CVE-2026-28466 — OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it…¶

Key facts

CVE-2026-28466 is a Critical (9.9) vulnerability: OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-28466
Severity	Critical (9.9)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-28466/

Details¶

CVE-2026-28466 is a Critical (9.9) vulnerability: OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run commands. Attackers with valid gateway credentials can inject approval control fields to execute arbitrary commands on connected node hosts, potentially compromising developer workstations and CI runners.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-28466
CVSS Score	9.9

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-28466/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-28466

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/commit/0af76f5f0e93540efbdf054895216c398692afcd
https://github.com/openclaw/openclaw/commit/318379cdb8d045da0009b0051bd0e712e5c65e2d
https://github.com/openclaw/openclaw/commit/a7af646fdab124a7536998db6bd6ad567d2b06b0
https://github.com/openclaw/openclaw/commit/c1594627421f95b6bc4ad7c606657dc75b5ad0ce
https://github.com/openclaw/openclaw/security/advisories/GHSA-gv46-4xfq-jv58
https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-node-invoke-approval-bypass

Generated by PoC Generator on 2026-04-10T16:14:20.098187452

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-28466, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-28466 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-28466 OpenClaw gateway approval bypass attempt"; flow:established,to_server; content:"node.invoke"; content:"system.run"; content:"approval"; distance:0; within:200; pcre:"/approval[\"'\s]*[:=][\"'\s]*true/i"; classtype:attempted-admin; sid:1000000; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-28466 OpenClaw gateway injection via approval fields"; flow:established,to_server; content:"node.invoke"; content:"approval_status"; distance:0; within:100; content:"system.run"; distance:0; within:300; classtype:attempted-admin; sid:1000001; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-28466 OpenClaw gateway exec bypass with injected parameters"; flow:established,to_server; content:"gateway"; content:"node.invoke"; distance:0; within:50; pcre:"/[\"']approval[\"'][\"'\s]*[:=][\"'\s]*[\"']?(true|1|approved|bypass)[\"']?/i"; classtype:attempted-admin; sid:1000002; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-28466 OpenClaw system.run command execution via approval manipulation"; flow:established,to_server; content:"system.run"; content:"approved"; distance:0; within:150; content:"node.invoke"; distance:0; within:200; classtype:attempted-admin; sid:1000003; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-28466 OpenClaw gateway approval control field injection"; flow:established,to_server; pcre:"/node\.invoke.*approval[_-]?(control|override|bypass|status).*system\.run/si"; classtype:attempted-admin; sid:1000004; rev:1; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_28466_OpenClaw_Gateway_Bypass {
    meta:
        author = "Security Engineer"
        description = "Detects OpenClaw gateway approval bypass exploitation attempts (CVE-2026-28466)"
        cve = "CVE-2026-28466"
        severity = "high"
        date = "2024-12-19"
        reference = "OpenClaw gateway vulnerability allowing bypass of exec approval gating"

    strings:
        $api_endpoint1 = "node.invoke" ascii wide
        $api_endpoint2 = "/api/node/invoke" ascii wide
        $api_endpoint3 = "/gateway/node/invoke" ascii wide

        $approval_field1 = "approval_status" ascii wide nocase
        $approval_field2 = "_approved" ascii wide nocase
        $approval_field3 = "exec_approved" ascii wide nocase
        $approval_field4 = "bypass_approval" ascii wide nocase
        $approval_field5 = "__approval__" ascii wide nocase

        $system_command1 = "system.run" ascii wide
        $system_command2 = "\"cmd\":\"system.run\"" ascii wide
        $system_command3 = "'cmd':'system.run'" ascii wide

        $injection_pattern1 = /"[^"]*approval[^"]*":\s*(true|1|"approved")/ ascii wide nocase
        $injection_pattern2 = /'[^']*approval[^']*':\s*(true|1|'approved')/ ascii wide nocase
        $injection_pattern3 = /approval[_-]?(status|flag|check)["']?\s*[:=]\s*["']?(true|1|approved|bypass)/ ascii wide nocase

        $payload_structure1 = "{" ascii wide
        $payload_structure2 = "\"parameters\":" ascii wide
        $payload_structure3 = "\"command\":" ascii wide

        $hex_approval = { 61 70 70 72 6F 76 61 6C } // "approval"
        $hex_system_run = { 73 79 73 74 65 6D 2E 72 75 6E } // "system.run"

    condition:
        (
            any of ($api_endpoint*) and
            any of ($system_command*) and
            any of ($approval_field*)
        ) or
        (
            any of ($injection_pattern*) and
            any of ($system_command*)
        ) or
        (
            all of ($payload_structure*) and
            ($hex_approval and $hex_system_run)
        )
}

rule CVE_2026_28466_OpenClaw_Malicious_Payload {
    meta:
        author = "Security Engineer"
        description = "Detects malicious payloads targeting OpenClaw gateway approval bypass (CVE-2026-28466)"
        cve = "CVE-2026-28466"
        severity = "high"
        date = "2024-12-19"

    strings:
        $json_exploit1 = /\{\s*["']?parameters["']?\s*:\s*\{[^}]*["']?approval[^}]*["']?\s*:\s*["']?(true|approved|1)["']?[^}]*\}/ ascii wide nocase
        $json_exploit2 = /\{\s*["']?cmd["']?\s*:\s*["']?system\.run["']?[^}]*["']?approval[^}]*["']?\s*:\s*["']?(true|approved)["']?/ ascii wide nocase

        $suspicious_params1 = "__approval_override" ascii wide nocase
        $suspicious_params2 = "_internal_approved" ascii wide nocase
        $suspicious_params3 = "force_approval" ascii wide nocase
        $suspicious_params4 = "skip_approval_check" ascii wide nocase

        $command_injection1 = "system.run" ascii wide
        $command_injection2 = /system\.run.*[;&|`$]/ ascii wide
        $command_injection3 = /["']system\.run["'].*["'](cmd|powershell|bash|sh)/ ascii wide nocase

        $base64_payload = /([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?/ ascii wide

    condition:
        any of ($json_exploit*) or
        (
            any of ($suspicious_params*) and
            any of ($command_injection*)
        ) or
        (
            $base64_payload and
            any of ($command_injection*)
        )
}

rule CVE_2026_28466_OpenClaw_Network_Traffic {
    meta:
        author = "Security Engineer"
        description = "Detects network traffic patterns associated with OpenClaw gateway bypass attempts (CVE-2026-28466)"
        cve = "CVE-2026-28466"
        severity = "medium"
        date = "2024-12-19"

    strings:
        $http_header1 = "POST" ascii wide
        $http_header2 = "Content-Type: application/json" ascii wide nocase
        $http_header3 = "Authorization:" ascii wide nocase

        $openclaw_agent = "OpenClaw-Client" ascii wide nocase
        $openclaw_version = /OpenClaw\/[0-9]{4}\.[0-9]\.[0-9]{1,2}/ ascii wide

        $exploit_body = /\{\s*["']?(node|gateway)["']?\s*:\s*["']?invoke["']?/ ascii wide nocase
        $exploit_params = /"parameters":\s*\{[^}]*"approval[^}]*true/ ascii wide nocase

        $user_agent_suspicious = /User-Agent:.*curl|wget|python|powershell/ ascii wide nocase

    condition:
        (
            $http_header1 and $http_header2 and
            ($exploit_body or $exploit_params)
        ) or
        (
            any of ($openclaw_*) and
            $exploit_params
        ) or
        (
            $user_agent_suspicious and
            $exploit_body and $exploit_params
        )
}

:material-file-download: prevention/yara.yar

# Block OpenClaw gateway exploitation attempts - CVE-2026-28466
# Prevent manipulation of internal approval fields in node.invoke parameters

# Block requests containing suspicious node.invoke parameters
location ~* /gateway {
    # Block requests with approval control field manipulation
    if ($request_body ~* "node\.invoke.*approval[_-]?(status|state|bypass|override|skip)" ) {
        return 403;
    }

    # Block attempts to inject approval control in query parameters
    if ($query_string ~* "approval[_-]?(status|state|bypass|override|skip)" ) {
        return 403;
    }

    # Block system.run command execution attempts
    if ($request_body ~* "system\.run" ) {
        return 403;
    }

    # Block common approval bypass patterns
    if ($request_body ~* "(approved|execute|exec)[\"'\s]*:[\"'\s]*(true|1|yes)" ) {
        return 403;
    }

    # Block JSON injection patterns for approval fields
    if ($request_body ~* "[\{\,]\s*[\"']?(approval|exec|execute|bypass)[\"']?\s*:" ) {
        return 403;
    }

    # Security headers
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    proxy_pass http://backend;
}

# Additional protection for API endpoints
location ~* /(api|v[0-9]+)/gateway {
    # Block node.invoke with suspicious parameters
    if ($request_body ~* "node\.invoke.*\{.*approval.*\}" ) {
        return 403;
    }

    # Block URL encoded approval bypass attempts
    if ($request_body ~* "(node%2Einvoke|approval%5F|system%2Erun)" ) {
        return 403;
    }

    # Block base64 encoded payloads containing approval keywords
    if ($request_body ~* "([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?" ) {
        set $decoded_body "";
        # Note: Nginx cannot decode base64 natively, but we can block suspicious patterns
        if ($request_body ~* "(YXBwcm92|YXBwcm92YWw|ZXhlY3V0|c3lzdGVt)" ) {
            return 403;
        }
    }

    proxy_pass http://backend;
}

# Block direct node execution attempts
location ~* /node/(invoke|execute|run) {
    # Block all direct node execution endpoints
    if ($request_method = "POST") {
        return 403;
    }

    # Allow only GET requests for legitimate monitoring
    if ($request_method != "GET") {
        return 405;
    }

    proxy_pass http://backend;
}

# Rate limiting for gateway endpoints
limit_req_zone $binary_remote_addr zone=gateway_limit:10m rate=10r/m;
location ~* /gateway.*invoke {
    limit_req zone=gateway_limit burst=5 nodelay;

    # Log suspicious requests for monitoring
    access_log /var/log/nginx/gateway_security.log combined;

    proxy_pass http://backend;
}

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-28466 - OpenClaw Gateway Approval Bypass
# Prevents exploitation of approval field injection in node.invoke parameters

# Rule 1000001: Block node.invoke requests with approval control field injection
SecRule REQUEST_URI "@contains node.invoke" \
    "id:1000001,\
    phase:2,\
    block,\
    msg:'CVE-2026-28466: OpenClaw node.invoke approval field injection attempt detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'attack-injection',\
    tag:'cve-2026-28466',\
    tag:'openclaw',\
    chain"
    SecRule ARGS "@rx (?i)(approval|approved|bypass|override|force|skip)[\s]*[:=][\s]*(?:true|1|yes|on)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"

# Rule 1000002: Block system.run command execution attempts in node.invoke
SecRule REQUEST_URI "@contains node.invoke" \
    "id:1000002,\
    phase:2,\
    block,\
    msg:'CVE-2026-28466: OpenClaw system.run command execution attempt via node.invoke',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'attack-rce',\
    tag:'cve-2026-28466',\
    tag:'openclaw',\
    chain"
    SecRule ARGS "@rx (?i)system\.run\s*\(" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"

# Rule 1000003: Detect suspicious approval parameter combinations
SecRule ARGS_NAMES "@rx (?i)(approval|exec_approval|gateway_approval|auth_bypass)" \
    "id:1000003,\
    phase:2,\
    block,\
    msg:'CVE-2026-28466: OpenClaw suspicious approval parameter detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'HIGH',\
    tag:'attack-injection',\
    tag:'cve-2026-28466',\
    tag:'openclaw'"

# Rule 1000004: Block attempts to manipulate approval status via JSON
SecRule REQUEST_BODY "@rx (?i)['\"](?:approval|approved|bypass|override)['\"][\s]*:[\s]*(?:true|1|['\"](?:yes|on|approved|bypassed)['\"])" \
    "id:1000004,\
    phase:2,\
    block,\
    msg:'CVE-2026-28466: OpenClaw JSON approval manipulation attempt',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'attack-injection',\
    tag:'cve-2026-28466',\
    tag:'openclaw',\
    t:none,t:urlDecodeUni,t:htmlEntityDecode"

# Rule 1000005: Monitor for OpenClaw gateway endpoint access patterns
SecRule REQUEST_URI "@rx (?i)/(?:gateway|api/gateway|openclaw)" \
    "id:1000005,\
    phase:2,\
    pass,\
    msg:'CVE-2026-28466: OpenClaw gateway access detected',\
    logdata:'URI: %{REQUEST_URI}',\
    severity:'INFO',\
    tag:'monitoring',\
    tag:'cve-2026-28466',\
    tag:'openclaw',\
    chain"
    SecRule ARGS "@rx (?i)(node\.invoke|system\.run|exec|command)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"

# Rule 1000006: Block command injection attempts in node.invoke parameters
SecRule REQUEST_URI "@contains node.invoke" \
    "id:1000006,\
    phase:2,\
    block,\
    msg:'CVE-2026-28466: OpenClaw command injection attempt in node.invoke',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    tag:'attack-injection',\
    tag:'cve-2026-28466',\
    tag:'openclaw',\
    chain"
    SecRule ARGS "@rx (?i)[\|;&\$\(\)`<>]|(?:sh|bash|cmd|powershell|python|perl|ruby)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-28466?¶

CVE-2026-28466 is a Critical (9.9) vulnerability: OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-28466?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-28466?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.