External risk intelligence

OpenClaw Remote Command Injection in iMessage Attachment Staging

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-32917

The vulnerability involves iMessage attachment processing within a specific application flow. While network-reachable in some environments, this functionality is typically an internal feature of the application's attachment handling logic rather than a public-facing service, gateway, or common internet-exposed endpoint.

OS Command Injection

Openclaw

before 2026.3.13

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical remote command injection vulnerability within OpenClaw's iMessage attachment handling. The flaw allows an attacker to execute arbitrary commands on configured remote hosts by exploiting unsanitized attachment paths. This could lead to significant system compromise if the affected functionality is enabled and exposed.

Attackers can run commands remotely.
Affects how attachments are handled.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging the iMessage attachment staging feature. If remote attachment staging is enabled, an attacker can craft a malicious remote attachment path containing shell metacharacters. This path is then processed by the SCP remote operand without proper sanitization, leading to arbitrary command execution on the configured remote hosts.

Requires remote attachment staging enabled.
Triggered by unsanitized remote attachment paths.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to execute arbitrary commands on remote hosts when the iMessage attachment staging flow is enabled and processes unsanitized attachment paths. This could impact the confidentiality, integrity, and availability of configured remote systems.

System data on remote hosts.
Unsanitized paths in SCP operand.
Arbitrary command execution on hosts.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability, which allows arbitrary command execution through unsanitized iMessage attachment paths. The first practical step is to identify all instances of the affected technology, confirm their reachability and business criticality, and then assign an owner to plan remediation based on the assessed risk.

Assign to application or platform owner.
Verify iMessage attachment staging configuration.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenClaw and how is it used?

OpenClaw is a Node.js-based software application designed for handling complex data streams and messaging integration. It is frequently deployed to automate workflows that involve processing and staging incoming files or attachments from messaging platforms like iMessage for transfer to remote servers.

What does the CVE-2026-32917 weakness mean?

This vulnerability is classified as Improper Neutralization of Special Elements used in an OS Command, or OS Command Injection. It occurs because OpenClaw takes file paths from iMessage attachments and passes them directly to a system command tool called SCP. If an attacker includes hidden shell characters in a file path, the software mistakenly runs those characters as legitimate system commands.

How is this OpenClaw vulnerability triggered?

An attacker triggers this by sending a specifically crafted attachment path that includes malicious shell instructions. Crucially, the bug only activates if the specific iMessage attachment staging feature is enabled in the software. If this staging feature is turned off or not configured for use, the vulnerable code path is not exercised.

Is my system at risk from CVE-2026-32917?

According to Halo Surface Signal, this vulnerability is unlikely to be found on standard public-facing gateways. It is tied to internal attachment handling logic. You should evaluate if your deployment uses the iMessage staging flow and if that process is reachable from any untrusted or external network, as this increases the potential risk of exploitation.

How do I start securing my environment?

First, locate all running instances of OpenClaw and confirm which versions are in use. Check your configuration files to determine if the iMessage attachment staging feature is currently enabled. If it is, coordinate with your system owners to disable this feature or apply the vendor-provided update to eliminate the command injection path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.