Is CVE-2026-26323 actively exploited?

No active exploitation of CVE-2026-26323 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26323 be exploited remotely?

Yes. CVE-2026-26323 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-26323?

CVE-2026-26323 has a CVSS score of 8.8 (HIGH) and an EPSS exploitation probability of 0.20%.

HOME VULNERABILITIESCVE-2026-26323

HIGH

CVE-2026-26323

CWE-78Published: February 19, 2026· Updated: Feb 20, 2026

8.8

CVSS v3.1

EPSS:0.18%probability of exploitation in 30 daysPercentile:38.9th

Official Description

OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script `scripts/update-clawtributors.ts`. The issue affects contributors/maintainers (or CI) who run `bun scripts/update-clawtributors.ts` in a source checkout that contains a malicious commit author email (e.g. crafted `@users[.]noreply[.]github[.]com` values). Normal CLI usage is not affected (`npm i -g openclaw`): this script is not part of the shipped CLI and is not executed during routine operation. The script derived a GitHub login from `git log` author metadata and interpolated it into a shell command (via `execSync`). A malicious commit record could inject shell metacharacters and execute arbitrary commands when the script is run. Version 2026.2.14 contains a patch.

NVD Source

Technical Analysis

CVE-2026-26323 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.