OpenClaw AI Assistant Compromised via WhatsApp: Three Critical Vulnerabilities Allowed Credential Theft, Sandbox Escape, and Arbitrary Code Execution on Host
Security researchers have disclosed three serious vulnerabilities in OpenClaw that could allow attackers to steal credentials, escalate privileges, and execute arbitrary code on systems running the AI assistant. The flaws affected both home users and corporate deployments, highlighting risks associated with insufficient input validation and sandbox isolation in AI tooling.
Command Filtering Failures (CVSS 8.8)
Two of the vulnerabilities received a CVSS score of 8.8. They were caused by incomplete command filtering mechanisms that did not block all malicious inputs. As a result, an attacker could inject system commands into contexts where they should have been prohibited, enabling unauthorized actions ranging from data exfiltration to privilege escalation.
Sandbox Bypass via Directory Mounting (CVSS 8.4)
The third vulnerability, rated 8.4, allowed attackers to circumvent sandbox restrictions by mounting parent directories. Although OpenClaw blocked direct access to sensitive folders such as ~/.ssh, ~/.aws, and ~/.gnupg, it could still permit mounting of the entire /home directory. This effectively placed SSH keys, cloud tokens, and GPG secrets directly accessible to the attacker.
Further escalation was possible through the /var directory, which could grant access to the Docker socket and enable escape from the sandbox directly onto the host system. Researcher Chinmohan Nayak demonstrated that the attack could be initiated remotely via an external message sent through WhatsApp (owned by Meta, designated as extremist and banned in Russia) without requiring any prior foothold on the target machine.
Impact and Recommendations
In the worst-case scenario, an attacker could exfiltrate sensitive data, establish persistence, and execute arbitrary code on the victim’s machine. Developers addressed all three issues in OpenClaw 2026.6.6. Users are strongly advised to:
- Update to the latest version immediately
- Enable sandboxing for all secondary sessions
- Remove exec from the list of allowed tools
- Narrow the list of trusted communication channels to the minimum necessary
These measures significantly reduce the attack surface and help prevent similar exploitation attempts in the future.
Related articles
Dangerous C++ Traps: Memory Safety Issues, Undefined Behavior, and Code That Betrays Developers
Around 70% of vulnerabilities assigned CVE numbers by Microsoft each year stem from memory safety errors, with Chromium reporting a similar pattern for serious Chrome bugs. The article examines how C++ deliberately permits low-level memory access for performance but demands strict discipline to avoid undefined behavior (UB). It details real-world cases including Heartbleed (CVE-2014-0160) in OpenSSL, use-after-free errors, buffer overflows, and data races. Modern tools such as AddressSanitizer, UndefinedBehaviorSanitizer, and ThreadSanitizer are presented as essential for detection, alongside recommendations for RAII, std::span, and smart pointers. The piece also discusses C++26 changes introducing erroneous behavior for uninitialized variables and advises when to consider memory-safe languages like Rust for new components. Practical migration steps and compiler warning strategies are outlined to reduce risk in existing codebases.
Critical CosmosEscape Flaw Breaks Customer Isolation in Azure Cosmos DB
A critical vulnerability named CosmosEscape allowed attackers to escape the restricted Gremlin API environment and execute arbitrary code on the DB Gateway component of Azure Cosmos DB. The flaw exploited weaknesses in .NET reflection protections, enabling file read/write operations and command execution that ultimately yielded the Cosmos Master Key. With this global signing key, an attacker could retrieve the primary key for any customer account and gain full read/write access. The exploit also exposed the Config Store containing account names, subscription identifiers, tenant details, and network rules. Even network-isolated and private instances remained vulnerable because the DB Gateway itself enforced those restrictions. Internal Microsoft services including Entra ID, Teams, and Copilot rely on Cosmos DB, amplifying the potential impact of the issue.
Critical RCE Vulnerability CVE-2026-66066 Affects Ruby on Rails Active Storage with libvips
A severe vulnerability tracked as CVE-2026-66066 has been identified in the Ruby on Rails web application framework. The flaw, also referred to as KindaRails2Shell by researchers, impacts applications that use Active Storage with the libvips image processing engine. Attackers can exploit the issue by uploading specially crafted files to read arbitrary files without authentication. This exposure may lead to theft of environment variables, secret keys, and external service credentials, enabling remote code execution or further attacks. The vulnerability stems from unsafe operations in the dependent libvips library. It carries a CVSS v4.0 base score of 9.5 and is rated Critical. JPCERT/CC has issued an advisory urging immediate updates.
Critical Vulnerabilities Disclosed in Adobe Campaign Classic Require Immediate Patching
Adobe has released a security advisory detailing two high-risk vulnerabilities affecting Adobe Campaign Classic on-premises deployments on Windows and Linux. CVE-2026-48449 is an improper authorization flaw that permits remote attackers to execute arbitrary code without authentication and carries a maximum CVSSv3.1 base score of 10.0. CVE-2026-48448 is a SQL injection vulnerability that allows unauthenticated attackers to read arbitrary files from the file system, rated at 8.6. Both issues affect the campaign management platform used by organizations for marketing automation. Adobe urges administrators to apply the available security updates without delay due to the elevated risk of exploitation.