OpenClaw AI Assistant Vulnerabilities: Credential Theft, Privilege Escalation, and Code Execution

Details have emerged about three high‑severity vulnerabilities in the OpenClaw personal artificial intelligence assistant that, if successfully exploited, could enable credential theft, privilege escalation, and arbitrary code execution on the host. The first flaw (GHSA‑hjr6‑g723‑hmfm) carries a CVSS score of 8.8 and allows attackers to steal stored credentials through a malformed input vector. A second vulnerability permits local privilege escalation by abusing an insecure file‑system permission check. The third flaw enables remote code execution via a crafted network packet that triggers a buffer overflow in the assistant’s communication module. All three issues have been patched in the latest OpenClaw release, which also includes additional hardening of the authentication layer. Users are advised to update immediately and verify that the new version is running. Security teams should monitor for unusual authentication attempts and scan for the presence of the vulnerable code paths. The incident underscores the importance of timely patching for AI assistants that run with elevated privileges.