# Security Advisory: CVE-2026-30741

Product: OpenClaw Agent Platform
Affected Versions: v2026.2.6 and earlier
Vulnerability Type: Remote Code Execution (RCE) via Request-Side Prompt Injection
Description: A lack of integrity validation for upstream API requests allows for request-stream poisoning. This induces high-performance models to generate unauthorized terminal commands executed via MCP tools without human confirmation.

## 📺 Proof of Concept (PoC)

<div align="center">
  <video src="https://github.com/Named1ess/CVE-2026-30741/raw/main/CVE-2026-30741_PoC.mp4" width="100%" controls>
    Your browser does not support the video tag.
  </video>
  <p><i>Figure 1: Demonstration of RCE via Request-Side Prompt Injection</i></p>
</div>

**External Mirror**: [Bilibili (BV1LoFazeEBM)](https://www.bilibili.com/video/BV1LoFazeEBM)

---

**Credit**: Namedless
**Reference**: CNVD-2026-11444
