CVE-2026-30741 Code injection in n/a
Attackers can execute arbitrary code on the OpenClaw Agent Platform via prompt injection, requiring immediate attention from platform operators.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-30741?
CVE-2026-30741 is a critical code injection vulnerability in Openclaw Openclaw, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Side prompt injection attack.
Weakness: CWE-94
Which versions are affected by CVE-2026-30741?
It affects 1 product.
Products include Openclaw Openclaw.
How do I fix CVE-2026-30741?
No fix has been published for CVE-2026-30741 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-30741 being exploited?
There is no known exploitation of CVE-2026-30741 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Openclaw Openclaw
- CVE-2026-28363 Security feature bypass in OpenClaw
- CVE-2026-33579 OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval
- CVE-2026-32922 OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate
- CVE-2026-32978 OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners
- CVE-2026-22172 OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections
Sources
Also known as GHSA-rvp5-mqmc-q4g6.