CVE-2026-28466 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.14 contains a broken access control vulnerability caused by failure to sanitize internal approval fields in node.invoke parameters, letting authenticated clients bypass exec approval gating to run arbitrary system commands.

Severity & Score

Impact

Authenticated attackers can execute arbitrary commands on connected node hosts, potentially compromising developer workstations and CI runners.

Mitigation

Update to version 2026.2.14 or later.

References

• https://github.com/openclaw/openclaw/commit/c1594627421f95b6bc4ad7c606657dc75b5ad0ce
• https://github.com/openclaw/openclaw/security/advisories/GHSA-gv46-4xfq-jv58
• https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-node-invoke-approval-bypass
• https://github.com/openclaw/openclaw/commit/0af76f5f0e93540efbdf054895216c398692afcd
• https://github.com/openclaw/openclaw/commit/318379cdb8d045da0009b0051bd0e712e5c65e2d
• https://github.com/openclaw/openclaw/commit/a7af646fdab124a7536998db6bd6ad567d2b06b0

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🟠 CVE-2026-28466 - High (8.8) OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run commands. At... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28466/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner