CVE-2026-28466 Details

A remote code execution vulnerability has been identified in OpenClaw versions prior to 2026.2.14. The issue arises in the gateway's node.invoke parameters, where internal approval fields are not properly sanitized. This flaw allows authenticated clients to bypass execution approval for system.run commands. Attackers with valid gateway credentials can inject approval control fields to execute arbitrary commands on connected node hosts, potentially compromising developer workstations and continuous integration runners.

Users are advised to upgrade to OpenClaw version 2026.2.14 or later. After upgrading, the gateway will properly sanitize approval control fields before forwarding them to node hosts. Additionally, access to the gateway should be restricted to trusted networks and users, and gateway credentials should be rotated if there is a suspicion of exposure.