CVE-2026-27487

OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data, this created an OS command injection risk. This issue has been fixed in version 2026.2.14.

• CWE-78

• https://github.com/openclaw/openclaw/commit/66d7178f2d6f9d60abad35797f97f3e61389b70cPatch
• https://github.com/openclaw/openclaw/commit/9dce3d8bf83f13c067bc3c32291643d2f1f10a06Patch
• https://github.com/openclaw/openclaw/commit/b908388245764fb3586859f44d1dff5372b19cafPatch
• https://github.com/openclaw/openclaw/pull/15924Issue Tracking
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14Release Notes
• https://github.com/openclaw/openclaw/security/advisories/GHSA-4564-pvr2-qq4hPatch, Vendor Advisory

Published

Feb 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27481Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-27482Ray is an AI compute engine. In versions 2.53.0 and below, t…6.5
• CVE-2026-27483MindsDB is a platform for building artificial intelligence f…8.8
• CVE-2026-27484OpenClaw is a personal AI assistant. In versions 2026.2.17 a…4.3
• CVE-2026-27485OpenClaw is a personal AI assistant. In versions 2026.2.17 a…4.4
• CVE-2026-27486OpenClaw is a personal AI assistant. In versions 2026.2.13 a…5.3
• CVE-2026-27488OpenClaw is a personal AI assistant. In versions 2026.2.17 a…7.3
• CVE-2026-27489Open Neural Network Exchange (ONNX) is an open standard for …7.5
• CVE-2026-2749Vulnerability in Centreon Centreon Open Tickets on Central S…8.8
• CVE-2026-27491Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-27492Lettermint Node.js SDK is the official Node.js SDK for Lette…4.7
• CVE-2026-27493n8n is an open source workflow automation platform. Prior to…9