CVE-2026-28391: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28391 is an OS command injection vulnerability in OpenClaw (npm package) affecting all versions prior to 2026.2.2. On Windows nodes, exec requests were executed via cmd.exe /d /s /c, and the allowlist/approval-gating logic failed to account for Windows cmd.exe metacharacter behavior, allowing attackers to inject additional commands beyond what was allowlisted. This vulnerability only affects deployments that have opted into the non-default allowlist/approval-gated exec configuration on Windows nodes. It was published on March 5, 2026, with a patch released in version 2026.2.2. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-184 (Incomplete List of Disallowed Inputs). On Windows, OpenClaw's src/infra/node-shell.ts executed commands via cmd.exe /d /s /c <command>, but the allowlist analysis in src/infra/exec-approvals.ts did not model Windows cmd.exe metacharacter semantics. An attacker could craft a command string containing metacharacters such as & (command chaining), %...% or !...! (variable expansion), |, ^, or newlines that cmd.exe would interpret as additional operations, effectively bypassing the allowlist check. The fix (commit a7f4a53) introduces a WINDOWS_UNSUPPORTED_TOKENS set, a dedicated analyzeWindowsShellCommand function that rejects any such tokens, and avoids invoking cmd.exe entirely in allowlist mode by executing the parsed argv directly (GitHub Advisory, GitHub Commit).

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on Windows nodes running OpenClaw with allowlist-gated exec enabled, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive data, modify or delete files, install malware, or use the compromised node as a pivot point for lateral movement within the network. The scope is limited to Windows nodes with the non-default allowlist/approval-gating configuration enabled; default installations are not affected (GitHub Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0011 (0.11%), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. Exploitation requires the target to be running OpenClaw on Windows with the non-default allowlist/approval-gated exec mode enabled, which limits the attack surface (GitHub Advisory).

1. Reconnaissance: Identify OpenClaw deployments running on Windows nodes with allowlist/approval-gated exec mode enabled (non-default configuration). This may be discoverable via service banners, configuration files, or network scanning.
2. Craft malicious command string: Construct a command string that begins with an allowlisted operation (e.g., ping 127.0.0.1 -n 1) followed by a cmd.exe metacharacter such as & to chain an additional unapproved command (e.g., ping 127.0.0.1 -n 1 & whoami).
3. Submit exec request: Send the crafted command string as an exec request to the OpenClaw service. The allowlist analysis evaluates only the portion before the metacharacter and approves the request.
4. Achieve command execution: cmd.exe interprets the full string including the metacharacter, executing both the allowlisted command and the injected unapproved command (e.g., whoami, a reverse shell payload, or data exfiltration command) with the privileges of the OpenClaw service account (GitHub Advisory, GitHub Commit).

• Logs: OpenClaw exec request logs showing command strings containing Windows metacharacters (&, |, ^, %, !) alongside otherwise allowlisted commands; unexpected command execution results in application logs.
• Process: Unusual child processes spawned by the OpenClaw Node.js process on Windows (e.g., whoami.exe, powershell.exe, cmd.exe with unexpected arguments, net.exe, curl.exe) that are not part of normal allowlisted operations.
• Network: Unexpected outbound network connections from the OpenClaw host to unknown external IPs, particularly on non-standard ports, following exec request activity.
• File System: New or modified files in the OpenClaw working directory or system directories created by the OpenClaw service account; presence of scripts, batch files, or executables not associated with normal operations.

Upgrade OpenClaw (npm) to version 2026.2.2 or later, which hardens Windows allowlist enforcement by rejecting Windows shell metacharacters, treating cmd.exe invocations as not allowlist-safe, and executing parsed argv directly instead of via cmd.exe in allowlist mode. The patch is available via GitHub commit a7f4a53ce80c98ba1452eb90802d447fca9bf3d6. If immediate patching is not possible, restrict network access to OpenClaw services to trusted networks only, disable allowlist-gated exec requests on Windows nodes if not required, and monitor command execution logs for suspicious metacharacter usage (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher simecek and analyzed by stanislavfortaisle, with the fix credited to the OpenClaw maintainer steipete (GitHub Advisory). Social media discussion was observed on Mastodon and Infosec.exchange shortly after disclosure. The Belgium Centre for Cybersecurity (CCB) issued an advisory noting multiple critical vulnerabilities in OpenClaw alongside Nextcloud Talk plugin issues. A blog post on exploit-intel.com titled "CVE-2026-28391: OpenClaw Command Injection — The Day I Hacked Myself" provided additional community commentary on the vulnerability.