CVE-2026-28460: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28460 is an allowlist bypass vulnerability in OpenClaw's system.run functionality that allows authenticated attackers with low privileges to execute non-allowlisted OS commands by exploiting shell line-continuation characters. It affects all OpenClaw (npm package) versions up to and including 2026.2.21-2, with the fix introduced in version 2026.2.22. The vulnerability was published on March 19, 2026, and was originally reported by researcher tdjackey. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-863 (Incorrect Authorization). When OpenClaw operates in tools.exec.security=allowlist mode, its shell-wrapper analysis statically inspects commands to determine if they are allowlisted before execution. An attacker can craft a payload using $\ followed by a newline character and an opening parenthesis ( inside double-quoted strings — a sequence the shell interprets as command substitution $(...) at runtime after folding the line continuation. The static analyzer treats the payload as matching an allowlisted command (e.g., /bin/echo), while the shell runtime executes the injected subcommand. The fix in commit 3f0b9dbb adds a hasShellLineContinuation check that immediately fails allowlist analysis for any command containing backslash-newline sequences, and also blocks escaped newlines inside double-quoted contexts during pipeline splitting (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated low-privileged user to execute arbitrary OS commands that should have been blocked by the allowlist security control, resulting in high integrity impact and low availability impact on the affected system. Confidentiality impact is rated as none in the CVSS scoring, though the ability to run arbitrary commands could indirectly enable data access depending on the deployment context. The vulnerability is scoped to the affected system and does not directly impact other systems, but unauthorized command execution could serve as a stepping stone for lateral movement or privilege escalation in broader environments (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.041%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with low privileges and the target deployment must have tools.exec.security=allowlist configured with ask=on-miss or ask=off (Feedly, GitHub Advisory).

1. Identify target configuration: Confirm the target OpenClaw instance is running a version ≤2026.2.21-2 with tools.exec.security=allowlist and ask=on-miss or ask=off, which enables the vulnerable allowlist enforcement path.
2. Craft the bypass payload: Construct a command that appears allowlisted to the static analyzer but contains a shell line-continuation sequence. For example: echo "ok $\ (id -u)" — the analyzer sees /bin/echo as the command, while the shell runtime interprets $\ ( as $( and executes id -u as a subcommand.
3. Submit the command via system.run: Invoke the system.run API or tool interface with the crafted payload. The allowlist analysis passes because the line-continuation folds the token boundary in a way the static parser does not detect.
4. Achieve non-allowlisted command execution: The shell runtime executes the injected subcommand (e.g., id -u, or a more impactful command), bypassing the approval boundary and achieving unauthorized OS command execution (GitHub Advisory, Patch Commit).

• Logs: OpenClaw exec event logs showing commands containing backslash-newline sequences ($\ () or unusual subcommand patterns within double-quoted arguments; exec.denied events that were unexpectedly followed by successful execution may indicate bypass attempts.
• Process: Unexpected child processes spawned by the OpenClaw Node.js process that do not correspond to allowlisted binaries (e.g., id, whoami, curl, bash) with unusual argument patterns.
• Network: Outbound connections from the OpenClaw host to unexpected external IPs or domains initiated by processes spawned through system.run, particularly if the OpenClaw process is not expected to initiate such connections.
• File System: Unexpected files created or modified in directories writable by the OpenClaw service account, potentially resulting from injected commands writing output or dropping payloads.

Upgrade OpenClaw (npm package) to version 2026.2.22 or later, which blocks all commands containing shell line-continuation characters (\ followed by newline) from passing allowlist analysis (Patch Commit). For deployments where immediate patching is not possible, set tools.exec.ask=always to require explicit user approval for every command, or set tools.exec.security=deny to block all system.run execution entirely (GitHub Advisory). Additionally, restrict network access to OpenClaw systems and enforce the principle of least privilege for user accounts to reduce the attack surface.

The OpenClaw vendor published a blog post titled "OpenClaw CVE Flood: Nine Vulnerabilities, Four Days, March 2026," acknowledging this and related vulnerabilities disclosed in the same period (OpenClaw Blog). A Reddit thread in the r/openclaw community discussed concerns about the "allow always" feature in OpenClaw, reflecting user anxiety about the security implications of the allowlist mechanism (Reddit). Community coverage was primarily limited to automated CVE aggregators and security news feeds, with no major independent researcher commentary identified.