CVE-2026-28463: OpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlist
OpenClaw versions prior to 2026.2.14 contain an arbitrary file read vulnerability in the exec-approvals allowlist validation that checks pre-expansion argv tokens but executes using real shell expansion. Attackers with authorization or through prompt-injection attacks can exploit safe binaries like head, tail, or grep with glob patterns or environment variables to disclose files readable by the gateway or node process when host execution is enabled in allowlist mode.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28463?
CVE-2026-28463 is classified as a high severity vulnerability due to its potential for arbitrary file read access.
How do I fix CVE-2026-28463?
To fix CVE-2026-28463, upgrade OpenClaw to version 2026.2.14 or later where the vulnerability has been addressed.
What are the main risks associated with CVE-2026-28463?
The main risks associated with CVE-2026-28463 include unauthorized access to sensitive local files through shell expansion.
Which versions of OpenClaw are affected by CVE-2026-28463?
OpenClaw versions prior to 2026.2.14 are affected by CVE-2026-28463.
What components of OpenClaw are vulnerable in CVE-2026-28463?
CVE-2026-28463 affects the exec-approvals allowlist validation checks in OpenClaw.