CVE-2026-28456: OpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling
OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths before passing them to dynamic import(), allowing code execution. An attacker with gateway configuration modification access can load and execute unintended local modules in the Node.js process.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28456?
CVE-2026-28456 has a high severity rating due to its potential for arbitrary code execution.
How do I fix CVE-2026-28456?
To fix CVE-2026-28456, upgrade OpenClaw to version 2026.2.14 or later.
What versions of OpenClaw are affected by CVE-2026-28456?
OpenClaw versions prior to 2026.2.14 are affected by CVE-2026-28456.
What type of vulnerability is CVE-2026-28456?
CVE-2026-28456 is classified as an arbitrary code execution vulnerability.
How does CVE-2026-28456 exploit the system?
CVE-2026-28456 exploits the system through insufficient constraints on hook module paths before dynamic imports.