CVE-2026-28466: OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass

Q: What is the severity of CVE-2026-28466?

CVE-2026-28466 is classified as a high-severity vulnerability due to the potential for remote code execution.

Q: How do I fix CVE-2026-28466?

To fix CVE-2026-28466, update OpenClaw to version 2026.2.14 or later.

Q: What is the impact of CVE-2026-28466?

The impact of CVE-2026-28466 allows authenticated users to bypass execution approval, which may lead to unauthorized code execution.

Q: What versions of OpenClaw are affected by CVE-2026-28466?

OpenClaw versions prior to 2026.2.14 are affected by CVE-2026-28466.

Q: Who is vulnerable to CVE-2026-28466?

Authenticated clients utilizing OpenClaw versions earlier than 2026.2.14 are vulnerable to CVE-2026-28466.

Published Mar 5, 2026

Updated

OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run commands. Attackers with valid gateway credentials can inject approval control fields to execute arbitrary commands on connected node hosts, potentially compromising developer workstations and CI runners.

Affected Software

2 affected components

OpenClaw OpenClaw<2026.2.14

OpenClaw Openclaw Node.js<2026.2.14

Remediation

Patch Available

https://github.com/openclaw/openclaw/commit/0af76f5f0e93540efbdf054895216c398692afcd

Event History

Mar 5, 2026

CVE Published

via MITRE·09:59 PM

Data Sourced

via MITRE·09:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Dec 1, 58158

Event

via FIRST·05:14 PM

Frequently Asked Questions

What is the severity of CVE-2026-28466?

CVE-2026-28466 is classified as a high-severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2026-28466?