CVE-2026-44115: OpenClaw RCE Vulnerability Explained

CVE-2026-44115 Overview

CVE-2026-44115 affects OpenClaw versions before 2026.4.22. The flaw resides in the exec allowlist analysis routine, which fails to inspect shell expansion tokens embedded in unquoted heredoc bodies. Attackers with low-privileged access can smuggle expansion sequences past the allowlist validator and execute unapproved commands at runtime. The issue maps to [CWE-184: Incomplete List of Disallowed Inputs] and exposes confidentiality, integrity, and availability of the host running OpenClaw.

Critical Impact
Authenticated attackers can bypass command allowlist enforcement and achieve arbitrary command execution by hiding shell expansion inside unquoted heredoc bodies.

Affected Products

OpenClaw versions prior to 2026.4.22
Deployments relying on OpenClaw's exec allowlist as a security boundary
Automation pipelines that pass user-influenced heredoc content to OpenClaw exec routines

Discovery Timeline

2026-05-06 - CVE-2026-44115 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-44115

Vulnerability Analysis

OpenClaw enforces command execution policy through an allowlist analyzer that inspects exec invocations before they run. The analyzer parses the command surface to confirm only approved binaries and arguments reach the shell. Versions before 2026.4.22 skip deep inspection of heredoc bodies when the heredoc delimiter is unquoted. Unquoted heredocs in POSIX shells perform parameter expansion, command substitution, and arithmetic expansion on the body before the data reaches the target process. An attacker can place expansion tokens such as $(...) or backticks inside the heredoc body to invoke commands not present in the allowlist. The analyzer treats the body as static data and approves the call, while the shell expands the tokens at runtime.

Root Cause

The root cause is incomplete denylist and allowlist coverage during static analysis of shell constructs. The validator distinguishes quoted from unquoted heredocs but does not scan unquoted bodies for expansion metacharacters. This gap fits the [CWE-184] pattern, where the protective list omits dangerous inputs that the underlying interpreter still processes.

Attack Vector

Exploitation requires network access and low-privileged authentication to a component that submits exec requests to OpenClaw. The attacker crafts a payload containing an unquoted heredoc whose body embeds shell expansion tokens that resolve to disallowed commands. OpenClaw approves the request because the visible command matches the allowlist. The shell then evaluates the expansion and runs attacker-chosen commands with the privileges of the OpenClaw exec context.

No verified exploit code is currently published. Refer to the GitHub Security Advisory GHSA-x3h8-jrgh-p8jx and the VulnCheck Advisory for protocol-level detail.

Detection Methods for CVE-2026-44115

Indicators of Compromise

Exec audit logs containing heredoc operators (<<, <<-) followed by unquoted delimiters in submitted commands
Presence of expansion tokens such as $(, backticks, or ${ inside heredoc bodies passed to OpenClaw
Child processes spawned by OpenClaw exec routines that do not match the configured allowlist
Unexpected outbound network connections or file writes initiated by OpenClaw worker processes

Detection Strategies

Parse OpenClaw exec request logs for heredoc constructs and flag bodies containing shell metacharacters
Compare the post-expansion process tree against the documented allowlist and alert on divergence
Apply integrity checks to OpenClaw binaries and confirm the running version is at or above 2026.4.22

Monitoring Recommendations

Forward OpenClaw audit and process telemetry to a centralized analytics platform with retention sufficient for incident review
Baseline normal exec patterns per service account and alert on new command lineages from OpenClaw
Track failed allowlist matches alongside successful approvals to identify probing of the validator

How to Mitigate CVE-2026-44115

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.22 or later as published in the upstream commit b2e8b7d
Audit recent exec submissions for heredoc payloads containing expansion tokens
Restrict OpenClaw service privileges to the minimum required for legitimate workloads

Patch Information

The fix is included in OpenClaw 2026.4.22. The corrective change is documented in commit b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5 and described in GHSA-x3h8-jrgh-p8jx. Apply the upgrade across all OpenClaw nodes and restart dependent services to load the patched analyzer.

Workarounds

Reject any exec input that contains heredoc operators until the patch is deployed
Force callers to use quoted heredoc delimiters, which suppress shell expansion in the body
Run OpenClaw under a constrained shell or sandbox that disables command substitution and parameter expansion

bash

# Configuration example
# Block heredoc constructs at the input layer until upgrade is complete
if printf '%s' "$REQUEST" | grep -Eq '<<-?[[:space:]]*[A-Za-z_]'; then
  echo "rejected: heredoc not permitted" >&2
  exit 1
fi