CVE-2026-28473 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.2 contains an authorization bypass caused by improper permission checks in the /approve chat command invoking exec.approval.resolve, letting clients with operator.write scope approve or deny exec requests without proper authorization.

Severity & Score

Impact

Clients with operator.write scope can bypass approval restrictions, potentially allowing unauthorized execution approvals.

Mitigation

Update to version 2026.2.2 or later.

References

• https://github.com/openclaw/openclaw/commit/efe2a464afcff55bb5a95b959e6bd9ec0fef086e
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mqpw-46fh-299h
• https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-approve-chat-command

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🔴 CVE-2026-28473 - Critical (9.8) OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending the /approve chat command. The /approve command path invokes exec.appro... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28473/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner