannot be self-issued by the agent runtime. The client-controlled senderIsOwner flag should be validated server-side against the authenticated session.

Would PP block it?

PP covers the authorization layer: any action requiring owner-level gateway control (CVE-2026-44118 pathway) would fail if the agent cannot produce a valid external receipt. PP does not protect against TOCTOU filesystem races (CVE-2026-44112/113) or environment variable leakage (CVE-2026-44115) — those require runtime sandbox hardening. Key insight: even a fully-compromised agent runtime cannot execute authorized production actions if the authority chain is external.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-04

    Cyera Research discovers and privately discloses four vulnerabilities to OpenClaw maintainers.

  2. 2026-04-23

    OpenClaw releases patches covering GHSA-5h3g-6xhh-rg6p, GHSA-wppj-c6mr-83jj, GHSA-r6xh-pqhr-v4xh, and GHSA-x3h8-jrgh-p8jx.

  3. 2026-05

    Cyera publishes ‘Claw Chain’ blog post. CybersecurityNews and The Hacker News report approximately 245,000 publicly exposed instances via Shodan and ZoomEye scans.

  4. 2026-05

    Security advisories recommend immediate patching, full secret rotation, and treating OpenClaw deployments as privileged identities.

Technical breakdown

  • CVE-2026-44112 (CVSS 9.6 Critical): TOCTOU race in OpenShell write path allows sandbox escape, host filesystem writes, and persistent backdoor placement.
  • CVE-2026-44113 (CVSS 7.7 High): TOCTOU race in read path allows symlink-swapping to expose system files and credentials outside the allowed mount root.
  • CVE-2026-44115 (CVSS 8.8 High): Command validation gap allows environment variables (API keys, tokens) to leak through unquoted heredocs at shell execution time.
  • CVE-2026-44118 (CVSS 7.8 High): Client-controlled senderIsOwner flag not validated server-side; any process with a valid bearer token can self-escalate to owner-level gateway control.
  • The chain is particularly dangerous because each step mimics normal agent behavior, making detection significantly harder for traditional security controls.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Agent gateway / owner-level action authorization
Still needs
Sandbox isolation (TOCTOU race conditions), environment variable handling at shell execution, and host filesystem access controls are outside PP’s enforcement scope
Receipt required for
Owner-level gateway configuration changes, cron scheduling modifications, execution environment management, and host filesystem writes outside declared mount roots

PP’s external receipt model limits blast radius: a compromised agent runtime cannot self-authorize owner-level actions if those actions require receipts from an external enforcement layer the agent doesn’t control. However, PP cannot prevent the sandbox escape or initial credential exfiltration.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop