CVE-2026-53865: OpenClaw < 2026.5.2 - Arbitrary Command Execution via Workspace-Derived Service PATH

Synopsis

This is a path traversal vulnerability in OpenClaw, a workspace management tool, affecting all versions before 2026.5.2. An attacker with a low-privilege local account can manipulate workspace-derived environment paths to influence which executable gets run during maintenance operations, causing OpenClaw to execute unintended binaries from attacker-controlled paths. Successful exploitation gives the attacker arbitrary command execution on the host, with high impact to confidentiality and integrity of the affected system. A patched-image rebuild at version 2026.5.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to carry out the attack; no administrative credentials are needed.

• Victim interactionNot required

  No action from another user or operator is required to trigger the vulnerable code path.

• Attack complexityDetail

  The exploit requires a specific prerequisite condition to be met (AT:P), meaning certain environmental or timing factors must align, though no race condition or memory-layout dependency is involved once that condition is satisfied.

Blast Radius

• The attacker executes arbitrary binaries on the host by substituting a malicious executable into the path OpenClaw resolves during maintenance operations.
• Confidentiality of data accessible to the OpenClaw process is fully compromised, including workspace files, configuration, and any secrets in the process environment.
• Integrity of host files and workspace data is fully compromised, allowing the attacker to modify, overwrite, or delete persisted data.
• Service availability is not directly impacted according to the CVSS scoring for this vulnerability.