CVE-2026-28391 in OpenClaw
요약
\~에 의해 MITRE • 2026. 03. 06.
OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings with shell metacharacters like & or %...% to execute unapproved commands beyond the allowlisted operations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.