VYPR
← All advisories
Critical severity9.9NVD Advisory· Published Mar 5, 2026· Updated Jun 17, 2026

CVE-2026-28466

CVE-2026-28466

Description

OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run commands. Attackers with valid gateway credentials can inject approval control fields to execute arbitrary commands on connected node hosts, potentially compromising developer workstations and CI runners.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.2.142026.2.14

Affected products

3
  • OpenClaw/Openclaw2 versions
    cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.2.14
    • (no CPE)range: 0
  • ghsa-coords
    pkg:npm/openclaw
    Range: < 2026.2.14

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.