CVE-2026-28460
published 2026-03-19CVE-2026-28460: OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by…
PriorityP260high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.44%
35.1th percentile
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by splitting command substitution using shell line-continuation characters. Attackers can bypass security analysis by injecting $\\ followed by a newline and opening parenthesis inside double quotes, causing the shell to fold the line continuation into executable command substitution that circumvents approval boundaries.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openclaw | openclaw | < 2026.2.22 | 2026.2.22 |
| openclaw | openclaw | >= 0 < 2026.2.22 | 2026.2.22 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect allowlist bypass attempts in OpenClaw system.run by looking for shell line-continuation characters injected inside double-quoted strings: the pattern '$\ followed by a newline and opening parenthesis' folds into executable command substitution. ↗
- →Monitor calls to the OpenClaw system.run API for payloads containing shell line-continuation characters (backslash-newline sequences) embedded within double-quoted command strings, which are the mechanism used to split and bypass command allowlist analysis. ↗
- ·The vulnerability affects OpenClaw versions prior to 2026.2.22; upgrading to 2026.2.22 or later (fix available as of March 20, 2026 on npm, Homebrew, and MinimOS) remediates the allowlist bypass. ↗
- ·The product was formerly known as Moltbot or Clawdbot; detection rules and package inventory checks should account for all three names when identifying affected deployments. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.06.0MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
ghsa·2026-03-03
CVE-2026-28460 [MEDIUM] CWE-78 OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
### Summary
In OpenClaw `system.run` allowlist mode, shell-wrapper analysis could be bypassed by splitting command substitution as `$\\` + newline + `(` inside double quotes. Analysis treated the payload as allowlisted (for example `/bin/echo`), while shell runtime folded the line continuation into `$(...)` and executed non-allowlisted subcommands.
### Affected Packages / Versions
- Package: npm `openclaw`
- Latest published affected version: `2026.2.21-2`
- Affected range: `<=2026.2.21-2`
- Patched version (planned next release): `2026.2.22`
### Impact
In deployments that opt into `tools.exec.security=allowlist` (with `ask=on-miss` or `off`), this can bypass approval boundaries and lead to unintende
OSV
OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
osv·2026-03-03
CVE-2026-28460 [MEDIUM] OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
### Summary
In OpenClaw `system.run` allowlist mode, shell-wrapper analysis could be bypassed by splitting command substitution as `$\\` + newline + `(` inside double quotes. Analysis treated the payload as allowlisted (for example `/bin/echo`), while shell runtime folded the line continuation into `$(...)` and executed non-allowlisted subcommands.
### Affected Packages / Versions
- Package: npm `openclaw`
- Latest published affected version: `2026.2.21-2`
- Affected range: `<=2026.2.21-2`
- Patched version (planned next release): `2026.2.22`
### Impact
In deployments that opt into `tools.exec.security=allowlist` (with `ask=on-miss` or `off`), this can bypass approval boundaries and lead to unintende
No detection rules found.
No public exploits indexed.
2026-03-19
Published