CVE-2026-28470

creationtimestamp| type| source ---|---|--- 2026-03-06 11:01:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf5xialel2f 2026-03-06 18:36:12+00:00| seen| https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-openclaws-nextcloud-talk-plugin-patch...

CVE-2026-28470

OpenClaw is affected in versions prior to 2026.2.2. The issue is an exec approvals allowlist bypass that lets an attacker run arbitrary commands by injecting command substitution syntax (unescaped $() or backticks) inside double-quoted strings, bypassing the allowlist protection. The vulnerabilit...