Vulnerability intelligence
CVE-2026-44115
OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.
CVSS Score
8.8
High
EPSS — Exploit Probability
0.4%
Riskier than 29% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
3 articles across 3 outlets · first covered May 15, 2026 · latest May 18, 2026
Coverage timeline
-
OpenClaw bugs enable full system takeover via chained exploitswww.darkreading.com · May 18, 2026
-
‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Deliverywww.securityweek.com · May 18, 2026
-
OpenClaw chain lets attackers hijack config and steal datathehackernews.com · May 15, 2026