CVE-2026-26320 OpenClaw macOS deep link confirmation truncation can conceal executed agent message
Attackers can hide malicious payloads in truncated deep link previews, tricking users into approving agent actions that lead to arbitrary command execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-26320?
CVE-2026-26320 is a high-severity vulnerability in Openclaw Openclaw, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unattended `key`, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full message after the user clicked "Run." At the time of writing, the OpenClaw macOS desktop client is still in beta. In versions 2026.2.6 through 2026.2.13, an attacker could pad the message with whitespace to push a malicious payload outside the visible preview, increasing the chance a user approves a different message than the one that is actually executed. If a user runs the deep link, the agent may perform actions that can lead to arbitrary command execution depending on the user's configured tool approvals/allowlists. This is a social-engineering mediated vulnerability: the confirmation prompt could be made to misrepresent the executed message. The issue is fixed in 2026.2.14. Other mitigations include not approve unexpected "Run OpenClaw agent?" prompts triggered while browsing untrusted sites and usingunattended deep links only with a valid `key` for trusted personal automations.
Weakness: CWE-451
Which versions are affected by CVE-2026-26320?
2 open source packages ship an affected version, including openclaw. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openclaw npm | From 2026.2.6-0 | 2026.2.14 |
openclaw npm | From 2026.2.6-0 | 2026.2.14 |
Products include Openclaw Openclaw.
How do I fix CVE-2026-26320?
Upgrade openclaw to 2026.2.14 or later.
Is CVE-2026-26320 being exploited?
There is no known exploitation of CVE-2026-26320 in the wild and no public exploit code.
Other vulnerabilities in Openclaw Openclaw
- CVE-2026-28363 Security feature bypass in OpenClaw
- CVE-2026-30741 Code injection in n/a
- CVE-2026-33579 OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval
- CVE-2026-32922 OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate
- CVE-2026-32978 OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners
Sources
Also known as GHSA-7q2j-c4q5-rm27.