OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies.
Date: 2026-05
Affected: openclaw/openclaw
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-44115
CWE: CWE-184
CWE-200
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.


Mitigations:

Architectural layers (MAESTRO):