Threat · curated 17 Jul 2026
NVD - CVE-2026-30741
First reported nist.gov
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
CVE-2026-30741 shows prompt injection escalating directly to arbitrary code execution in an AI agent platform, meaning a maliciously crafted prompt can fully compromise the host running the agent.
CVE-2026-30741 is a remote code execution vulnerability in OpenClaw Agent Platform v2026.2.6 that allows attackers to execute arbitrary code via a request-side prompt injection attack. CISA-ADP rated it CVSS 3.1 base 9.8 (Critical), classified as CWE-94 code injection, with public exploit references including a GitHub PoC repository.
Summary
CVE-2026-30741 is a critical remote code execution vulnerability in the OpenClaw Agent Platform (v2026.2.6 and earlier) that allows an attacker to execute arbitrary code through a Request-Side prompt injection attack. CISA-ADP scored it CVSS 3.1 9.8 (Critical) and classified the root cause as CWE-94 code injection.[1]
The disclosure is supported by publicly available proof-of-concept material—a GitHub exploit repository referenced by MITRE and a demonstration video—rather than reports of coordinated in-the-wild exploitation; CISA's SSVC assessment records exploitation as 'none' while noting the attack is automatable with total technical impact.[1][2]
The accompanying demonstration illustrates that abusing third-party API keys and injecting prompts can coerce the agent into leaking sensitive data such as wallet mnemonic seed phrases, underscoring the practical impact of prompt-injection flaws in agent platforms.[2]
Attack chain
- Injection: An attacker submits a crafted Request-Side prompt injection payload to the OpenClaw Agent Platform.[1]
- Code execution: The injected content is improperly treated as code (CWE-94), resulting in arbitrary/remote code execution on the platform.[1]
- Impact / data theft: Demonstration material shows the technique combined with third-party API key hijacking to inject prompts and extract sensitive secrets such as wallet mnemonic seed phrases.[2]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-02-05 | Demonstration video published on Bilibili showing third-party API key hijacking and prompt injection to obtain a mnemonic seed phrase.[2] |
| 2026-03-11 | CVE-2026-30741 received from MITRE and published on NVD with description and references.[1] |
| 2026-03-12 | CISA-ADP added CVSS 3.1 vector (9.8 Critical) and CWE-94 classification; SSVC timestamp recorded.[1] |
| 2026-03-17 | NIST performed initial analysis, adding CPE configuration and reference types.[1] |
| 2026-06-17 | CVE last modified by CISA-ADP and MITRE (SSVC and affected metadata updates).[1] |
How it works
The vulnerability is a Request-Side prompt injection flaw in the OpenClaw Agent Platform. Malicious input carried in a request is improperly incorporated into generated code (CWE-94, Improper Control of Generation of Code), permitting an unauthenticated remote attacker to execute arbitrary code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low complexity, no privileges or user interaction required, with high confidentiality, integrity, and availability impact.[1]
Public demonstration material shows the injection path combined with hijacking of third-party API keys, enabling the injected prompt to extract sensitive secrets such as cryptocurrency wallet mnemonic seed phrases.[2]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| OpenClaw Agent Platform (openclaw:openclaw, Node.js) | All versions up to and including 2026.2.6 | No fixed version or patch is identified in the available evidence.[1] |
Key takeaways
- Prompt injection against AI agent platforms can escalate to full remote code execution (CWE-94), as evidenced by the CVSS 9.8 rating for CVE-2026-30741.[1]
- Although exploitation is currently assessed as 'none' in the wild, working proof-of-concept code and a public demonstration exist, and CISA notes the attack is automatable—raising the risk of near-term weaponization.[1][2]
- Handing agents third-party API keys and sensitive secrets is dangerous, since injected prompts have been demonstrated to leak wallet mnemonic seed phrases.[2]
Defensive actions
- Restrict and validate the use of third-party API keys with OpenClaw agents and avoid supplying secrets the agent could be induced to disclose.: Demonstration material shows third-party API key hijacking combined with prompt injection to exfiltrate sensitive data such as wallet mnemonic seed phrases.[2]
- Treat all request-side input to the OpenClaw Agent Platform as untrusted and monitor for exploitation attempts, prioritizing an upgrade beyond 2026.2.6 once available.: The flaw allows unauthenticated remote code execution via prompt injection (CVSS 9.8) and CISA notes the attack is automatable, so exploitation attempts are low-effort and high-impact.[1]