Three high-severity flaws in OpenClaw can allow attackers to chain a simple WhatsApp message into host code execution under vulnerable configurations. Here’s how the attack works, who is affected, and how to secure your deployment.
Imagine glancing at your phone and seeing a harmless WhatsApp ping. One message. Nothing to download. No link to trick you. Yet that single notification could hand an attacker the keys to your entire host. No foothold. No phishing. No mercy.
Your gut says it is just another chat. Your server says it is a loaded gun.
According to a July 10, 2026 report from The Hacker News, security researcher Chinmohan Nayak disclosed three high-severity vulnerabilities in OpenClaw that enable credential theft, privilege escalation, and arbitrary code execution on the host. And the entry point is as mundane as a text message.
The Three Flaws That Open the Door
Nayak’s disclosure names three specific bugs, and each one bites hard.
The first is GHSA-hjr6-g723-hmfm, carrying a CVSS score of 8.8. It is an OS command injection caused by incomplete input filtering in the host execution environment, allowing execution beyond the caller’s intended authorization. The second, GHSA-9969-8g9h-rxwm, also scores 8.8. It is a second OS command injection with incomplete input filtering in that same host execution environment, similarly bypassing authorization. The third, GHSA-575v-8hfq-m3mc, scores 8.4. It is a path traversal and link following vulnerability in sandbox bind mounts that allows a parent-directory bypass.
Here is where your blood runs cold. These three bugs chain from an external WhatsApp message straight to host code execution. An attacker sends a crafted WhatsApp message that reaches an OpenClaw channel-facing agent with the exec tool enabled. That message triggers the command injection flaws, spinning up arbitrary host commands instantly. The attacker needs zero prior presence.
The sandbox crack lives in getBlockedReasonForSourcePath(). The function carefully checks if a source path is under a blocked path, but it never checks whether a blocked path is under the source. It is a one-way blindfold. This logic gap allows mounting a parent directory like /home or /var, which indirectly exposes blocked subdirectories that were meant to stay sealed away from prying eyes.
When the Sandbox Vault Becomes a Reading Room
The bind mount denylist tries to protect your secrets. It blocks ~/.ssh, ~/.aws, and ~/.gnupg. But because mounting /home or /var is permitted, an attacker walks around the gate. Mounting /home reads every user’s SSH private keys, AWS credentials files, and GPG secret keys in one pass. Mounting /var is even uglier. It exposes the Docker socket, enabling full host escape from inside the sandbox. Suddenly the container walls crumble, and the attacker is roaming your bare metal.
This is a stark difference from the Claw Chain vulnerabilities disclosed by Cyera in May 2026. Those demanded an attacker establish a prior foothold before extracting sensitive data, dropping a persistent backdoor, obtaining arbitrary remote code execution, or escaping to the host. Nayak’s bugs ask for nothing. A stranger becomes root over chat.
The Fix
All three flaws have been patched in OpenClaw version 2026.6.6. OpenClaw maintainers stated that practical impact depends on the operator’s configuration and whether lower-trust input can reach that path. So your setup is the final gatekeeper. OpenClaw advises enabling sandbox mode for all non-main sessions, removing exec from the tool allowlist for channel-facing agents, and monitoring git clone commands for the ext:: external protocol helper, which could be abused to run arbitrary system commands. General hardening guidance includes restricting the affected feature to trusted operators, keeping channel and tool allowlists narrow, avoiding sharing one Gateway between mutually untrusted users, and disabling the affected feature when not needed.
One WhatsApp message should never be the master key to your kingdom. Update to 2026.6.6, tighten your allowlists, and audit your sandbox rules today. Because the next ping you hear might not be from a friend. It might be the sound of your front door swinging open.