What’s Vulnerable › Vulnerabilities

CVE-2026-28463: OpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlist

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-05 · updated 2026-06-17
• Weakness: CWE-78

Description

OpenClaw versions prior to 2026.2.14 contain an arbitrary file read vulnerability in the exec-approvals allowlist validation that checks pre-expansion argv tokens but executes using real shell expansion. Attackers with authorization or through prompt-injection attacks can exploit safe binaries like head, tail, or grep with glob patterns or environment variables to disclose files readable by the gateway or node process when host execution is enabled in allowlist mode.

Affected products

• OpenClaw: before 2026.2.14 — fixed in 2026.2.14

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.14. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/77b89719d5b7e271f48b6f49e334a8b991468c3b
• https://github.com/openclaw/openclaw/security/advisories/GHSA-xvhf-x56f-2hpp
• https://www.vulncheck.com/advisories/openclaw-arbitrary-file-read-via-shell-expansion-in-safe-bins-allowlist

Get alerted when CVE-2026-28463 or the next vulnerability affects your stack