PT-2026-22291 · Openclaw · Openclaw

Tdjackey · Published 2026-02-27 · Updated 2026-03-04 · CVE-2026-28363

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.23

Description The software contains a validation bypass in the tools.exec.safeBins logic for the sort command. This bypass occurs when using GNU long-option abbreviations (such as --compress-prog) in allowlist mode, allowing execution paths that should require approval to run without it. The vulnerable component is the tools.exec.safeBins function.

Recommendations Update OpenClaw to version 2026.2.23 or later.

Fix

LPE

Incomplete List of Disallowed Inputs

Incorrect Authorization

Weakness Enumeration

CWE-184

CWE-863

Related Identifiers

CVE-2026-28363

GHSA-3C6H-G97W-FG78

GHSA-7977-C43C-XPWJ

Affected Products

Openclaw

References · 20

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3c6h-g97w-fg78 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7977-c43c-xpwj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3c6h-g97w-fg78 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28363 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32059 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.23 · Note
• https://github.com/openclaw/openclaw/commit/3b8e33037ae2e12af7beb56fcf0346f1f8cbde6f · Note
• https://twitter.com/pulsepatchio/status/2027753800635707501 · Twitter Post
• https://twitter.com/CveTodo/status/2027239324220076068 · Twitter Post
• https://twitter.com/cracbot/status/2029149990451650984 · Twitter Post
• https://vulncheck.com/advisories/openclaw-allowlist-bypass-via-sort-long-option-abbreviation-in-toolsexecsafebins · Note
• https://twitter.com/TheHackerWire/status/2027236947056545859 · Twitter Post
• https://twitter.com/CVEnew/status/2027380205422051403 · Twitter Post