CVE-2026-44115: OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlist

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-06 · updated 2026-06-17
Weakness: CWE-184

Description

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.

Affected products

OpenClaw: before 2026.4.22 — fixed in 2026.4.22

How to fix

Upgrade to a fixed version: OpenClaw 2026.4.22. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5
https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx
https://www.vulncheck.com/advisories/openclaw-shell-expansion-bypass-in-unquoted-heredocs-via-exec-allowlist

Get alerted when CVE-2026-44115 or the next vulnerability affects your stack