TLDR Tech / InfoSec
Claw Chain: Cyera Research Unveil Four Chainable Vulnerabilities in OpenClaw
OpenClaw contains four chained flaws: a TOCTOU write escape that enables host changes, env-var leakage of secrets, a loopback bug that grants owner rights, and a TOCTOU read escape that exposes files. Attackers can move from a malicious plugin or prompt to data theft, privilege escalation, and persistence on widely exposed OpenClaw instances, so patching and secret rotation cannot wait.
Read the full story