CVE-2026-27524: OpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Path

Q: What is the severity of CVE-2026-27524?

CVE-2026-27524 is classified as a high severity vulnerability due to its potential for prototype pollution attacks.

Q: How do I fix CVE-2026-27524?

To mitigate CVE-2026-27524, upgrade OpenClaw to version 2026.2.21 or later.

Q: What type of attack is CVE-2026-27524 associated with?

CVE-2026-27524 is associated with prototype pollution attacks allowing injection of sensitive keys.

Q: Which versions of OpenClaw are affected by CVE-2026-27524?

OpenClaw versions prior to 2026.2.21 are affected by CVE-2026-27524.

Q: What components are vulnerable in CVE-2026-27524?

CVE-2026-27524 affects the runtime /debug set override path of OpenClaw.

Published Mar 18, 2026

Updated

OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authorized /debug set callers can inject proto, constructor, or prototype keys to manipulate object prototypes and bypass command gate restrictions.

Affected Software

2 affected components

OpenClaw<2026.2.21

OpenClaw Openclaw Node.js<2026.2.21

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenClaw to a version that resolves this vulnerability.
Fixed in 2026.2.21

Event History

Mar 18, 2026

CVE Published

via MITRE·01:34 AM

Data Sourced

via MITRE·01:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

Mar 25, 58182

Event

via NVD·08:29 AM

Frequently Asked Questions

What is the severity of CVE-2026-27524?

CVE-2026-27524 is classified as a high severity vulnerability due to its potential for prototype pollution attacks.

How do I fix CVE-2026-27524?