Executive brief
OpenClaw is an AI automation platform that supports remote message attachment fetching via SCP. The vulnerable code accepted SSH host keys on first connection without verification and did not validate remote host configuration values, allowing an attacker on the network to perform man-in-the-middle attacks or DNS poisoning to inject false host keys and potentially modify SCP command arguments. In remote iMessage deployments, this could lead to file theft or command execution.
Technical details
This vulnerability encompasses improper SSH host-key validation and OS command injection in OpenClaw's remote iMessage attachment fetching mechanism. The root causes are: (1) SCP was invoked with StrictHostKeyChecking=accept-new, which trusts any host key on first connection (TOFU behavior vulnerable to MITM/DNS poisoning); (2) the channels.imessage.remoteHost configuration parameter was not validated as a strict SSH host token, allowing unsafe values; (3) the SCP command construction did not properly escape or isolate the remote host argument. An unauthenticated attacker on the network (adjacent or network-adjacent to the target) can exploit this by poisoning DNS or performing MITM attacks on the first connection, causing the application to trust a malicious SSH host key, or by crafting unsafe host tokens in config that alter SCP argument semantics (CWE-78, CWE-295). The fix hardens the implementation by requiring StrictHostKeyChecking=yes, adding strict host token normalization/validation, inserting an argument barrier (--) in SCP commands, and validating the remoteHost value at config load time.
Affected products
- OpenClaw openclaw ≤ 2026.2.17
Timeline
- 2026-03-03: disclosed
- 2026-02-19: patched: Fix commit 49d0def6d1e88f002026b1d2a35aa615d48a751a