Openclaw
Page 2 of 7 — Openclaw CVEs from a corpus of 666, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62207 | High | 8.8 | 2026-07-17 | OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools. Attackers can per… |
CVE-2026-62206 | High | 7.1 | 2026-07-17 | OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or co… |
CVE-2026-62205 | High | 7.1 | 2026-07-17 | OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected fea… |
CVE-2026-62203 | High | 8.8 | 2026-07-17 | OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables… |
CVE-2026-62202 | High | 8.8 | 2026-07-17 | OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied… |
CVE-2026-62201 | High | 7.7 | 2026-07-17 | OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal ne… |
CVE-2026-62200 | High | 8.8 | 2026-07-13 | OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature… |
CVE-2026-62199 | High | 8.8 | 2026-07-13 | OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is e… |
CVE-2026-62198 | Medium | 4.3 | 2026-07-13 | OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actio… |
CVE-2026-62197 | High | 8.5 | 2026-07-13 | OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access… |
CVE-2026-62196 | High | 8.3 | 2026-07-13 | OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Atta… |
CVE-2026-62195 | High | 8.3 | 2026-07-13 | OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execut… |
CVE-2026-62194 | High | 8.8 | 2026-07-13 | OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute… |
CVE-2026-62193 | Medium | 4.9 | 2026-07-13 | OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. Whe… |
CVE-2026-62192 | High | 8.1 | 2026-07-13 | OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform ac… |
CVE-2026-62191 | High | 7.1 | 2026-07-13 | OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perfor… |
CVE-2026-62190 | High | 8.8 | 2026-07-13 | OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist acti… |
CVE-2026-62189 | High | 7.1 | 2026-07-13 | OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requi… |
CVE-2026-62188 | High | 8.1 | 2026-07-13 | OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-… |
CVE-2026-62187 | High | 8.1 | 2026-07-13 | OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input p… |
CVE-2026-62186 | High | 7.6 | 2026-07-13 | OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to pe… |
CVE-2026-59261 | High | 7.1 | 2026-07-08 | OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-tru… |
CVE-2026-53866 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved… |
CVE-2026-53865 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash c… |
CVE-2026-53864 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass… |
CVE-2026-53863 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a… |
CVE-2026-53862 | Medium | 4.2 | 2026-06-16 | OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested sco… |
CVE-2026-53861 | Medium | 6.6 | 2026-06-16 | OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers… |
CVE-2026-53860 | Medium | 4.2 | 2026-06-16 | OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation… |
CVE-2026-53859 | Medium | 6.5 | 2026-06-16 | OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model… |
CVE-2026-53858 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependen… |
CVE-2026-53857 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries thr… |
CVE-2026-53856 | Medium | 5.5 | 2026-06-16 | OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permis… |
CVE-2026-53855 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional p… |
CVE-2026-53854 | Medium | 6.5 | 2026-06-16 | OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard… |
CVE-2026-53853 | High | 8.3 | 2026-06-16 | OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowl… |
CVE-2026-53852 | Medium | 5.4 | 2026-06-16 | OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes… |
CVE-2026-53851 | Medium | 5.3 | 2026-06-16 | OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction not… |
CVE-2026-53850 | Medium | 5.5 | 2026-06-16 | OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the comma… |
CVE-2026-53849 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable… |
CVE-2026-53848 | Medium | 4.3 | 2026-06-16 | OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowl… |
CVE-2026-53847 | Medium | 5.4 | 2026-06-16 | OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write acces… |
CVE-2026-53846 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configura… |
CVE-2026-53845 | Medium | 4.3 | 2026-06-16 | OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverag… |
CVE-2026-53844 | Medium | 6.5 | 2026-06-16 | OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory e… |
CVE-2026-53843 | High | 8.8 | 2026-06-16 | OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority… |
CVE-2026-53842 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through C… |
CVE-2026-53841 | Medium | 6.1 | 2026-06-16 | OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated… |
CVE-2026-53840 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers duri… |
CVE-2026-53839 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostname… |
CVE-2026-53838 | Critical | 9.8 | 2026-06-12 | OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. At… |
CVE-2026-53837 | Low | 3.7 | 2026-06-12 | OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers… |
CVE-2026-53836 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands u… |
CVE-2026-53835 | Medium | 4.3 | 2026-06-12 | OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that allows authenticated senders to create… |
CVE-2026-53834 | High | 7.5 | 2026-06-12 | OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFr… |
CVE-2026-53833 | High | 7.7 | 2026-06-12 | OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configurati… |
CVE-2026-53832 | High | 7.7 | 2026-06-12 | OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attack… |
CVE-2026-53831 | High | 8.3 | 2026-06-12 | OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command… |
CVE-2026-53830 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active a… |
CVE-2026-53829 | High | 8.0 | 2026-06-12 | OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers… |
CVE-2026-53828 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only comm… |
CVE-2026-53827 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata to forward action payl… |
CVE-2026-53826 | Medium | 4.3 | 2026-06-12 | OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts… |
CVE-2026-53825 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with opera… |
CVE-2026-53824 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor re… |
CVE-2026-53823 | High | 8.1 | 2026-06-12 | OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack… |
CVE-2026-53822 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuil… |
CVE-2026-53821 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline… |
CVE-2026-53820 | Medium | 6.6 | 2026-06-12 | OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to byp… |
CVE-2026-53819 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew execut… |
CVE-2026-53818 | Medium | 6.6 | 2026-06-11 | OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool poli… |
CVE-2026-53817 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality inform… |
CVE-2026-53816 | High | 7.2 | 2026-06-11 | OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle… |
CVE-2026-53815 | Medium | 6.5 | 2026-06-11 | OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can r… |
CVE-2026-53814 | High | 8.3 | 2026-06-11 | OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority… |
CVE-2026-53813 | High | 7.8 | 2026-06-11 | OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolutio… |
CVE-2026-53812 | High | 7.7 | 2026-06-11 | OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network nav… |
CVE-2026-53811 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom feature that allows authenticated accounts to match policy entri… |
CVE-2026-53810 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package pa… |
CVE-2026-53809 | Low | 3.8 | 2026-06-11 | OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against alias… |
CVE-2026-53808 | Medium | 6.5 | 2026-06-11 | OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true desp… |
CVE-2026-53807 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allo… |
CVE-2026-53806 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers ca… |
CVE-2026-35674 | High | 8.8 | 2026-05-29 | OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attac… |
CVE-2026-35673 | Medium | 6.5 | 2026-05-29 | OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attac… |
CVE-2026-35630 | High | 8.0 | 2026-05-29 | OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. N… |
CVE-2026-34507 | Medium | 5.4 | 2026-05-29 | OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated senders to skip DM-only and allowFrom policy… |
CVE-2026-32906 | Medium | 4.3 | 2026-05-29 | OpenClaw before 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals that allows exec-authorized users to resolve plugin approvals… |
CVE-2026-32905 | High | 8.3 | 2026-05-29 | OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issu… |
CVE-2026-8634 | Critical | 9.1 | 2026-05-14 | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to… |
CVE-2026-8629 | High | 8.1 | 2026-05-14 | Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress… |
CVE-2026-8621 | High | 8.8 | 2026-05-14 | Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organization… |
CVE-2026-45224 | High | 7.1 | 2026-05-11 | Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relat… |
CVE-2026-45223 | High | 8.8 | 2026-05-11 | Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails… |
CVE-2026-8305 | High | 7.3 | 2026-05-11 | A vulnerability was detected in OpenClaw up to 2026.1.24. The impacted element is the function handleBlueBubblesWebhookRequest of the file extensions/bluebubbl… |
CVE-2026-45006 | High | 8.8 | 2026-05-11 | OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromi… |
CVE-2026-45005 | Medium | 6.0 | 2026-05-11 | OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. A… |
CVE-2026-45004 | High | 7.8 | 2026-05-11 | OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() du… |
CVE-2026-45003 | Medium | 5.0 | 2026-05-11 | OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers wi… |
CVE-2026-45002 | Medium | 5.3 | 2026-05-11 | OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restrict… |