PT-2026-26225 · Openclaw · Openclaw

Tdjackey · Publicado 2026-02-23 · Atualizado 2026-04-01 · CVE-2026-28460

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22

Description The software contains an allowlist bypass issue in the system.run function. This allows attackers to execute commands not included in the allowlist by utilizing shell line-continuation characters to split command substitution. Specifically, injecting $ followed by a newline and an opening parenthesis inside double quotes bypasses security analysis, causing the shell to interpret the line continuation as executable command substitution, circumventing approval boundaries. The issue affects deployments using tools.exec.security=allowlist with ask=on-miss or ask=off.

Recommendations Upgrade to version 2026.2.22 or newer when it is published. As a temporary mitigation, set tools.exec.ask=always or tools.exec.security=deny.

Correção

Incorrect Authorization

OS Command Injection

Enumeração de Fraquezas

CWE-863

CWE-78

Identificadores relacionados

BDU:2026-05018

CVE-2026-28460

GHSA-9868-VXMX-W862

GHSA-XRGV-34CC-Q765

Produtos afetados

Openclaw

Referências · 14

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/commit/3f0b9dbb36c86e308267924c0d3d4a4e1fc4d1e9 · Correção
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9868-vxmx-w862 · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-allowlist-bypass-via-shell-line-continuation-command-substitution-in-system-run · Nota
• https://twitter.com/RedPacketSec/status/2034735873263022582 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28460 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-05018 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xrgv-34cc-q765 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034520398704812353 · Publicação no Twitter
• https://reddit.com/r/openclaw/comments/1s9etbu/why_allow_always_on_openclaw_was_a_terrible_idea · Publicação no Reddit
• https://twitter.com/CVEarity/status/2035247345047413020 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28460 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2034524155349987599 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-9868-vxmx-w862 · Aviso do Fabricante