CVE-2026-100580: OpenClaw before 2026.7.1 Remote Code Execution via cron tool
OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a persistent cron job that executes attacker-selected commands with the privileges of the OpenClaw process user, resulting in access to host files and credentials and impact to scheduled service availability. The issue is limited to cron jobs created or edited through the model-facing cron tool; direct CLI and authorized Gateway scheduling surfaces are trusted operator controls. Fixed in 2026.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.7.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to steer a tool-enabled OpenClaw agent. They can use a mixed-case payload kind through the model-facing cron tool to bypass the shell-execution guard and create or modify a command job.
Are direct CLI or Gateway scheduling workflows affected?
No. The issue is limited to cron jobs created or edited through the model-facing cron tool; direct CLI and authorized Gateway scheduling surfaces are described as trusted operator controls.
What is the impact of successful exploitation?
A successful attacker can establish a persistent cron job that runs attacker-selected commands as the OpenClaw process user. This can expose host files and credentials and disrupt scheduled service availability.
What should teams do if they cannot update immediately?
Limit untrusted parties' ability to steer tool-enabled agents, particularly where those agents can access the model-facing cron tool. Review cron jobs created or edited through that tool for unexpected command jobs.
Which version contains the fix?
The issue is fixed in OpenClaw version 2026.7.1. Versions before 2026.7.1 are affected.