CVE-2026-28460: OpenClaw allowlist bypass enables OS

CISO Take

CVE-2026-28460 is an allowlist bypass in OpenClaw's system.run function, exploitable by any authenticated low-privilege user — an attacker injects shell line-continuation characters ($\ followed by a newline and opening parenthesis inside double quotes) to fold the payload into executable command substitution that OpenClaw's security analysis never flags as non-allowlisted. The EPSS score places this in the top 65th percentile for exploitation likelihood, attack complexity is low, and no user interaction is required; with CVSS I:H the integrity of the underlying host is fully at stake for any API-exposed OpenClaw deployment. OpenClaw agents typically run with elevated OS privileges in automated AI pipelines, so a successful bypass can enable credential theft, lateral movement, or persistent modification of agent tool configurations. Upgrade immediately to OpenClaw 2026.2.22 (patch commit 3f0b9dbb); if patching is blocked, restrict system.run access to trusted callers only and alert on $\ followed by newline sequences in incoming inputs.

Sources: NVD EPSS CISA KEV GitHub Advisory ATLAS VulnCheck

What is the risk?

High risk for any AI agent deployment relying on OpenClaw's system.run allowlist as its primary security boundary. CVSS 7.1 with low attack complexity and no user interaction required makes exploitation straightforward for any authenticated attacker who can submit inputs to the agent. The package's 396 historical CVEs signal a persistent pattern of security issues. While blast radius is limited to 4 direct dependents, AI agent frameworks commonly operate with elevated OS privileges in automated pipelines, amplifying effective impact beyond the CVSS score suggests. No public exploit is confirmed and the CVE is absent from CISA KEV, but the shell obfuscation technique is replicable by any attacker familiar with shell metacharacter handling — no AI/ML knowledge required.

How does the attack unfold?

Initial Access

Attacker authenticates to an OpenClaw API endpoint using valid low-privilege credentials, gaining the ability to submit inputs to system.run.

AML.T0012

Payload Crafting

Attacker constructs a system.run input embedding $\ followed by a newline and ( inside double quotes to hide a non-allowlisted command from OpenClaw's static security analysis.

AML.T0050

Allowlist Evasion

OpenClaw's security analysis evaluates the obfuscated input against the allowlist, fails to model shell line-continuation folding, and approves the payload as compliant.

AML.T0107

Command Execution & Impact

The shell runtime folds the line continuation and executes the embedded command substitution, granting the attacker arbitrary OS-level code execution within the agent's privileged runtime context.

AML.T0053

Initial Access

Attacker authenticates to an OpenClaw API endpoint using valid low-privilege credentials, gaining the ability to submit inputs to system.run.

AML.T0012

Payload Crafting

Attacker constructs a system.run input embedding $\ followed by a newline and ( inside double quotes to hide a non-allowlisted command from OpenClaw's static security analysis.

AML.T0050

Allowlist Evasion

OpenClaw's security analysis evaluates the obfuscated input against the allowlist, fails to model shell line-continuation folding, and approves the payload as compliant.

AML.T0107

Command Execution & Impact

The shell runtime folds the line continuation and executes the embedded command substitution, granting the attacker arbitrary OS-level code execution within the agent's privileged runtime context.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

5 steps

Upgrade to OpenClaw 2026.2.22 or later — the definitive fix is patch commit 3f0b9dbb36c86e308267924c0d3d4a4e1fc4d1e9.
If patching is delayed, implement input validation at the system.run boundary that rejects inputs containing $\ followed by whitespace or newlines inside quoted strings.
Run OpenClaw agents under a dedicated low-privilege OS account with filesystem ACLs to limit damage radius.
Monitor agent execution logs for command substitution patterns ($(...) or backtick sequences) appearing in approved commands post-execution.
Audit all callers of system.run to verify they do not accept untrusted external input without sanitization prior to passing it to the function.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0105 - Escape to Host AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2.3 - Controls for AI system security

NIST AI RMF

GOVERN 6.2 - Organizational risk and cybersecurity policies

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-28460?

CVE-2026-28460 is an allowlist bypass in OpenClaw's system.run function, exploitable by any authenticated low-privilege user — an attacker injects shell line-continuation characters ($\ followed by a newline and opening parenthesis inside double quotes) to fold the payload into executable command substitution that OpenClaw's security analysis never flags as non-allowlisted. The EPSS score places this in the top 65th percentile for exploitation likelihood, attack complexity is low, and no user interaction is required; with CVSS I:H the integrity of the underlying host is fully at stake for any API-exposed OpenClaw deployment. OpenClaw agents typically run with elevated OS privileges in automated AI pipelines, so a successful bypass can enable credential theft, lateral movement, or persistent modification of agent tool configurations. Upgrade immediately to OpenClaw 2026.2.22 (patch commit 3f0b9dbb); if patching is blocked, restrict system.run access to trusted callers only and alert on $\ followed by newline sequences in incoming inputs.

Is CVE-2026-28460 actively exploited?

No confirmed active exploitation of CVE-2026-28460 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-28460?

1. Upgrade to OpenClaw 2026.2.22 or later — the definitive fix is patch commit 3f0b9dbb36c86e308267924c0d3d4a4e1fc4d1e9. 2. If patching is delayed, implement input validation at the system.run boundary that rejects inputs containing $\ followed by whitespace or newlines inside quoted strings. 3. Run OpenClaw agents under a dedicated low-privilege OS account with filesystem ACLs to limit damage radius. 4. Monitor agent execution logs for command substitution patterns ($(...) or backtick sequences) appearing in approved commands post-execution. 5. Audit all callers of system.run to verify they do not accept untrusted external input without sanitization prior to passing it to the function.

What systems are affected by CVE-2026-28460?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration, automated pipeline execution, multi-agent systems.

What is the CVSS score for CVE-2026-28460?

CVE-2026-28460 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent orchestrationautomated pipeline executionmulti-agent systems

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0105 Escape to Host

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.3

NIST AI RMF: GOVERN 6.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by splitting command substitution using shell line-continuation characters. Attackers can bypass security analysis by injecting $\\ followed by a newline and opening parenthesis inside double quotes, causing the shell to fold the line continuation into executable command substitution that circumvents approval boundaries.

Exploitation Scenario

An attacker with a low-privilege OpenClaw API account submits a crafted system.run payload embedding $\ followed by a newline and ( inside a double-quoted argument of an otherwise allowlisted command. OpenClaw's static security analysis tokenizes the input, evaluates it against the allowlist, and approves it because the analysis does not model shell line-continuation folding. The shell runtime processes the payload, folds the line continuation, and executes the embedded command substitution as arbitrary OS commands. In an AI agent pipeline context this is immediately leveraged to exfiltrate environment variables containing secrets (ANTHROPIC_API_KEY, STRIPE_SECRET_KEY, database connection strings), pivot to backend infrastructure accessible from the agent host, or overwrite agent tool definitions to persist malicious behavior across future sessions — directly mirroring the OpenClaw skills ecosystem abuse documented in AIID #1368.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.