VYPR
← All advisories
Medium severity4.0NVD Advisory· Published Feb 21, 2026· Updated Jun 17, 2026

CVE-2026-27576

CVE-2026-27576

Description

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt payloads before forwarding them to chat.send. Because ACP runs over local stdio, this mainly affects local ACP clients (for example IDE integrations) that send unusually large inputs. This issue has been fixed in version 2026.2.19.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.2.192026.2.19

Affected products

3
  • OpenClaw/Openclaw2 versions
    cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <=2026.2.17
    • (no CPE)range: < 2026.2.19
  • ghsa-coords
    pkg:npm/openclaw
    Range: < 2026.2.19

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.