CVE-2026-28463

OpenClaw's exec-approvals allowlist supports a small set of "safe bins" intended to be stdin-only (no positional file arguments) when running tools.exec.host=gateway|node with security=allowlist.

In affected configurations, the allowlist validation checked pre-expansion argv tokens, but execution used a real shell (sh -c) which expands globs and environment variables. This allowed safe bins like head, tail, or grep to read arbitrary local files via tokens such as * or $HOME/... without triggering approvals.

This issue is configuration-dependent and is not exercised by default settings (default tools.exec.host is sandbox).

Affected Packages / Versions

• Package: openclaw (npm)
• Affected: <= 2026.2.13
• Patched: >= 2026.2.14 (planned; publish the advisory after the npm release is out)

Fix Commit(s)

• 77b89719d5b7e271f48b6f49e334a8b991468c3b

Release Process Note

patched_versions is pre-set for the next planned release (>= 2026.2.14) so publishing is a single click once that npm version is available.

Thanks @christos-eth for reporting.

An authorized but untrusted caller (or prompt-injection) could cause the gateway/node process to disclose files readable by that process when host execution is enabled in allowlist mode.

Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.

CVE-2026-28463 has a CVSS score of 5.7 (High). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2026.2.14); upgrading removes the vulnerable code path.

Kodem intelligence

Safe-bins executions now force argv tokens to be treated as literal text at execution time (single-quoted), preventing globbing and $VARS expansion from turning "safe" tokens into file paths.

1. What is CVE-2026-28463? CVE-2026-28463 is a high-severity OS command injection vulnerability in openclaw (npm), affecting versions < 2026.2.14. It is fixed in 2026.2.14. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
2. How severe is CVE-2026-28463? CVE-2026-28463 has a CVSS score of 5.7 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of openclaw are affected by CVE-2026-28463? openclaw (npm) versions < 2026.2.14 is affected.
4. Is there a fix for CVE-2026-28463? Yes. CVE-2026-28463 is fixed in 2026.2.14. Upgrade to this version or later.
5. Is CVE-2026-28463 exploitable, and should I be worried? Whether CVE-2026-28463 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-28463 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-28463? Upgrade openclaw to 2026.2.14 or later.