Executive brief
OpenClaw is an AI automation platform that executes tasks across various systems. The /debug endpoint allows authorized administrators to override runtime command flags, but it fails to block prototype-reserved keys (__proto__, constructor, prototype), allowing an authenticated attacker to pollute object prototypes and potentially bypass security gates that restrict dangerous commands like bash and debug execution.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in OpenClaw's runtime command override system. The /debug endpoint accepts user-supplied objects for setting runtime overrides but fails to sanitize or block prototype-reserved keys (__proto__, constructor, prototype) during deep merge operations. An authenticated attacker with /debug set authorization can inject these keys to pollute the object prototype chain, potentially enabling inherited property values that bypass security gates for restricted commands (bash, config, debug). The attack requires prior authorization to the /debug endpoint—no unauthenticated vector exists. The vulnerability affects only in-memory runtime state and is cleared on restart/reset. Patches are available in version 2026.2.21, which blocks reserved prototype keys during deep merge, sanitizes nested object values before storage, and requires own-property boolean checks (not inherited) for gated command flags.
Affected products
- OpenClaw openclaw <= 2026.2.19-2
Timeline
- 2026-03-03: disclosed: GHSA-62f6-mrcj-v8h5 published
- 2026-02-21: patched: Fix commit fbb79d4013000552d6a2c23b9613d8b3cb92f6b6
- 2026-03-18: other: CVE-2026-27524 published on NVD