CVE-2026-28391: Openclaw

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings with shell metacharacters like & or %...% to execute unapproved commands beyond the allowlisted operations.

Affected products

• Openclaw Openclaw: before 2026.2.2 (fixed in 2026.2.2)

Published 2026-03-05. Last modified 2026-06-17.