Security readout for executives and security teams
Plain-English summary
OpenClaw before 2026.2.23 has a critical validation flaw in its command safety controls. A low-privileged user may bypass approval checks for certain sort options, allowing execution paths that should have required approval. This is urgent for organizations using OpenClaw automation or tool execution features.
Executive priority
Prioritize remediation quickly if OpenClaw is used in automation, developer tooling, or environments handling sensitive data. The business risk is unauthorized execution that bypasses approval controls, potentially affecting data confidentiality, integrity, and service availability.
Technical view
The issue is CWE-184: incomplete list of disallowed inputs. In tools.exec.safeBins allowlist mode, validation for sort denied exact strings such as --compress-program but could be bypassed using GNU long-option abbreviations. CVSS 3.1 is 9.9, with network attack vector, low privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is likely limited to OpenClaw deployments before 2026.2.23 that use tools.exec.safeBins allowlist mode and allow users or workflows to influence sort arguments. The source bundle does not identify affected hosted services, package ecosystems, or downstream products.
Exploitation context
The CVSS vector indicates remote reachability with low privileges and no user interaction. The CVE is not listed as KEV in the provided data, and no cited source states active exploitation. Treat it as high-priority because it can bypass intended approval controls.
Researcher notes
The public description centers on GNU long-option abbreviation handling for sort inside tools.exec.safeBins validation. Do not assume broader command coverage without vendor evidence. The affected range is stated as OpenClaw before 2026.2.23; the bundle provides no exploit-in-the-wild confirmation.
Mitigation direction
- Upgrade OpenClaw to 2026.2.23 or later where applicable.
- Review the GitHub advisory for vendor-specific remediation guidance.
- Restrict access to tool execution features until remediation is complete.
- Review approval policies around tools.exec.safeBins allowlist mode.
Validation and detection
- Inventory OpenClaw instances and confirm versions are before or after 2026.2.23.
- Check whether tools.exec.safeBins allowlist mode is enabled.
- Identify workflows where users can influence sort arguments.
- Review execution and approval logs for unexpected sort-related activity.
- Confirm remediation by verifying the deployed OpenClaw version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-184: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28363 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3c6h-g97w-fg78CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incomplete List of Disallowed Inputs
Incomplete List of Disallowed Inputs represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.