---
id: CVE-2026-44115
title: >-
  OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec
  Allowlist
summary: >-
  OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability
  allowing shell expansion hiding in unquoted heredoc bodies. Attackers can
  bypass allowlist validation by embedding shell expansion tokens in heredoc
  bodies to ex…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-184
vendor: OpenClaw
product: OpenClaw
affected:
  - OpenClaw < 2026.4.22
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-05-07T12:37:49.388219Z'
published: '2026-05-06'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:17:42.176Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-44115'
references:
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx
    label: GitHub Security Advisory (GHSA-x3h8-jrgh-p8jx)
  - url: >-
      https://github.com/openclaw/openclaw/commit/b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-shell-expansion-bypass-in-unquoted-heredocs-via-exec-allowlist
    label: >-
      VulnCheck Advisory: OpenClaw < 2026.4.22 - Shell Expansion Bypass in
      Unquoted Heredocs via Exec Allowlist
tags:
  - cve.org
epss: 0.00606
epssPercentile: 0.46681
ingestedAt: '2026-09-24T15:45:56.730Z'
---

## Overview

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.

## Affected

- `OpenClaw < 2026.4.22`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.