CVE-2026-44115 - Vulnerability Analysis

Overview

OpenClaw < 2026.4.22 contains a command injection caused by shell expansion hiding in unquoted heredoc bodies, letting attackers bypass allowlist validation and execute unapproved commands at runtime, exploit requires crafted input with heredoc bodies.

Severity & Score

Impact

Attackers can execute unapproved commands at runtime, potentially leading to full system compromise.

Mitigation

Update to version 2026.4.22 or later.

References

• https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5
• https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx
• https://www.vulncheck.com/advisories/openclaw-shell-expansion-bypass-in-unquoted-heredocs-via-exec-allowlist

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner