High severity · published Feb 2, 2026
CVE-2026-24763
Authenticated Command Injection in OpenClaw Docker Execution via PATH Environment Variable
8.8
CVSS
5.3%
EPSS
No
On KEV
Description
OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An authenticated user able to control environment variables could influence command execution within the container context. This vulnerability is fixed in 2026.1.29.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.3% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
clawdbot · clawdbot
< 2026.1.29 · source: vendor
OP
Openclaw · Openclaw
before 2026.1.29 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24763
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24763
Patch
https://github.com/openclaw/openclaw/commit/771f23d36b95ec2204cc9a0054045f5d8439ea75
Product
https://github.com/openclaw/openclaw/releases/tag/v2026.1.29
Vendor Advisory
https://github.com/openclaw/openclaw/security/advisories/GHSA-mc68-q9jw-2h3v
More from clawdbot
3.7
CVE-2026-24764
OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions