RCE in Apple macOS
CVE-2026-27487
OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data, this created an OS command injection risk. This issue has been fixed in version 2026.2.14.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.019 (78.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 79th percentile — 78.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.019 · change: +0.007
Affected products
- Apple macOS
- Openclaw — versions < 2026.2.14
Weakness classification (CWE)
References
- github.com/openclaw/openclaw/security/advisories/GHSA-4564-pvr2-qq4h (Patch, Vendor Advisory)
- github.com/openclaw/openclaw/pull/15924 (Issue Tracking)
- github.com/openclaw/openclaw/commit/66d7178f2d6f9d60abad35797f97f3e61389b70c (Patch)
- github.com/openclaw/openclaw/commit/9dce3d8bf83f13c067bc3c32291643d2f1f10a06 (Patch)
- github.com/openclaw/openclaw/commit/b908388245764fb3586859f44d1dff5372b19caf (Patch)
- github.com/openclaw/openclaw/releases/tag/v2026.2.14 (Release Notes)
Frequently asked questions
- What is CVE-2026-27487?
- CVE-2026-27487 is a high-severity vulnerability in Apple macOS, classified under OS Command Injection. CVSS score: 7.6/10. Published 2026-02-21.
- How severe is CVE-2026-27487?
- High severity. CVSS v3 base score is 7.6 out of 10.