Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by splitting command substitution using shell line-continuation characters. Attackers can bypass security analysis by injecting $\\ followed by a newline and opening parenthesis inside double quotes, causing the shell to fold the line continuation into executable command substitution that circumvents approval boundaries.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-19 | 3 | Disclosure1General2 |
| 2026-03-21 | 1 | Disclosure1 |
⚡ New CVE Alert: CVE-2026-28460 📊 Severity: 5.9 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-28460 #CVE-2026-28460 #CVE #Medium #CyberSecurity #InfoSec https://t.co/CmgS2JJdBb
Post summary
The tweet announces a new CVE (CVE‑2026‑28460) with a medium severity score and an unspecified affected product scope, but offers no technical or exploit details.
CVE Alert: CVE-2026-28460 - OpenClaw - OpenClaw - https://www.redpacketsecurity.com/cve-alert-cve-2026-28460-openclaw-openclaw/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-28460 #openclaw #
Post summary
The tweet is a concise CVE alert for CVE-2026-28460 in OpenClaw, offering only the vulnerability identifier and a link, with no further technical detail or evidence of exploitation.
CVE-2026-28460 OpenClaw http://System.Run Allowlist Bypass Vulnerability via Command Su... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28460 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The text references CVE‑2026‑28460 as an allowlist bypass vulnerability but provides no PoC, exploit details, or patch information beyond a link to a vulnerability database.
CVE-2026-28460 OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in http://system.run that allows attackers to execute non-allowlisted commands by splitting co… https://www.cve.org/CVERecord?id=CVE-2026-28460
Post summary
The text identifies CVE-2026-28460 as an allowlist bypass in OpenClaw's system.run, enabling execution of non-allowlisted commands via splitting, but provides no PoC, exploit, patch, or active exploitation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |