{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-44112",
    "name": "CVE-2026-44112",
    "vendor": "OpenClaw",
    "description": "Four chained vulnerabilities (CVE-2026-44112, 44113, 44115, 44118) in OpenClaw allow an attacker with minimal foothold to escalate privileges, expose sensitive operator data, and plant backdoors that survive restarts, collectively dubbed Claw Chain. With OpenClaw's install base concentrated in CI/CD runners that often hold long-lived cloud credentials, a single compromised instance can pivot into production. Patched in OpenClaw 2026.4.22.",
    "website": "https://thehackernews.com/2026/05/four-openclaw-flaws-enable-data-theft.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-05-04",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-44112",
      "aliases": [
        "ti-018"
      ],
      "title": "OpenClaw \"Claw Chain\": Four CVEs Enable Data Theft, Privilege Escalation, and Persistence",
      "summary": "Four chained vulnerabilities (CVE-2026-44112, 44113, 44115, 44118) in OpenClaw allow an attacker with minimal foothold to escalate privileges, expose sensitive operator data, and plant backdoors that survive restarts, collectively dubbed Claw Chain. With OpenClaw's install base concentrated in CI/CD runners that often hold long-lived cloud credentials, a single compromised instance can pivot into production. Patched in OpenClaw 2026.4.22.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Privilege escalation"
      ],
      "componentType": "agent",
      "component": {
        "name": "OpenClaw",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "OpenClaw < 2026.4.22",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-05-04",
      "modifiedAt": "2026-05-04",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/05/four-openclaw-flaws-enable-data-theft.html"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44112"
        }
      ],
      "mitigation": "Upgrade to OpenClaw 2026.4.22+. Audit OpenClaw runner logs for unexpected operator role changes since April. Rotate any cloud credentials accessible from OpenClaw instances. Restrict OpenClaw network egress.",
      "detectedByAnomity": true
    }
  }
}