CVE-2026-44115
OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.
- Affected products
- Openclaw
- Openclaw
- < 2026.4.22
- Fix
- Available
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 0.4% (29th percentile)
- Weakness
- CWE-184
- NVD status
- Analyzed
- Published
- 2026-05-06
CVE-2026-44115 at NVD
No indexed exploits for CVE-2026-44115 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-44115 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.