OpenClaw CLI unvalidated process kill via SIGKILL in cleanup
OpenClaw CLI used unvalidated process pattern matching to kill processes during cleanup, risking termination of unrelated processes on shared hosts. The vulnerability was patched in version 2026.2.14 to scope cleanup to owned child processes only.
What happened
OpenClaw CLI versions before 2026.2.14 used system-wide process enumeration and pattern matching to terminate processes during cleanup without verifying they were owned by the current OpenClaw process.
On shared hosts, unrelated processes could be terminated if they matched the command-line patterns used for process identification.
Index analysis
The vulnerability (CVE-2026-27486) was classified as low severity and involved unverified process ownership (CWE-283).
Version 2026.2.14 patched the issue by scoping process cleanup to owned processes only, filtering to direct child process IDs where ppid equals the current process ID.
Governance controls
The fix included hardening follow-ups: preferring graceful termination with SIGTERM before SIGKILL fallback, reducing false negatives from process argument truncation using ps -axww output, and tightening command-line token matching to avoid substring matches.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.