PT-2026-27224 · Openclaw · Openclaw

Tdjackey · CVE-2026-28455 · Publicado 2026-03-23 · Atualizado 2026-03-24

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22

Description The software contains a flaw in the system.run exec analysis where the allowlist bypass fails to properly unwrap environment and shell-dispatch wrapper chains. This allows attackers to use wrapper binaries, such as env and bash, to smuggle payloads and circumvent the intended allowlist restrictions. The issue could allow for unauthorized execution of commands.

Recommendations Update to version 2026.2.22 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-28455

Produtos afetados

Openclaw

Referências · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-jj82-76v6-933r · Nota
• https://github.com/openclaw/openclaw/commit/2b63592be57782c8946e521bc81286933f0f99c7 · Correção
• https://vulncheck.com/advisories/openclaw-mar-allowlist-bypass-via-wrapper-binary-unwrapping-in-system · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-28455 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2036319086225854618 · Publicação no Twitter