CVE-2026-28391 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.2 contains a command injection caused by improper validation of Windows cmd.exe metacharacters in allowlist-gated exec requests, letting remote attackers bypass command approval and execute unapproved commands.

Severity & Score

Impact

Remote attackers can execute arbitrary unapproved commands, potentially leading to full system compromise.

Mitigation

Upgrade to version 2026.2.2 or later.

References

• https://github.com/openclaw/openclaw/commit/a7f4a53ce80c98ba1452eb90802d447fca9bf3d6
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qj77-c3c8-9c3q
• https://www.vulncheck.com/advisories/openclaw-command-injection-via-cmdexe-parsing-bypass-in-allowlist-enforcement

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🔴 CVE-2026-28391 - Critical (9.8) OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests, allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings with shell metach... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28391/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner