CVE-2026-28363: 
MinimOS vulnerability analysis and mitigation

CVE-2026-28363 is a validation bypass vulnerability in OpenClaw (npm package) that allows authenticated low-privilege attackers to circumvent the tools.exec.safeBins approval mechanism for the sort command using GNU long-option abbreviations. Affected versions are all releases before 2026.2.23 (≤ 2026.2.22-2). The vulnerability was published on February 27, 2026, with the fix released the same day. CVSS v3.1 base scores vary by source: 8.8 (High) per the vendor advisory and NVD, and 9.9 (Critical) per the GitHub Advisory Database and ENISA EUVD, reflecting differing scope assessments (GitHub Advisory, Vendor Advisory).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs) and CWE-863 (Incorrect Authorization). When tools.exec.security=allowlist, tools.exec.ask=on-miss, and tools.exec.safeBins includes sort, the validation logic matched denied flags only by exact string comparison — for example, --compress-program was blocked, but the abbreviated form --compress-prog was not. GNU sort accepts long-option prefix abbreviations as valid, so an attacker could supply an abbreviated option (e.g., --compress-prog=<malicious_binary>) that bypasses the denylist check and is treated as a safe-bin invocation, skipping the required approval step entirely. The fix (commit 3b8e33037ae2e12af7beb56fcf0346f1f8cbde6f) changes long-option handling to fail closed on unknown or abbreviated options rather than accepting them (Vendor Advisory, GitHub Advisory).

Successful exploitation allows an authenticated attacker with low privileges to execute commands through the sort tool that were explicitly designed to require approval before execution, effectively bypassing the OpenClaw approval control plane. This can result in high impact to confidentiality, integrity, and availability of the affected system, as arbitrary binaries can be invoked via the --compress-program argument to sort without triggering the approval workflow. In environments where OpenClaw agents operate with elevated system access, this bypass could enable lateral movement or data exfiltration (GitHub Advisory, Vendor Advisory).

Exploitation has been reported by cxsecurity.com, and a proof-of-concept reference exists at https://cxsecurity.com/issue/WLB-2026030004, though Feedly notes no confirmed public PoC code has been independently verified (Feedly). The EPSS score is approximately 0.048% (15th percentile), indicating a currently low but non-zero probability of exploitation in the wild within 30 days. No specific threat actor attribution or CISA KEV catalog listing has been identified for this CVE. Exploitation requires only low-privilege authenticated access and no user interaction, lowering the barrier for abuse in multi-tenant or shared OpenClaw deployments.

1. Reconnaissance: Identify OpenClaw npm installations running versions ≤ 2026.2.22-2 with tools.exec.security=allowlist, tools.exec.ask=on-miss, and sort listed in tools.exec.safeBins.
2. Authenticate: Obtain low-privilege authenticated access to the OpenClaw instance (e.g., via a standard user account).
3. Craft abbreviated option payload: Construct a sort invocation using a GNU long-option abbreviation such as --compress-prog=<path_to_malicious_binary> instead of the fully spelled-out --compress-program=<path> that would be denied.
4. Submit command: Pass the crafted sort command through the OpenClaw tool execution interface. The safeBins validation matches sort as an allowed binary and fails to recognize --compress-prog as a denied flag due to exact-string-only matching.
5. Achieve unauthorized execution: The abbreviated option is accepted and sort invokes the attacker-specified binary via --compress-prog, executing arbitrary code without triggering the approval workflow (Vendor Advisory, GitHub Advisory).

• Logs: OpenClaw execution logs showing sort invocations with --compress-prog or other abbreviated long-option forms (e.g., --compress-p, --compress-pr) rather than the full --compress-program; absence of expected approval request log entries for sort commands that include external binary references.
• Process: Unexpected child processes spawned by the OpenClaw agent process via sort, particularly processes corresponding to binaries not normally invoked in the environment; sort processes with --compress-program or abbreviated variants pointing to non-standard paths.
• File System: Presence of unusual binaries or scripts in directories referenced by --compress-prog arguments in OpenClaw execution history; new files created by processes spawned through the sort bypass.
• Network: Outbound network connections from the OpenClaw host to unexpected external IPs initiated by processes spawned through the sort tool execution path.

Upgrade OpenClaw (npm) to version 2026.2.23 or later, which contains the fix in commit 3b8e33037ae2e12af7beb56fcf0346f1f8cbde6f that changes long-option handling to fail closed on abbreviated or unknown options (Vendor Advisory). As an interim workaround, remove sort from tools.exec.safeBins or set tools.exec.security to a mode that does not rely on the allowlist validation until patching is possible. Additionally, audit execution logs for any historical sort invocations using abbreviated GNU long options that may indicate prior exploitation.

The vulnerability received coverage from security news outlets including The Hacker Wire and community blogs, with discussion on Reddit's r/cybersecurity framing it in the broader context of AI agent security as an emerging attack surface (Reddit). F5 Labs included it in their weekly threat bulletin for March 4, 2026 (F5 Labs). A dev.to post explored how the vulnerability illustrates risks of local AI agent architectures, and a follow-up article discussed lessons for building secure AI agent systems on AWS, reflecting growing community interest in agentic security controls.