CVE-2026-27487
📋 TL;DR
OpenClaw versions 2026.2.13 and below on macOS are vulnerable to OS command injection when refreshing OAuth tokens in the Keychain. This allows attackers to execute arbitrary commands with the user's privileges. Users of OpenClaw on macOS with affected versions are impacted.
💻 Affected Systems
- OpenClaw
📦 What is this software?
Openclaw by Openclaw
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary command execution, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation or unauthorized access to sensitive system resources and user data stored in Keychain.
If Mitigated
Limited impact if proper input validation and command sanitization are implemented, restricting execution to intended operations only.
🎯 Exploit Status
Exploitation requires user interaction to trigger OAuth token refresh; no public exploits are known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2026.2.14
Vendor Advisory: https://github.com/openclaw/openclaw/releases/tag/v2026.2.14
Restart Required: No
Instructions:
1. Update OpenClaw to version 2026.2.14 or later. 2. Verify the update by checking the version. 3. No restart is required, but restarting the application is recommended.
🔧 Temporary Workarounds
Disable OAuth Token Refresh
macOSPrevent the vulnerable credential refresh process from executing.
Not applicable - configuration change only
Use Alternative Authentication
macOSSwitch to API keys or other authentication methods that don't use OAuth token refresh in Keychain.
Not applicable - configuration change only
🧯 If You Can't Patch
- Restrict user permissions to limit potential damage from command execution.
- Monitor system logs for unusual security or keychain access patterns.
🔍 How to Verify
Check if Vulnerable:
Check OpenClaw version; if it's 2026.2.13 or below on macOS, it's vulnerable.Check Version:
openclaw --versionVerify Fix Applied:
Confirm OpenClaw version is 2026.2.14 or later and test OAuth token refresh functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual security command executions
- Failed Keychain access attempts
- Suspicious process spawns from OpenClaw
Network Indicators:
- Unexpected outbound connections from OpenClaw process
SIEM Query:
process_name:"security" AND parent_process:"openclaw" AND command_line:"add-generic-password"🔗 References
- https://github.com/openclaw/openclaw/commit/66d7178f2d6f9d60abad35797f97f3e61389b70c
- https://github.com/openclaw/openclaw/commit/9dce3d8bf83f13c067bc3c32291643d2f1f10a06
- https://github.com/openclaw/openclaw/commit/b908388245764fb3586859f44d1dff5372b19caf
- https://github.com/openclaw/openclaw/pull/15924
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.14
- https://github.com/openclaw/openclaw/security/advisories/GHSA-4564-pvr2-qq4h
