Junglewise Threat Intelligence

CVE-2026-27487: OpenClaw shell injection in macOS keychain credential write

CVE-2026-27487 · Severity: low · CVSS 3.1 · Published 2026-02-18

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a command-line interface tool used to manage credentials and authentication on macOS systems. A shell injection vulnerability in the keychain credential refresh process could allow an attacker with control over OAuth tokens to execute arbitrary commands on the user's machine with the privileges of the running process. This could lead to credential theft, unauthorized access to systems, or installation of malware.

Technical details

OpenClaw vulnerable to OS command injection (CWE-78) in the writeClaudeCliKeychainCredentials function on macOS. The vulnerable code constructed a shell command using execSync() with string interpolation, passing OAuth token values directly into a security add-generic-password command even after single-quote escaping. This escaping was insufficient because shell metacharacters like $() and backticks are processed before quote evaluation, allowing attackers controlling OAuth provider responses to break out and execute arbitrary commands. The fix uses execFileSync("security", argv) with the updated keychain payload passed as a literal array element, preventing shell interpretation entirely. Attack vector is network-based (malicious OAuth provider), requires low privileges and user interaction (OAuth login flow), affects confidentiality, integrity, and some availability. Patched in version 2026.2.14.

Affected products

  • OpenClaw openclaw <= 2026.2.13

Timeline

  • 2026-02-18: disclosed
  • 2026-02-14: patched: Fix merged to main; patched version 2026.2.14

References