CVE-2026-28463: Openclaw Information Disclosure Flaw

CVE-2026-28463 Overview

CVE-2026-28463 is an arbitrary file read vulnerability in OpenClaw versions prior to 2026.2.14. The flaw resides in the exec-approvals allowlist validation, which inspects pre-expansion argv tokens but executes commands through real shell expansion. Attackers with authorization, or those leveraging prompt-injection attacks against the gateway, can invoke allowlisted binaries such as head, tail, or grep with glob patterns or environment variables. This mismatch between validation and execution discloses files readable by the gateway or node process when host execution runs in allowlist mode. The issue is tracked as [CWE-78] OS Command Injection.

Critical Impact
Authorized users or prompt-injection payloads can read arbitrary files accessible to the OpenClaw node process by abusing shell expansion in supposedly safe binaries.

Affected Products

OpenClaw versions prior to 2026.2.14
OpenClaw Node.js distributions running with host execution enabled
Deployments configured with exec-approvals allowlist mode

Discovery Timeline

2026-03-05 - CVE-2026-28463 published to NVD
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-28463

Vulnerability Analysis

The vulnerability stems from a validation-execution mismatch in OpenClaw's exec-approvals allowlist enforcement. The allowlist parser tokenizes the user-supplied command and inspects the raw argv tokens against the safe-binaries list. After validation, the same command string is handed to a real shell, which performs glob expansion and variable substitution before invocation. An attacker can pass arguments such as /etc/* or $HOME/.ssh/id_rsa, which appear inert during validation but resolve to sensitive files at execution time. Allowlisted read utilities then return file contents to the caller, producing arbitrary file disclosure within the privileges of the gateway or node process.

Root Cause

The root cause is asymmetric command parsing between the security boundary and the execution layer. The allowlist trusts pre-expansion tokens, while the spawned shell performs post-expansion resolution, breaking the assumption that validated arguments equal executed arguments.

Attack Vector

Exploitation requires either local authenticated access to the OpenClaw exec interface or a successful prompt-injection payload delivered to an AI agent that proxies commands through bash-tools. The attacker submits an allowlisted binary with shell metacharacters that expand to attacker-controlled paths.

typescript

// Patch excerpt: src/agents/bash-tools.exec-runtime.ts
export async function runExecProcess(opts: {
  command: string;
  // Execute this instead of `command` (which is kept for display/session/logging).
  // Used to sanitize safeBins execution while preserving the original user input.
  execCommand?: string;
  workdir: string;
  env: Record<string, string>;
  sandbox?: BashSandboxConfig;

Source: GitHub Commit 77b89719

The fix introduces a separate execCommand field and a buildSafeShellCommand helper in src/infra/exec-approvals.js, ensuring that the string sent to the shell is rebuilt from validated tokens rather than the original user input.

Detection Methods for CVE-2026-28463

Indicators of Compromise

Process events showing head, tail, cat, or grep invoked with glob characters (*, ?, [) targeting paths outside expected workdirs
Shell invocations from the OpenClaw node process referencing environment variables such as $HOME, $PWD, or $XDG_CONFIG_HOME in argument positions
Unexpected reads of /etc/passwd, /root/, ~/.ssh/, or cloud credential files originating from the OpenClaw service account

Detection Strategies

Audit OpenClaw exec session logs for commands containing shell metacharacters that passed allowlist validation
Correlate bash-tools execution telemetry with file access events on sensitive paths
Alert on prompt-injection patterns in upstream LLM interactions that produce subsequent safeBins invocations

Monitoring Recommendations

Enable verbose audit logging on the OpenClaw gateway and forward to a centralized log platform
Monitor process lineage from the node runtime for child shells executing read utilities with wildcard arguments
Track file-read syscalls scoped to the OpenClaw service identity using Linux auditd or eBPF-based sensors

How to Mitigate CVE-2026-28463

Immediate Actions Required

Upgrade OpenClaw to version 2026.2.14 or later, which introduces buildSafeShellCommand for sanitized execution
Disable host execution or allowlist mode in exec-approvals until the patch is applied
Rotate any credentials, tokens, or keys readable by the OpenClaw node process if exploitation is suspected

Patch Information

The fix is delivered in commit 77b89719d5b7e271f48b6f49e334a8b991468c3b and described in GHSA-xvhf-x56f-2hpp. The patch separates the displayed command from the sanitized execCommand actually passed to the shell, eliminating the validation-execution gap. Additional analysis is available in the VulnCheck Advisory on OpenClaw.

Workarounds

Run the OpenClaw node process under a dedicated low-privilege user with no read access to secrets, SSH keys, or configuration stores
Remove head, tail, grep, and similar read utilities from the safeBins allowlist until upgrade is complete
Restrict prompt-injection exposure by sanitizing untrusted LLM inputs before they reach bash-tools

bash

# Configuration example: minimal allowlist with host execution disabled
openclaw config set exec.hostExecution false
openclaw config set exec.allowlist.safeBins '[]'
openclaw config set exec.mode 'sandbox-only'