OpenClaw AI agent Remote Code Execution Vulnerability

The OpenClaw AI agent is critically vulnerable to remote code execution and extensive data exfiltration due to an authentication bypass where misconfigured reverse proxies improperly trust external requests as local. Additionally, the agent is susceptible to prompt injection attacks, enabling the extraction of private keys and sensitive user data from the underlying system.

What Happened

The OpenClaw AI agent is critically vulnerable to remote code execution and extensive data exfiltration due to an authentication bypass where misconfigured reverse proxies improperly trust external requests as local. Additionally, the agent is susceptible to prompt injection attacks, enabling the extraction of private keys and sensitive user data from the underlying system.

Why This Matters

Publisher reporting describes a security event affecting New OpenClaw AI. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether New OpenClaw AI is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.

Exposure

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

Timeline

• Incident first seen
  Feb 10, 2026 05:30

  BugSkan first recorded this incident.

• New OpenClaw AI agent found unsafe for use - Kaspersky
  Feb 10, 2026 05:30

  kaspersky.com · Vulnerability

Sources

Related Incidents

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match