What is the CVSS score of CVE-2026-28470?

CVE-2026-28470 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-28470?

Within 24 hours: Inventory all systems running Openclaw and confirm versions; assess which systems are internet-facing or accessible to untrusted networks; establish incident response readiness. Within 7 days: Apply available vendor patch to all affected Openclaw instances in development and non-production environments first, then production during change windows. Within 30 days: Complete patch deployment across all systems; conduct post-patch validation; review access logs for indicators of exploitation or reconnaissance.

Openclaw CVE-2026-28470

CRITICAL

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-03-05 disclosure@vulncheck.com

GHSA-3hcm-ggvf-rch5

Authentication Bypass Openclaw

9.2

CVSS 4.0 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted command with embedded $() substitution
Exploit

Bypass exec approvals allowlist filter
Impact

Execute arbitrary commands on target system

Vulnerability Assessment

Weakness	CWE CWE-88 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Argument sanitization
Exploitation Conditions	OpenClaw exec approvals feature must be enabled. Attacker injects command substitution syntax ($() or backticks) within double-quoted strings to bypass the allowlist validation designed to restrict command execution.
Impact	CVSS 9.2.
Exploit ScenarioDerived	Bypass exec restrictions via argument injection.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Exec allowlist bypass in OpenClaw before 2026.2.2 via argument injection. Patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:06 CVSS 9.2

Exec allowlist bypass in OpenClaw.

RemediationAI

Update.

Affected Packages

npm openclaw fix: 2026.2.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-88.

Know when Openclaw gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch released

Mar 25, 2026 - 15:16 nvd

Patch available

CVE Published

Mar 05, 2026 - 22:16 nvd

CRITICAL 9.2

DescriptionCVE.org

OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the allowlist protection by embedding unescaped $() or backticks inside double-quoted strings to execute unauthorized commands.

Executive ViewAI

Why It Matters

A critical remote code execution vulnerability in Openclaw (CVE-2026-28470) allows unauthenticated attackers to execute arbitrary commands on affected systems with a 9.8 CVSS score. Any organization running Openclaw versions 2026.2.2 or earlier faces immediate risk of complete system compromise, data exfiltration, and operational disruption. Immediate patching is required to prevent potential breach.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 74% exploitable

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

Related Vulnerabilities in OpenClaw Multiple Security Vulnerabilities

View all 46

CVE-2026-29613 MEDIUM

CVE-2026-28475 MEDIUM

CVE-2026-28457 MEDIUM

6.1

CVE-2026-28453 HIGH

7.5

CVE-2026-28446 CRITICAL POC

CVE-2026-28394 MEDIUM

6.5

CVE-2026-28452 MEDIUM

5.5

CVE-2026-28450 MEDIUM

6.8

CVE-2026-28481 MEDIUM

6.5

CVE-2026-28467 MEDIUM POC

6.5

CVE-2026-29606 MEDIUM

6.5

CVE-2026-28474 CRITICAL

CVE-2026-28395 MEDIUM

6.3

CVE-2026-28480 MEDIUM POC

6.5

CVE-2026-28391 CRITICAL

CVE-2026-28448 HIGH POC

CVE-2026-28464 MEDIUM

5.9

CVE-2026-28466 CRITICAL

9.9

CVE-2026-28471 MEDIUM

5.3

CVE-2026-28473 HIGH

8.1

CVE-2026-28476 MEDIUM

CVE-2026-28486 MEDIUM

6.1

CVE-2026-29610 HIGH

8.8

CVE-2026-29612 MEDIUM

5.5

More in Openclaw

View all

CVE-2026-33579 CRITICAL Act Now POC

9.4 Mar 31

Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b

CVE-2026-32042 HIGH This Week POC

8.8 Mar 21

OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att

CVE-2026-32051 HIGH This Week POC

8.8 Mar 21

An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.

CVE-2026-25253 HIGH This Week POC

8.8 Feb 01

OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e

CVE-2026-32846 HIGH This Week POC

8.7 Mar 26

Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in

CVE-2026-53857 HIGH This Week POC

8.6 Jun 16

Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses

CVE-2026-100530 HIGH This Week POC

8.5 Sep 26

Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a

CVE-2026-32064 HIGH This Week POC

8.5 Mar 21

Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach

CVE-2026-32055 HIGH This Week POC

7.6 Mar 21

OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director

CVE-2026-32056 HIGH This Week POC

7.5 Mar 21

OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func

CVE-2026-32049 HIGH This Week POC

7.5 Mar 21

OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste

Same weakness CWE-88 – Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

View all

CVE-2016-10033 CRITICAL POC

9.8

CVE-2026-24061 CRITICAL POC

9.8

CVE-2026-86060 CRITICAL POC

9.2

CVE-2025-57791 MEDIUM POC

6.9

CVE-2018-17456 CRITICAL POC

9.8

CVE-2018-19518 HIGH POC

7.5

CVE-2025-70327 CRITICAL POC

9.8

CVE-2020-5792 HIGH POC

7.2

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

References

Advisories & patches

PATCH https://github.com/openclaw/openclaw/commit/d1ecb46076145deb188abcba8f0699709ea17198 ADVISORY https://github.com/openclaw/openclaw/security/advisories/GHSA-3hcm-ggvf-rch5 ADVISORY https://vuldb.com/?id.349397 REF https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-command-substitution-in-double-quotes

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back