OpenClaw's 2026 CVE Trail: What the Claw Chain Teaches About Running Self-Hosted Agents

Self-Hosted Agent Security, Part 1. This series follows OpenClaw and Hermes, the two self-hosted agents most people are running. This post covers OpenClaw’s incident record; Part 2 compares Hermes and OpenClaw against the OWASP Agentic Top 10.

Every major OpenClaw advisory this year comes down to one design mistake: the agent trusted a field the attacker could write. An approval flag in a request. A gateway URL in a query string. An owner claim in a request header. Once you see the pattern you can audit any self-hosted agent for it, OpenClaw or not.

Why OpenClaw became the agent everyone attacks

OpenClaw (formerly Clawdbot / Moltbot) is a self-hosted agent with a gateway, node hosts, and a skills ecosystem on ClawHub. It can browse, manage files, talk to messaging apps, and run code on the machine that hosts it.

That capability is why it is a target. An agent that can run system.run is a remote shell with a chat UI. Attack surface is set by what the agent can do, not by how many stars the repo has. Always-on boxes (including the Mac mini clusters people are standing up for local models) make a good compromise persistent.

The disclosure volume is real: OSV lists 591 advisories for the openclaw npm package (queried Oct 23, 2026). Read that as a large attack surface plus an active disclosure process, not as a single verdict on quality.

The 2026 incident timeline

A short reference, not a full CVE dump. Cite the advisory, note the fixed version, and stop there.

Incident	What went wrong	Fixed in	Source
CVE-2026-25253 / GHSA-g8p2-7wf7-98mq (gatewayUrl token theft)	Control UI took gatewayUrl from the query string, auto-connected, and sent the gateway token	2026.1.29	NVD · OSV
CVE-2026-28466 / GHSA-gv46-4xfq-jv58	node.invoke let clients inject params.approved / approvalDecision and skip exec approval for system.run	2026.2.14	GitHub advisory
GHSA-943q-mwmv-hhvh (no CVE)	/tools/invoke could reach session-spawn tools; ACP clients auto-approved risky permissions	2026.2.14	GitHub advisory
ClawJacked (Oasis Security, disclosed Feb 25)	Any website could hijack a locally running instance: localhost WebSocket brute force plus auto-approved local pairing	2026.2.25 (released Feb 26, within 24 hours)	Oasis Security
ClawHavoc (Koi Security)	Malicious ClawHub skills posing as crypto, productivity, and coding tools. Koi’s audit of all 2,857 skills found 341 malicious, 335 from one campaign (Feb 1); its Feb 16 update counted 824 of 10,700+	Registry response (ecosystem, not a core patch)	Koi Security
Claw Chain (Cyera)	CVE-2026-44112 / 44113: TOCTOU write/read escapes from the OpenShell sandbox. CVE-2026-44115: exec-allowlist bypass via shell expansion in unquoted heredocs (Cyera showed it leaking credentials and environment variables). CVE-2026-44118: owner context on loopback MCP taken from spoofable request metadata	2026.4.22	NVD: 44112 · 44113 · 44115 · 44118 · Cyera
CVE-2026-62197 / GHSA-3x84-qq85-fj65	Browser CDP discovery accepted blocked WebSocket URLs, so lower-trust callers could reach network destinations policy should block (an SSRF-class bypass)	2026.6.6; advisory published Oct 21, 2026	GitHub advisory · NVD

Two lessons hide in that table:

• Loopback binding did not save you on CVE-2026-25253. The victim’s own browser made the connection, so “it’s only on localhost” was not a boundary. That’s our reading of the advisory, and it applies to every local-only deployment.
• An advisory’s publish date is not your exposure window. CVE-2026-62197 was fixed in 2026.6.6 but disclosed in October. If you were current, you were covered months before the advisory existed; if you were pinned, you were exposed without knowing it.

Hardening keeps landing too: 2026.10.5 (Oct 18) stops ordinary hooks from rewriting tool arguments that were already approved inline without asking for approval again (changelog, #142700).

The ecosystem is part of your attack surface

Third-party plugins and tools built around OpenClaw carry their own CVEs. Three from this month:

• pinclaw channel plugin, CVE-2026-108757 (through 0.3.0). POST /pinclaw/send skipped its auth-token check, and its listener on port 18790 binds all interfaces by default, so anyone on the network could inject prompts into the main agent session. NVD lists no fixed version as of Oct 23.
• LobsterAI, CVE-2026-108156 (2026.5.27 through 2026.9.23). The skill-uninstall handler trusted a path in the skill’s own _meta.json, so removing a crafted skill could delete arbitrary user-writable directories.
• ClawScan, CVE-2026-110689 (through 0.1.6, fixed in 0.1.7). A protection-mechanism bypass in a static skill scanner (local attack, CVSS 3.1 5.3).

The point isn’t these three products; it’s that scanners and plugins are controls with bugs of their own. Inventory them like dependencies.

The pattern: trust boundaries drawn in the wrong place

Three failure modes show up again and again:

1. Client-controlled control fields. Approval flags and owner context were treated as facts instead of claims. If the client can write the bit that skips the guardrail, the guardrail is theater.
2. Check-then-use gaps. TOCTOU on paths (Claw Chain) and “validated command ≠ executed shell expansion” (the heredoc allowlist bypass) mean the thing you approved is not the thing that ran.
3. Supply chain as a capability grant. Installing a ClawHub skill or a channel plugin is code execution on a machine that already holds credentials. Treat the registry like npm in 2018: pin, read source, and skip “trading bot” skills entirely.

Map those to the OWASP Top 10 for Agentic Applications 2026 and you land on ASI02 (Tool Misuse & Exploitation), ASI03 (Identity & Privilege Abuse), ASI04 (Agentic Supply Chain), and ASI05 (Unexpected Code Execution). Part 2 of this series walks Hermes vs OpenClaw against that list end to end.

Hardening baseline you can apply tonight

Checked against the OpenClaw releases and npm registry on Oct 23, 2026. Re-check on the day you read this; OpenClaw ships several releases a week.

• OpenClaw doesn’t publish an official “minimum safe version”; run the latest stable release. As of Oct 30 that is 2026.10.9 (Oct 29), a security release that follows 2026.10.8 (Oct 27) and 2026.10.7 (Oct 24).
• Node first. 2026.10.6 requires Node 24.22.1+ or 26.12.1+ (npm engines). Those versions reject TLS chains signed with the eMudhra intermediate CA keys addressed in Node.js’s Oct 21, 2026 security releases, and openclaw update refuses to run on older Node.
• Core and plugins. Updating core alone isn’t enough; many fixes ship in @openclaw/* channel plugins.

node --version          # needs 24.22.1+ or 26.12.1+
openclaw update
openclaw plugins update --all
openclaw --version

• Network. Bind the gateway to loopback (gateway.bind="loopback"). Reach it with SSH or Tailscale. Do not port-forward the gateway to the public internet. Then audit plugins for their own listeners on 0.0.0.0 (see pinclaw). If anything was ever exposed, rotate the gateway token.
• Execution. Deny system.run where you don’t need it (gateway.nodes.denyCommands). Keep default-denied HTTP tools denied. Require per-invocation approvals for shell and proxy commands.
• Credentials. Give the agent box its own scoped keys. Rotate gateway and device tokens after any suspected exposure. Prefer SecretRefs over plaintext in openclaw.json / .env where the product supports it.
• Skills and plugins. Pin versions, read the source before installing, and refuse “trading bot” / crypto automation skills. ClawHub’s install-time scanning helps, but scanners have bugs too (see ClawScan). They don’t replace reading what you install.

Checklist

• Node at 24.22.1+ or 26.12.1+
• Core at the latest stable release; plugins updated
• gateway.bind is loopback (or equivalent)
• No public port publish for the gateway
• No plugin listeners on 0.0.0.0 you didn’t intend
• system.run denied unless you truly need it
• Default-denied HTTP tools still denied
• Agent credentials are scoped and rotatable
• Every installed skill and plugin has a pinned version and a human review note

How to tell if you were already hit

Watch for unexpected sessions, new cron entries, config drift, unfamiliar skills or plugins, and outbound traffic from the agent host that you didn’t authorize. If anything looks wrong: isolate the host, rotate every credential the agent could reach, and rebuild from known-good config. Don’t “clean in place” after a skill or gateway compromise.

The takeaway for any self-hosted agent

Judge agents on their defaults and their disclosure practice. OpenClaw’s advisory volume is uncomfortable, but detailed, fast patches count in its favor: Oasis reports ClawJacked was fixed within 24 hours. The recurring issue is architecture plus a hostile ecosystem: control fields that should be server-authoritative, sandboxes that race, and a marketplace and plugin layer that grant shell.

Next in the series, Part 2: a Hermes vs OpenClaw threat model against the OWASP Agentic Top 10.

Sources

• NVD: CVE-2026-25253 · OSV: GHSA-g8p2-7wf7-98mq
• OpenClaw GHSA-gv46-4xfq-jv58 (CVE-2026-28466)
• OpenClaw GHSA-943q-mwmv-hhvh
• OpenClaw GHSA-3x84-qq85-fj65 (CVE-2026-62197)
• Oasis Security: ClawJacked
• Koi Security: ClawHavoc
• Cyera: Claw Chain and NVD records for CVE-2026-44112, 44113, 44115, 44118
• NVD: CVE-2026-108757 (pinclaw) · CVE-2026-108156 (LobsterAI) · CVE-2026-110689 (ClawScan)
• OpenClaw 2026.10.9 release · OpenClaw 2026.10.8 release · OpenClaw 2026.10.7 release · OpenClaw 2026.10.6 release · 2026.10.5 changelog · npm metadata (engines)
• Node.js October 2026 security releases
• OWASP Top 10 for Agentic Applications 2026