CVE-2026-28391: OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating

Severity: Critical

CVSS Score: 9.2

OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests, allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings with shell metacharacters like & or %...% to execute unapproved commands beyond the allowlisted operations.