CVE-2026-28470 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.2 contains a command injection caused by unescaped command substitution syntax in exec approvals allowlist, letting attackers execute arbitrary commands by bypassing allowlist protection, exploit requires exec approvals enabled.

Severity & Score

Impact

Attackers can execute arbitrary commands, potentially leading to full system compromise.

Mitigation

Update to version 2026.2.2 or later.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3hcm-ggvf-rch5
• https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-command-substitution-in-double-quotes
• https://github.com/openclaw/openclaw/commit/d1ecb46076145deb188abcba8f0699709ea17198

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🔴 CVE-2026-28470 - Critical (9.8) OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the allowlist protect... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28470/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner