CVE-2026-28363

Summary

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as –compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as –compress-program was denied.

Affected Software

VendorProductVersion RangeStatus
OpenClawOpenClaw0 < 2026.2.23affected

Weaknesses

  • CWE-184: CWE-184 Incomplete List of Disallowed Inputs

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References