OpenClaw Process Safety Vulnerability: Unvalidated PID Kill via SIGKILL
Summary
GHSA-jfv4-h8mc-jcp8: OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup. Affects openclaw versions < 2026.2.14. Fixed in 2026.2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is a command-line interface (CLI) tool designed for managing and automating processes in various environments. It allows users to execute commands, manage process lifecycles, and perform cleanup operations. However, a significant vulnerability exists in its process cleanup functionality, where it fails to validate the ownership of processes before terminating them. This flaw can lead to unintended termination of unrelated processes on shared hosts, posing a risk to system stability and security.
Vulnerability Detail
The vulnerability arises from OpenClaw's reliance on system-wide process enumeration and pattern matching to identify processes for termination. Without verifying that the processes belong to the current OpenClaw instance, it is possible for the CLI to kill unrelated processes that match the specified command-line patterns. This could result in data loss, service disruption, or other unintended consequences, particularly in multi-user environments where processes from different users coexist.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.14
This is the first release that contains the fix.
npm install openclaw@2026.2.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually verify and terminate processes using system tools like kill or pkill, ensuring that they only target processes they own. For example, to kill a process with a specific PID, use: kill <PID>.
Conclusion
The OpenClaw vulnerability presents a significant risk by allowing unvalidated process termination, which can affect unrelated processes on shared hosts. Users are strongly encouraged to update to the patched version 2026.2.14 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows OpenClaw to terminate processes without verifying their ownership, potentially affecting unrelated processes on shared systems.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
If updating is not possible, consider implementing manual process management practices to ensure that only owned processes are terminated.
The consequences include unintended termination of critical processes, leading to data loss, service disruptions, and overall instability in shared environments.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
