Path Traversal in OpenClaw Git Extension

Executive Summary

CVE-2026-62200 is a vulnerability in OpenClaw versions before 2026.6.6. It involves a flaw in the host exec environment filtering mechanism, specifically related to Git ext transport. This flaw allows lower-trust callers or configured input paths to execute or persist actions beyond their intended authorization when the affected feature is enabled and reachable.

The vulnerability arises due to incomplete filtering of host exec environment inputs. This means that the system does not properly restrict or sanitize inputs, enabling attackers to bypass authentication and perform unauthorized actions. The issue is classified under CWE-184 (Incomplete List of Disallowed Inputs) and CWE-78 (OS Command Injection).

• Affected versions: OpenClaw versions prior to 2026.6.6.
• Severity: High, with a CVSS v4.0 base score of 8.7 and a CVSS v3.1 base score of 8.8.
• Attack vector: Network-based, with low attack complexity and low privileges required.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking if the affected feature (Git ext transport with host exec environment filtering) is enabled and accessible in OpenClaw versions before 2026.6.6. Since the vulnerability allows lower-trust callers or configured input paths to execute actions beyond their intended authorization, you should verify the configuration and version of OpenClaw.

• Check the installed version of OpenClaw. If it is prior to 2026.6.6, the system may be vulnerable. You can typically check the version by running a command like 'openclaw --version' or by inspecting the package manager (e.g., 'apt list --installed | grep openclaw' or 'yum list installed | grep openclaw').
• Inspect the OpenClaw configuration files to determine if the affected feature (Git ext transport with host exec environment filtering) is enabled. Look for settings related to 'host exec environment filtering' or 'Git ext transport' in configuration files, which may be located in directories like /etc/openclaw/ or /opt/openclaw/config/.
• Monitor network traffic for unusual Git ext transport activity, particularly if the feature is exposed to untrusted networks. Tools like Wireshark or tcpdump can be used to capture and analyze traffic on relevant ports (e.g., 'tcpdump -i eth0 port 9418' for Git traffic).
• Review logs for unexpected or unauthorized execution of commands or actions. Check OpenClaw logs, system logs (e.g., /var/log/syslog or /var/log/messages), and Git-related logs for signs of abuse.

If the feature is enabled and the system is running a vulnerable version, assume the vulnerability may be exploitable. Immediate steps should be taken to mitigate the risk.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts if exploited. An attacker with lower privileges or access to configured input paths could execute unauthorized actions or persist malicious activities beyond their intended authorization scope.

• Confidentiality impact: High. Attackers could access sensitive data or systems they are not authorized to view.
• Integrity impact: High. Attackers could modify or delete data, leading to data corruption or unauthorized changes.
• Availability impact: High. Attackers could disrupt services or systems, causing downtime or denial of service.

The vulnerability does not alter OpenClaw's trusted-operator model, but it could allow lower-trust input to reach and exploit the affected feature if it is enabled and accessible. This could lead to unintended execution or persistence of actions, depending on the operator's configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with several common standards and regulations, depending on the context in which OpenClaw is used.

• GDPR (General Data Protection Regulation): If the vulnerability leads to unauthorized access or disclosure of personal data, it could result in a breach of GDPR requirements. Organizations must ensure the confidentiality, integrity, and availability of personal data, and this vulnerability could compromise those principles.
• HIPAA (Health Insurance Portability and Accountability Act): If OpenClaw is used in a healthcare environment and the vulnerability exposes protected health information (PHI), it could lead to non-compliance with HIPAA. HIPAA requires safeguards to protect the confidentiality and integrity of PHI, and this vulnerability could undermine those safeguards.
• Other standards: The vulnerability could also affect compliance with standards like ISO 27001, which requires organizations to manage information security risks, or NIST guidelines, which emphasize protecting systems from unauthorized access and ensuring data integrity.

Organizations using OpenClaw should assess the potential impact of this vulnerability on their compliance posture and take appropriate measures, such as applying patches or implementing mitigations, to reduce risk.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade OpenClaw to the latest patched version (2026.6.6 or later). This is the most effective way to resolve the vulnerability. Use your package manager to update (e.g., 'apt upgrade openclaw' or 'yum update openclaw').
• If upgrading is not immediately possible, restrict the affected feature (Git ext transport with host exec environment filtering) to trusted operators only. Modify the configuration to ensure that only authorized users or systems can access this feature.
• Disable the affected feature entirely if it is not required for your operations. This can be done by modifying the OpenClaw configuration files to turn off host exec environment filtering or Git ext transport.
• Apply general hardening measures, such as keeping channel and tool allowlists narrow. Avoid shared Gateways between untrusted users to reduce the risk of unauthorized access.
• Review and tighten access controls to ensure that lower-trust callers or input paths cannot reach the vulnerable feature. Implement network-level restrictions (e.g., firewalls) to limit access to the OpenClaw service.
• Monitor the system for signs of exploitation, such as unexpected command execution or unauthorized changes. Set up alerts for suspicious activity in logs.

Useful 0 Not Useful 0