CVE-2026-27486
Last modified
CVE-2026-27486 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern matching to terminate processes without verifying if they are owned by the current OpenClaw process. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern matching to terminate processes without verifying if they are owned by the current OpenClaw process. On shared hosts, unrelated processes can be terminated if they match the pattern. The CLI runner cleanup helpers can kill processes matched by command-line patterns without validating process ownership. This issue has been fixed in version 2026.2.14.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.2.14 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-jfv4-h8mc-jcp8Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-27486?
How severe is CVE-2026-27486?
How do I fix CVE-2026-27486?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27480Static Web Server (SWS) is a production-ready web server sui…5.3
- CVE-2026-27481Discourse is an open-source discussion platform. From versio…5.3
- CVE-2026-27482Ray is an AI compute engine. In versions 2.53.0 and below, t…6.5
- CVE-2026-27483MindsDB is a platform for building artificial intelligence f…8.8
- CVE-2026-27484OpenClaw is a personal AI assistant. In versions 2026.2.17 a…4.3
- CVE-2026-27485OpenClaw is a personal AI assistant. In versions 2026.2.17 a…4.4
- CVE-2026-27487OpenClaw is a personal AI assistant. In versions 2026.2.13 a…8
- CVE-2026-27488OpenClaw is a personal AI assistant. In versions 2026.2.17 a…7.3
- CVE-2026-27489Open Neural Network Exchange (ONNX) is an open standard for …7.5
- CVE-2026-2749Vulnerability in Centreon Centreon Open Tickets on Central S…8.8
- CVE-2026-27491Discourse is an open-source discussion platform. Prior to ve…4.3
- CVE-2026-27492Lettermint Node.js SDK is the official Node.js SDK for Lette…4.7
Are you affected by CVE-2026-27486?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST