OpenClaw has disclosed a high-severity vulnerability that could allow an actor who can steer a tool-enabled AI agent to bypass a shell-execution guard through the model-facing cron tool and create a persistent scheduled job that runs attacker-selected commands.
The flaw, tracked as CVE-2026-100580 in the CVE record and the National Vulnerability Database, affects OpenClaw versions before 2026.7.1. OpenClaw published its security advisory for the issue on September 11, 2026.
OpenClaw, an open-source AI assistant that runs on users’ own computers, can interact with services and tools, read and write files, and run shell commands. Its cron capability creates scheduled work that can continue after the original chat or task has ended.
The vulnerability was caused by inconsistent handling of the case of a cron payload’s kind value.
According to OpenClaw’s security advisory, a mixed-case payload could pass the agent-facing shell-execution guard and later be normalized into a command job.
This meant the security check and the later processing of the same payload did not interpret its type in the same way.
An actor able to steer a tool-enabled agent could use the affected model-facing cron tool to create a persistent cron job that executed attacker-selected commands with the privileges of the OpenClaw process user, according to the advisory.
OpenClaw said the practical impact could include access to host files and credentials, as well as disruption of scheduled service availability.
The issue is specifically scoped to cron jobs created or edited through the model-facing cron tool.
OpenClaw said direct command-line scheduling and authorized Gateway scheduling surfaces remain trusted operator controls.
The vulnerability carries a CVSS 3.1 score of 8.8, rated High by OpenClaw. Its published vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
The advisory classifies the flaw under CWE-178, Improper Handling of Case Sensitivity, and CWE-863, Incorrect Authorization.
The first stable release containing the fix is OpenClaw 2026.7.1.
OpenClaw’s July 2026 release notes also introduced additional controls around cron access. Agents using OpenClaw’s cron tools were limited to their own scheduled jobs and session targets, while operator-managed cron remained unchanged.
The same release made cron wake actions started by an agent stay within that agent’s own session lanes and added fail-closed behavior for mixed-version setups.
OpenClaw’s current documentation describes cron as a control-plane-sensitive capability because its scheduled jobs continue running after the original chat or task ends.
The project’s automation documentation states that jobs, runtime state and run history persist in OpenClaw’s shared SQLite state database, so restarting the Gateway does not remove schedules.
That persistence is central to the vulnerability’s impact. A malicious command placed into a scheduled job can remain active beyond the original interaction instead of depending on the attacker maintaining the same session.
OpenClaw’s current CLI documentation also states that command-payload automation jobs execute directly in the Gateway process rather than as an agent tools.exec call.
For affected installations, OpenClaw recommends upgrading to 2026.7.1 or later.
The advisory also recommends removing the cron tool from agents exposed to lower-trust content before upgrading and inspecting existing scheduled jobs for command payloads.
The vulnerability is now addressed in releases far newer than the fixed version. OpenClaw’s release page currently lists 2026.9.6 as the latest release, published September 23, 2026. The project also lists 2026.7.35 as an extended-stable release.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
