Openclaw
Page 2 of 6 — Openclaw CVEs from a corpus of 539, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53810 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package pa… |
CVE-2026-53809 | Low | 3.8 | 2026-06-11 | OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against alias… |
CVE-2026-53808 | Medium | 6.5 | 2026-06-11 | OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true desp… |
CVE-2026-53807 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allo… |
CVE-2026-53806 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers ca… |
CVE-2026-35674 | High | 8.8 | 2026-05-29 | OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attac… |
CVE-2026-35673 | Medium | 6.5 | 2026-05-29 | OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attac… |
CVE-2026-35630 | High | 8.0 | 2026-05-29 | OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. N… |
CVE-2026-34507 | Medium | 5.4 | 2026-05-29 | OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated senders to skip DM-only and allowFrom policy… |
CVE-2026-32906 | Medium | 4.3 | 2026-05-29 | OpenClaw before 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals that allows exec-authorized users to resolve plugin approvals… |
CVE-2026-32905 | High | 8.3 | 2026-05-29 | OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issu… |
CVE-2026-8634 | Critical | 9.1 | 2026-05-14 | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to… |
CVE-2026-8629 | High | 8.1 | 2026-05-14 | Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress… |
CVE-2026-8621 | High | 8.8 | 2026-05-14 | Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organization… |
CVE-2026-45224 | High | 7.1 | 2026-05-11 | Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relat… |
CVE-2026-45223 | High | 8.8 | 2026-05-11 | Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails… |
CVE-2026-8305 | High | 7.3 | 2026-05-11 | A vulnerability was detected in OpenClaw up to 2026.1.24. The impacted element is the function handleBlueBubblesWebhookRequest of the file extensions/bluebubbl… |
CVE-2026-45006 | High | 8.8 | 2026-05-11 | OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromi… |
CVE-2026-45005 | Medium | 6.0 | 2026-05-11 | OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. A… |
CVE-2026-45004 | High | 7.8 | 2026-05-11 | OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() du… |
CVE-2026-45003 | Medium | 5.0 | 2026-05-11 | OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers wi… |
CVE-2026-45002 | Medium | 5.3 | 2026-05-11 | OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restrict… |
CVE-2026-45001 | High | 7.1 | 2026-05-11 | OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect opera… |
CVE-2026-45000 | Medium | 5.0 | 2026-05-11 | OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attac… |
CVE-2026-44999 | Medium | 5.3 | 2026-05-11 | OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be re… |
CVE-2026-44998 | Medium | 5.4 | 2026-05-11 | OpenClaw before 2026.4.20 contains a tool policy bypass vulnerability allowing bundled MCP and LSP tools to circumvent configured tool restrictions. Attackers… |
CVE-2026-44997 | Medium | 4.3 | 2026-05-11 | OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to i… |
CVE-2026-44996 | Low | 3.7 | 2026-05-11 | OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root contai… |
CVE-2026-44995 | High | 7.3 | 2026-05-11 | OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute… |
CVE-2026-44994 | Medium | 5.3 | 2026-05-11 | OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to… |
CVE-2026-44993 | Medium | 5.4 | 2026-05-11 | OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversat… |
CVE-2026-44992 | Medium | 5.0 | 2026-05-11 | OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Att… |
CVE-2026-44991 | Medium | 4.2 | 2026-05-11 | OpenClaw before 2026.4.21 contains an authorization bypass vulnerability in command-auth.ts that allows non-owner senders to execute owner-enforced slash comma… |
CVE-2026-44118 | High | 7.8 | 2026-05-06 | OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can pres… |
CVE-2026-44117 | Medium | 5.8 | 2026-05-06 | OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSR… |
CVE-2026-44116 | High | 8.6 | 2026-05-06 | OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo UR… |
CVE-2026-44115 | High | 8.8 | 2026-05-06 | OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass al… |
CVE-2026-44114 | High | 7.8 | 2026-05-06 | OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to overri… |
CVE-2026-44113 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside th… |
CVE-2026-44112 | Critical | 9.6 | 2026-05-06 | OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes o… |
CVE-2026-44111 | Medium | 4.3 | 2026-05-06 | OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read any Markdown files w… |
CVE-2026-44110 | High | 8.8 | 2026-05-06 | OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing-store entries. Att… |
CVE-2026-44109 | Critical | 9.8 | 2026-05-06 | OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to… |
CVE-2026-43585 | High | 8.1 | 2026-05-06 | OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTT… |
CVE-2026-43584 | High | 8.8 | 2026-05-06 | OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied ove… |
CVE-2026-43583 | Medium | 5.3 | 2026-05-06 | OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered q… |
CVE-2026-43582 | Medium | 6.3 | 2026-05-06 | OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation… |
CVE-2026-43581 | Critical | 9.6 | 2026-05-06 | OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0… |
CVE-2026-43580 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforc… |
CVE-2026-43579 | Medium | 6.5 | 2026-05-06 | OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permission… |
CVE-2026-43578 | Critical | 9.1 | 2026-05-06 | OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background asy… |
CVE-2026-43577 | Medium | 6.5 | 2026-05-06 | OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers… |
CVE-2026-43576 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to unt… |
CVE-2026-43575 | Critical | 9.8 | 2026-05-06 | OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser… |
CVE-2026-43574 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as exp… |
CVE-2026-43573 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypa… |
CVE-2026-43572 | Medium | 5.3 | 2026-05-05 | OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender… |
CVE-2026-43571 | High | 8.8 | 2026-05-05 | OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bun… |
CVE-2026-43570 | Medium | 6.5 | 2026-05-05 | OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to e… |
CVE-2026-43569 | High | 8.8 | 2026-05-05 | OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboard… |
CVE-2026-43568 | Medium | 6.5 | 2026-05-05 | OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming s… |
CVE-2026-43567 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards… |
CVE-2026-43566 | Critical | 9.1 | 2026-05-05 | OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carryi… |
CVE-2026-43535 | Medium | 6.8 | 2026-05-05 | OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to in… |
CVE-2026-43534 | Critical | 9.1 | 2026-05-05 | OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can… |
CVE-2026-43533 | High | 8.6 | 2026-05-05 | OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the int… |
CVE-2026-43532 | High | 7.7 | 2026-05-05 | OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media norm… |
CVE-2026-43531 | High | 7.3 | 2026-05-05 | OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Att… |
CVE-2026-43530 | High | 8.8 | 2026-05-05 | OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attacker… |
CVE-2026-43529 | Low | 2.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to byp… |
CVE-2026-43528 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfi… |
CVE-2026-43527 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attack… |
CVE-2026-43526 | High | 8.2 | 2026-05-05 | OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary conte… |
CVE-2026-42439 | High | 8.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can… |
CVE-2026-42438 | High | 7.7 | 2026-05-05 | OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthor… |
CVE-2026-42437 | High | 7.5 | 2026-05-05 | OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames w… |
CVE-2026-42436 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate… |
CVE-2026-42435 | High | 8.8 | 2026-05-05 | OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variab… |
CVE-2026-42434 | High | 8.8 | 2026-05-05 | OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node… |
CVE-2026-42433 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requir… |
CVE-2026-42432 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the ope… |
CVE-2026-42431 | High | 8.1 | 2026-04-28 | OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles. Attackers… |
CVE-2026-42430 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF check… |
CVE-2026-42429 | High | 7.1 | 2026-04-28 | OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing oper… |
CVE-2026-42428 | High | 7.1 | 2026-04-28 | OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin pack… |
CVE-2026-42427 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC… |
CVE-2026-42426 | High | 8.8 | 2026-04-28 | OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrow… |
CVE-2026-42424 | Medium | 5.7 | 2026-04-28 | OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers ca… |
CVE-2026-42423 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec… |
CVE-2026-42422 | High | 8.8 | 2026-04-28 | OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers ca… |
CVE-2026-42421 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can mai… |
CVE-2026-42420 | Medium | 4.3 | 2026-04-28 | OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exp… |
CVE-2026-41916 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. New… |
CVE-2026-41915 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit t… |
CVE-2026-41914 | High | 8.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit… |
CVE-2026-41913 | Low | 3.7 | 2026-04-28 | OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per… |
CVE-2026-41912 | High | 7.6 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF che… |
CVE-2026-41911 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries… |
CVE-2026-41910 | Medium | 4.3 | 2026-04-28 | OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An authorized non-owner sender can bypass… |
CVE-2026-41408 | Medium | 4.3 | 2026-04-28 | OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup op… |