CVE-2026-30741 — A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows…¶

Key facts

CVE-2026-30741 is a Critical (9.8) vulnerability: A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-30741
Severity	Critical (9.8)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-30741/

Details¶

CVE-2026-30741 is a Critical (9.8) vulnerability: A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Side prompt injection attack.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-30741
Type	RCE
CVSS Score	9.8

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-30741/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-30741

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/Named1ess/CVE-2026-30741
https://github.com/OpenClaw/OpenClaw
https://www.bilibili.com/video/BV1LoFazeEBM

Generated by PoC Generator on 2026-04-10T15:40:43.291482983

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-30741, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-30741 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-30741 OpenClaw Agent Platform RCE via Request-Side Prompt Injection"; flow:established,to_server; content:"OpenClaw"; http_header; content:"Agent"; http_header; content:"execute"; http_client_body; content:"system"; http_client_body; content:"cmd"; http_client_body; pcre:"/(\bexec\b|\beval\b|\bsystem\b|\bcmd\b).{0,50}(\||;|&|\$\()/i"; classtype:attempted-admin; sid:1000000; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-30741 OpenClaw Agent Platform Prompt Injection Attack Pattern"; flow:established,to_server; content:"User-Agent"; http_header; content:"OpenClaw"; http_header; content:"ignore"; http_client_body; content:"previous"; http_client_body; content:"instruction"; http_client_body; pcre:"/ignore.{0,20}previous.{0,20}instruction/i"; classtype:attempted-admin; sid:1000001; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-30741 OpenClaw Agent Platform Command Injection via Prompt"; flow:established,to_server; content:"POST"; http_method; content:"application/json"; http_header; content:"prompt"; http_client_body; content:"exec"; http_client_body; pcre:"/[\"']prompt[\"'].{0,100}(exec|system|eval|cmd|shell)/i"; classtype:attempted-admin; sid:1000002; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-30741 OpenClaw Agent Platform Request-Side Injection Bypass"; flow:established,to_server; content:"OpenClaw"; http_header; content:"v2026.2.6"; http_header; content:"request"; http_client_body; pcre:"/(execute|run|eval).{0,50}(bash|sh|powershell|cmd\.exe)/i"; classtype:attempted-admin; sid:1000003; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-30741 OpenClaw Agent Platform Malicious Prompt Injection"; flow:established,to_server; content:"Content-Type"; http_header; content:"json"; http_header; content:"{"; http_client_body; content:"prompt"; http_client_body; content:"execute"; http_client_body; pcre:"/\{.{0,200}\"prompt\".{0,100}(system|exec|eval|cmd)/i"; classtype:attempted-admin; sid:1000004; rev:1; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_30741_OpenClaw_RCE_Injection {
    meta:
        author = "Security Engineer"
        description = "Detects OpenClaw Agent Platform v2026.2.6 RCE via Request-Side prompt injection"
        reference = "CVE-2026-30741"
        severity = "high"
        date = "2024-01-01"

    strings:
        $version = "OpenClaw Agent Platform" ascii nocase
        $version_num = "v2026.2.6" ascii
        $version_num2 = "2026.2.6" ascii

        $injection1 = "\\n\\nIgnore previous instructions" ascii nocase
        $injection2 = "\\n\\nSystem:" ascii nocase
        $injection3 = "\\n\\nUser:" ascii nocase
        $injection4 = "exec(" ascii nocase
        $injection5 = "eval(" ascii nocase
        $injection6 = "__import__" ascii nocase
        $injection7 = "subprocess" ascii nocase
        $injection8 = "os.system" ascii nocase

        $prompt_bypass1 = /\\n\\n(ignore|forget|disregard).{0,20}(previous|above|prior)/i
        $prompt_bypass2 = /\\n\\n(new|updated|changed).{0,20}(instruction|rule|prompt)/i
        $prompt_bypass3 = /\\n\\n(you are now|act as|pretend to be)/i

        $rce_pattern1 = /{exec\s*\([^)]+\)}/
        $rce_pattern2 = /{eval\s*\([^)]+\)}/
        $rce_pattern3 = /subprocess\.(call|run|Popen)/

        $hex_injection = { 5C 6E 5C 6E 49 67 6E 6F 72 65 20 70 72 65 76 69 6F 75 73 }
        $hex_exec = { 65 78 65 63 28 }

    condition:
        (
            ($version and ($version_num or $version_num2)) or
            any of ($injection*) or
            any of ($prompt_bypass*) or
            any of ($rce_pattern*) or
            any of ($hex_*)
        ) and
        (
            2 of ($injection*) or
            1 of ($prompt_bypass*) or
            1 of ($rce_pattern*)
        )
}

rule CVE_2026_30741_OpenClaw_Memory_Artifacts {
    meta:
        author = "Security Engineer"
        description = "Detects memory artifacts of OpenClaw Agent Platform RCE exploitation"
        reference = "CVE-2026-30741"
        severity = "high"
        date = "2024-01-01"

    strings:
        $mem_artifact1 = "openclaw_agent" ascii nocase
        $mem_artifact2 = "request_processor" ascii nocase
        $mem_artifact3 = "prompt_injection_detected" ascii nocase

        $exploit_marker1 = "OPENCLAW_EXPLOIT" ascii
        $exploit_marker2 = "prompt_bypass_success" ascii
        $exploit_marker3 = "rce_payload_executed" ascii

        $payload_exec = /cmd\s*=\s*['"'][^'"]+['"]/
        $shell_spawn = /sh\s*-c\s*['"'][^'"]+['"]/

        $encoded_payload = { 63 6D 64 3D }  // cmd=
        $base64_marker = { 65 58 5A 6C 59 }  // eXZlY (common base64 start)

    condition:
        2 of them
}

rule CVE_2026_30741_OpenClaw_Network_Indicators {
    meta:
        author = "Security Engineer"
        description = "Detects network-based indicators of OpenClaw Agent Platform exploitation"
        reference = "CVE-2026-30741"
        severity = "medium"
        date = "2024-01-01"

    strings:
        $http_header = "User-Agent: OpenClawExploit" ascii
        $http_header2 = "X-OpenClaw-Version: 2026.2.6" ascii

        $post_data1 = "prompt=" ascii
        $post_data2 = "&injection=" ascii
        $post_data3 = "request_data=" ascii

        $json_payload1 = "\"prompt_injection\":" ascii
        $json_payload2 = "\"bypass_instruction\":" ascii
        $json_payload3 = "\"execute_command\":" ascii

        $exploit_path1 = "/api/v1/agent/process" ascii
        $exploit_path2 = "/openclaw/request" ascii
        $exploit_path3 = "/agent/prompt" ascii

    condition:
        2 of them
}

:material-file-download: prevention/yara.yar

# Prevention rules for CVE-2026-30741 - OpenClaw Agent Platform RCE via Request-Side Prompt Injection

# Block requests targeting OpenClaw Agent Platform endpoints
location ~* ^/(openclaw|agent|platform)/ {
    # Block prompt injection attempts in query parameters
    if ($query_string ~* "(prompt|inject|execute|eval|system|cmd|shell|exec|run|call|invoke)") {
        return 403;
    }

    # Block malicious request bodies containing prompt injection patterns
    if ($request_body ~* "(<!--.*?-->|<script.*?>|javascript:|data:|vbscript:|onload|onerror|eval\(|exec\(|system\(|shell_exec|passthru|proc_open)") {
        return 403;
    }

    # Block common RCE payloads in headers
    if ($http_user_agent ~* "(curl|wget|python|perl|ruby|bash|sh|cmd|powershell)") {
        return 403;
    }

    # Continue to application if no malicious patterns detected
    try_files $uri $uri/ @backend;
}

# Block specific request patterns targeting OpenClaw vulnerabilities
location ~* \.(php|jsp|asp|aspx|cgi|pl|py|rb|sh)$ {
    # Block requests with prompt injection in file uploads
    if ($request_body ~* "(prompt.*injection|execute.*code|eval.*input|system.*command)") {
        return 403;
    }

    # Block encoded injection attempts
    if ($args ~* "(%3C|%3E|%22|%27|%28|%29|%3B|%7C|%26|%60)") {
        return 403;
    }

    try_files $uri =404;
}

# Block suspicious Content-Type headers often used in injection attacks
location / {
    # Block multipart requests with suspicious boundaries
    if ($content_type ~* "multipart.*boundary.*(script|eval|exec|cmd)") {
        return 403;
    }

    # Block JSON requests with potential injection payloads
    if ($content_type ~* "application/json" ) {
        if ($request_body ~* "(\"|').*?(eval|exec|system|shell|cmd|prompt).*?(\"|')") {
            return 403;
        }
    }

    # Block XML requests with XXE or injection attempts
    if ($content_type ~* "application/xml|text/xml" ) {
        if ($request_body ~* "(<!ENTITY|<!DOCTYPE.*ENTITY|eval\(|exec\(|system\()") {
            return 403;
        }
    }

    # Add security headers
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Content-Security-Policy "default-src 'self'";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

    try_files $uri $uri/ @backend;
}

# Rate limiting for potential attack patterns
limit_req_zone $binary_remote_addr zone=injection_limit:10m rate=5r/m;

# Apply rate limiting to suspicious requests
location ~* "(prompt|inject|execute|eval|system|cmd)" {
    limit_req zone=injection_limit burst=3 nodelay;
    return 403;
}

# Block common injection vectors in headers
if ($http_x_forwarded_for ~* "(script|eval|exec|system|shell|cmd)") {
    return 403;
}

if ($http_referer ~* "(javascript:|data:|vbscript:|eval\(|exec\(|system\()") {
    return 403;
}

# Block requests with suspicious request methods for OpenClaw endpoints
location ~* ^/(openclaw|agent|platform)/ {
    limit_except GET POST HEAD {
        deny all;
    }
}

# Upstream backend configuration
location @backend {
    proxy_pass http://backend_servers;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Additional security headers for backend communication
    proxy_set_header X-Content-Type-Options nosniff;
    proxy_set_header X-Frame-Options SAMEORIGIN;

    # Hide server information
    proxy_hide_header Server;
    proxy_hide_header X-Powered-By;
}

:material-file-download: prevention/nginx.conf

# ModSecurity Rules for CVE-2026-30741
# OpenClaw Agent Platform v2026.2.6 RCE via Request-Side Prompt Injection

# Block common prompt injection patterns
SecRule REQUEST_BODY "@detectSQLi" \
    "id:1000000,\
    phase:2,\
    block,\
    msg:'CVE-2026-30741: Potential prompt injection attempt detected in request body',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'cve-2026-30741',\
    tag:'prompt-injection',\
    tag:'rce'"

# Detect prompt injection keywords and patterns
SecRule ARGS "@rx (?i)(ignore\s+previous|forget\s+instructions|new\s+instructions|system\s+prompt|override\s+prompt|bypass\s+filter)" \
    "id:1000001,\
    phase:2,\
    block,\
    msg:'CVE-2026-30741: Prompt injection keywords detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'cve-2026-30741',\
    tag:'prompt-injection'"

# Block command injection patterns common in prompt attacks
SecRule ARGS "@rx (?i)(execute|eval|system|shell|cmd|powershell|bash|sh|exec)" \
    "id:1000002,\
    phase:2,\
    block,\
    msg:'CVE-2026-30741: Command execution keywords in parameters',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'cve-2026-30741',\
    tag:'command-injection'"

# Detect role manipulation attempts
SecRule ARGS "@rx (?i)(you\s+are\s+now|act\s+as|pretend\s+to\s+be|role\s*:\s*|assume\s+the\s+role)" \
    "id:1000003,\
    phase:2,\
    block,\
    msg:'CVE-2026-30741: Role manipulation attempt detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'HIGH',\
    tag:'cve-2026-30741',\
    tag:'role-manipulation'"

# Block attempts to break out of context
SecRule ARGS "@rx (?i)(\*\*\*|---|\[INST\]|\[\/INST\]|<\|.*\|>|```|###)" \
    "id:1000004,\
    phase:2,\
    block,\
    msg:'CVE-2026-30741: Context break attempt detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'HIGH',\
    tag:'cve-2026-30741',\
    tag:'context-break'"

# Detect OpenClaw-specific injection patterns
SecRule REQUEST_URI "@rx (?i)/openclaw/agent" \
    "id:1000005,\
    phase:1,\
    pass,\
    msg:'CVE-2026-30741: OpenClaw Agent endpoint accessed',\
    logdata:'URI: %{REQUEST_URI}',\
    severity:'INFO',\
    tag:'cve-2026-30741',\
    tag:'openclaw-access',\
    chain"
    SecRule ARGS "@rx (?i)(prompt|instruction|command|directive)" \
        "block,\
        msg:'CVE-2026-30741: Prompt injection attempt on OpenClaw Agent endpoint',\
        logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
        severity:'CRITICAL'"

# Block suspicious HTTP headers that might contain injection
SecRule REQUEST_HEADERS "@rx (?i)(ignore\s+previous|new\s+instructions|system\s+prompt)" \
    "id:1000006,\
    phase:1,\
    block,\
    msg:'CVE-2026-30741: Prompt injection in HTTP headers',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'cve-2026-30741',\
    tag:'header-injection'"

# Detect JSON payload injection attempts
SecRule REQUEST_HEADERS:Content-Type "@rx application/json" \
    "id:1000007,\
    phase:2,\
    pass,\
    msg:'CVE-2026-30741: JSON content detected',\
    severity:'INFO',\
    tag:'cve-2026-30741',\
    chain"
    SecRule REQUEST_BODY "@rx (?i)(\\\"prompt\\\":|\\\"instruction\\\":|\\\"system\\\":)" \
        "block,\
        msg:'CVE-2026-30741: Prompt injection in JSON payload',\
        logdata:'Matched Data: %{MATCHED_VAR}',\
        severity:'CRITICAL'"

# Block excessively long inputs that might contain injection
SecRule ARGS "@gt 5000" \
    "id:1000008,\
    phase:2,\
    block,\
    msg:'CVE-2026-30741: Suspiciously long parameter value',\
    logdata:'Parameter length: %{MATCHED_VAR} bytes',\
    severity:'MEDIUM',\
    tag:'cve-2026-30741',\
    tag:'length-check'"

# Rate limiting for OpenClaw endpoints
SecRule REQUEST_URI "@rx (?i)/openclaw" \
    "id:1000009,\
    phase:1,\
    pass,\
    msg:'CVE-2026-30741: Rate limiting OpenClaw requests',\
    severity:'INFO',\
    tag:'cve-2026-30741',\
    setvar:'ip.openclaw_requests=+1',\
    expirevar:'ip.openclaw_requests=60'"

SecRule IP:OPENCLAW_REQUESTS "@gt 10" \
    "id:1000010,\
    phase:1,\
    block,\
    msg:'CVE-2026-30741: Rate limit exceeded for OpenClaw endpoints',\
    logdata:'Requests from IP: %{REMOTE_ADDR}',\
    severity:'MEDIUM',\
    tag:'cve-2026-30741',\
    tag:'rate-limit'"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-30741?¶

CVE-2026-30741 is a Critical (9.8) vulnerability: A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-30741?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-30741?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.