CVE-2026-26320
Received Received - Intake
Command Injection via Incomplete URL Scheme Confirmation in OpenClaw

Publication date: 2026-02-19

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description
OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unattended `key`, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full message after the user clicked "Run." At the time of writing, the OpenClaw macOS desktop client is still in beta. In versions 2026.2.6 through 2026.2.13, an attacker could pad the message with whitespace to push a malicious payload outside the visible preview, increasing the chance a user approves a different message than the one that is actually executed. If a user runs the deep link, the agent may perform actions that can lead to arbitrary command execution depending on the user's configured tool approvals/allowlists. This is a social-engineering mediated vulnerability: the confirmation prompt could be made to misrepresent the executed message. The issue is fixed in 2026.2.14. Other mitigations include not approve unexpected "Run OpenClaw agent?" prompts triggered while browsing untrusted sites and usingunattended deep links only with a valid `key` for trusted personal automations.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-19
Last Modified
2026-02-20
Generated
2026-06-16
AI Q&A
2026-02-20
EPSS Evaluated
2026-06-14
NVD
CVE-2026-26320
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw From 2026.2.6 (inc) to 2026.2.14 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-451 The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects the OpenClaw macOS desktop client, which registers the openclaw:// URL scheme. When a user encounters an openclaw://agent deep link without an unattended key, the app shows a confirmation dialog displaying only the first 240 characters of the message. However, after the user clicks "Run," the full message is executed.

An attacker can exploit this by padding the message with whitespace to push a malicious payload beyond the visible preview, causing the user to approve a different message than the one actually executed. This can lead to arbitrary command execution depending on the user's configured tool approvals or allowlists.

This is a social-engineering mediated vulnerability because the confirmation prompt misrepresents the executed message. The issue is fixed in version 2026.2.14.

Impact Analysis

If exploited, this vulnerability can lead to arbitrary command execution on your macOS system through the OpenClaw agent. An attacker could trick you into approving a malicious command by hiding it beyond the visible preview in the confirmation dialog.

This could result in unauthorized actions being performed on your system, potentially compromising your data, privacy, or system integrity depending on what commands are executed and your tool approval settings.

Mitigations include not approving unexpected "Run OpenClaw agent?" prompts from untrusted sites and using unattended deep links only with a valid key for trusted automations.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, update the OpenClaw macOS desktop client to version 2026.2.14 or later, where the issue is fixed.

Additionally, do not approve unexpected "Run OpenClaw agent?" prompts triggered while browsing untrusted sites.

Use unattended deep links only with a valid `key` for trusted personal automations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26320. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart