CVE-2026-28363 — In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed…¶

Key facts

CVE-2026-28363 is a Critical (9.9) vulnerability: In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-28363
Severity	Critical (9.9)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-28363/

Details¶

CVE-2026-28363 is a Critical (9.9) vulnerability: In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-28363
CVSS Score	9.9

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-28363/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-28363

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/security/advisories/GHSA-3c6h-g97w-fg78

Generated by PoC Generator on 2026-04-10T16:08:41.532782176

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-28363, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-28363 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-28363 OpenClaw tools.exec.safeBins validation bypass attempt via GNU long-option abbreviation"; content:"sort"; content:"--compress-prog"; distance:0; within:50; classtype:attempted-admin; priority:2; sid:1000000; rev:1;)

alert tcp any any -> any any (msg:"CVE-2026-28363 OpenClaw GNU long-option abbreviation bypass attempt"; content:"tools.exec"; content:"--compress-prog"; distance:0; within:100; classtype:policy-violation; priority:2; sid:1000001; rev:1;)

alert tcp any any -> any any (msg:"CVE-2026-28363 OpenClaw safeBins validation bypass via abbreviated options"; content:"safeBins"; content:"--compress-prog"; distance:0; within:200; classtype:attempted-admin; priority:2; sid:1000002; rev:1;)

alert tcp any any -> any any (msg:"CVE-2026-28363 OpenClaw sort command with suspicious GNU option abbreviation"; content:"sort"; pcre:"/--compress-prog(?!ram)/i"; classtype:attempted-admin; priority:2; sid:1000003; rev:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_28363_OpenClaw_SafeBins_Bypass {
    meta:
        author = "Security Engineer"
        description = "Detects exploitation attempts for CVE-2026-28363 - OpenClaw tools.exec.safeBins validation bypass via GNU long-option abbreviations"
        cve = "CVE-2026-28363"
        date = "2024-01-15"
        reference = "OpenClaw safeBins validation bypass"
        severity = "high"

    strings:
        $sort_cmd = "sort" nocase
        $compress_prog_abbrev1 = "--compress-prog" nocase
        $compress_prog_abbrev2 = "--compress-pr" nocase
        $compress_prog_abbrev3 = "--compress-p" nocase
        $compress_prog_full = "--compress-program" nocase
        $openclaw_ref1 = "tools.exec.safeBins" nocase
        $openclaw_ref2 = "allowlist" nocase
        $gnu_long_option = /--[a-z\-]{3,20}/ nocase
        $exec_pattern = /exec\(.*sort.*--compress-prog/ nocase
        $bypass_pattern = /safeBins.*bypass|validation.*bypass/ nocase

    condition:
        (
            ($sort_cmd and any of ($compress_prog_abbrev*)) or
            ($sort_cmd and $gnu_long_option) or
            $exec_pattern or
            ($openclaw_ref1 and ($compress_prog_abbrev1 or $compress_prog_abbrev2 or $compress_prog_abbrev3))
        ) and not $compress_prog_full
}

rule CVE_2026_28363_OpenClaw_Memory_Indicators {
    meta:
        author = "Security Engineer"
        description = "Memory-based indicators for CVE-2026-28363 OpenClaw exploitation"
        cve = "CVE-2026-28363"
        date = "2024-01-15"
        reference = "OpenClaw memory artifacts"
        severity = "medium"

    strings:
        $mem_pattern1 = { 2D 2D 63 6F 6D 70 72 65 73 73 2D 70 72 6F 67 } // --compress-prog
        $mem_pattern2 = { 2D 2D 63 6F 6D 70 72 65 73 73 2D 70 72 } // --compress-pr
        $mem_pattern3 = { 2D 2D 63 6F 6D 70 72 65 73 73 2D 70 } // --compress-p
        $tools_exec = "tools.exec.safeBins"
        $sort_exec = /sort\s+--[a-z\-]+/
        $approval_bypass = "approval-free execution"

    condition:
        any of ($mem_pattern*) or
        ($tools_exec and $sort_exec) or
        $approval_bypass
}

rule CVE_2026_28363_OpenClaw_Config_Artifacts {
    meta:
        author = "Security Engineer"
        description = "Configuration file artifacts related to CVE-2026-28363"
        cve = "CVE-2026-28363"
        date = "2024-01-15"
        reference = "OpenClaw configuration bypass"
        severity = "medium"

    strings:
        $config_safebins = "safeBins"
        $config_allowlist = "allowlist"
        $config_sort = "sort"
        $version_vulnerable = /OpenClaw.*202[0-5]|OpenClaw.*2026\.[01]\./
        $bypass_comment = /bypass.*validation|validation.*bypass/

    condition:
        ($config_safebins and $config_allowlist and $config_sort) or
        $version_vulnerable or
        $bypass_comment
}

:material-file-download: prevention/yara.yar

# CVE-2026-28363: OpenClaw tools.exec.safeBins bypass prevention
# Block GNU long-option abbreviations that could bypass validation

location / {
    # Block requests containing GNU long-option abbreviations for compress-program
    if ($request_uri ~* "compress-prog(?!ram\b)") {
        return 403;
    }

    # Block partial GNU long-option matches that could bypass validation
    if ($args ~* "(^|&)(compress-prog[^=&]*)(=|&|$)") {
        return 403;
    }

    # Block POST body containing abbreviated compress options
    if ($request_body ~* "compress-prog(?!ram\b)") {
        return 403;
    }

    # Block other common GNU long-option abbreviation patterns
    if ($request_uri ~* "(sort|exec|safe).*(--[a-z]+-[a-z]+[^-\s=&]*(?![a-z-]))") {
        return 403;
    }

    # Block requests with partial option matches in query parameters
    if ($args ~* "(^|&)(sort|exec|safe)[^=&]*=(.*--[a-z]+-[a-z]+[^-\s=&]*(?![a-z-]))") {
        return 403;
    }

    # Block requests targeting tools.exec endpoints with suspicious parameters
    if ($request_uri ~* "/(tools|exec|safe)" && $args ~* "--[a-z]+-[a-z]+[^-\s=&]*(?![a-z-])") {
        return 403;
    }

    # Add security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
}

# Specific protection for OpenClaw tools endpoints
location ~* ^/(api/)?tools/(exec|safe) {
    # Block any abbreviated GNU long options
    if ($request_body ~* "--[a-z]+-[a-z]+[a-z]*(?![a-z-])") {
        return 403;
    }

    # Block compress-program abbreviations specifically
    if ($request_body ~* "compress-prog[a-z]*(?!ram\b)") {
        return 403;
    }

    # Block query parameters with option abbreviations
    if ($args ~* "--[a-z]+-[a-z]+[a-z]*(?![a-z-])") {
        return 403;
    }

    # Block JSON payloads containing abbreviated options
    if ($request_body ~* '"[^"]*--[a-z]+-[a-z]+[a-z]*(?![a-z-])[^"]*"') {
        return 403;
    }
}

# Block file upload attempts with malicious option names
location ~* ^/(upload|file) {
    if ($request_body ~* "filename.*--[a-z]+-[a-z]+[a-z]*(?![a-z-])") {
        return 403;
    }
}

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-28363 - OpenClaw tools.exec.safeBins bypass
# Prevents exploitation of GNU long-option abbreviations bypass

# Rule 1000000: Block requests containing OpenClaw tool execution patterns with GNU long options
SecRule ARGS "@detectXSS" \
    "id:1000000,\
    phase:2,\
    block,\
    msg:'CVE-2026-28363: OpenClaw tools.exec.safeBins bypass attempt detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:CRITICAL,\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-command-injection',\
    tag:'CVE-2026-28363',\
    chain"
SecRule ARGS "@rx (?:tools\.exec|safeBins|sort).*--(?:compress-prog|comp|output|o\b|field-separator|t\b)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"

# Rule 1000001: Detect GNU long-option abbreviations in command parameters
SecRule REQUEST_BODY|ARGS|ARGS_NAMES "@rx --[a-z-]{3,20}(?:prog|sep|out|field)" \
    "id:1000001,\
    phase:2,\
    block,\
    msg:'CVE-2026-28363: Suspicious GNU long-option abbreviation detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:HIGH,\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-command-injection',\
    tag:'CVE-2026-28363'"

# Rule 1000002: Block OpenClaw execution contexts with compressed program options
SecRule REQUEST_URI|REQUEST_BODY|ARGS "@rx (?i)openclaw.*(?:exec|safebins).*sort.*--(?:compress|output|field)" \
    "id:1000002,\
    phase:2,\
    block,\
    msg:'CVE-2026-28363: OpenClaw execution with dangerous sort options',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:CRITICAL,\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-command-injection',\
    tag:'CVE-2026-28363'"

# Rule 1000003: Detect allowlist bypass patterns with partial option matching
SecRule ARGS "@rx (?:allowlist|whitelist).*--[a-z-]{4,15}(?:prog|program|sep|separator|out|output)" \
    "id:1000003,\
    phase:2,\
    block,\
    msg:'CVE-2026-28363: Allowlist bypass attempt via partial option matching',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:HIGH,\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-command-injection',\
    tag:'CVE-2026-28363'"

# Rule 1000004: Block common GNU sort option abbreviations that could bypass validation
SecRule REQUEST_BODY|ARGS "@rx --(?:comp|compress-p|field-s|output-d|temp-d)" \
    "id:1000004,\
    phase:2,\
    block,\
    msg:'CVE-2026-28363: Dangerous GNU sort option abbreviation detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:MEDIUM,\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-command-injection',\
    tag:'CVE-2026-28363'"

# Rule 1000005: Monitor for approval-free execution indicators
SecRule REQUEST_URI|REQUEST_BODY|ARGS "@rx (?i)(?:approval.?free|bypass.?approval|exec.*without.*approval)" \
    "id:1000005,\
    phase:2,\
    block,\
    msg:'CVE-2026-28363: Approval bypass execution attempt',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:HIGH,\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-command-injection',\
    tag:'CVE-2026-28363'"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-28363?¶

CVE-2026-28363 is a Critical (9.9) vulnerability: In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-28363?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-28363?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.