Openclaw
Page 3 of 6 — Openclaw CVEs from a corpus of 539, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41407 | Low | 3.7 | 2026-04-28 | OpenClaw before 2026.4.2 contains a timing side channel vulnerability in shared-secret comparison call sites that use early length-mismatch checks instead of f… |
CVE-2026-41406 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fe… |
CVE-2026-41405 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhau… |
CVE-2026-41404 | High | 8.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalat… |
CVE-2026-41403 | Low | 2.9 | 2026-04-28 | OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauth… |
CVE-2026-41402 | Medium | 4.2 | 2026-04-28 | OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages ac… |
CVE-2026-41400 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. R… |
CVE-2026-41399 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network… |
CVE-2026-41398 | Medium | 4.6 | 2026-04-28 | OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. A… |
CVE-2026-41397 | Medium | 6.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file… |
CVE-2026-41396 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification… |
CVE-2026-41395 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashe… |
CVE-2026-41394 | High | 8.2 | 2026-04-28 | OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes… |
CVE-2026-41393 | Medium | 4.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-… |
CVE-2026-41392 | Medium | 6.7 | 2026-04-28 | OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations… |
CVE-2026-41391 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to red… |
CVE-2026-41390 | High | 7.3 | 2026-04-28 | OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers b… |
CVE-2026-41388 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers ca… |
CVE-2026-41387 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts… |
CVE-2026-41386 | Critical | 9.1 | 2026-04-28 | OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pa… |
CVE-2026-41385 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechan… |
CVE-2026-41384 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environm… |
CVE-2026-41383 | High | 8.1 | 2026-04-28 | OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencin… |
CVE-2026-41382 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist… |
CVE-2026-41381 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member acc… |
CVE-2026-41380 | High | 7.3 | 2026-04-28 | OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper car… |
CVE-2026-41379 | High | 7.1 | 2026-04-28 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voic… |
CVE-2026-41378 | High | 8.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestr… |
CVE-2026-41377 | Medium | 4.6 | 2026-04-28 | OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers… |
CVE-2026-41376 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to properly validate message s… |
CVE-2026-41375 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator… |
CVE-2026-41374 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume… |
CVE-2026-41373 | Medium | 6.1 | 2026-04-28 | OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted… |
CVE-2026-41372 | Medium | 5.8 | 2026-04-28 | OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers… |
CVE-2026-41371 | High | 8.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session res… |
CVE-2026-41370 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains a path traversal vulnerability in ACP dispatch that allows attackers to read arbitrary files by manipulating inbound channel… |
CVE-2026-41369 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compile… |
CVE-2026-41368 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains an environment variable disclosure vulnerability in the jq safe-bin policy that fails to block the $ENV filter. Attackers ca… |
CVE-2026-41367 | Medium | 5.0 | 2026-04-28 | OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers… |
CVE-2026-41366 | Medium | 5.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file… |
CVE-2026-41365 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread mess… |
CVE-2026-41364 | High | 8.1 | 2026-04-28 | OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers… |
CVE-2026-41363 | Medium | 5.3 | 2026-04-28 | OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-syst… |
CVE-2026-41362 | Medium | 4.3 | 2026-04-28 | OpenClaw versions 2026.2.19 before 2026.3.31 contain an improper cache isolation vulnerability in the Zalo webhook replay-dedupe mechanism that is shared acros… |
CVE-2026-41361 | High | 7.1 | 2026-04-23 | OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting… |
CVE-2026-41360 | Medium | 6.7 | 2026-04-23 | OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operands consistently with pnpm exec flows. A… |
CVE-2026-41359 | High | 7.1 | 2026-04-23 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Telegram… |
CVE-2026-41358 | Medium | 5.4 | 2026-04-23 | OpenClaw before 2026.4.2 fails to filter Slack thread context by sender allowlist, allowing non-allowlisted messages to enter agent context. Attackers can inje… |
CVE-2026-41357 | Low | 3.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child proce… |
CVE-2026-41356 | Medium | 5.4 | 2026-04-23 | OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maint… |
CVE-2026-41355 | High | 7.3 | 2026-04-23 | OpenClaw before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into workspace hooks. Attacke… |
CVE-2026-41354 | Low | 3.7 | 2026-04-23 | OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversat… |
CVE-2026-41353 | High | 8.1 | 2026-04-23 | OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions… |
CVE-2026-41352 | High | 8.8 | 2026-04-23 | OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. At… |
CVE-2026-41351 | Medium | 5.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains a replay detection bypass vulnerability in webhook signature handling that treats Base64 and Base64URL encoded signatures as… |
CVE-2026-41350 | Medium | 4.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to enforce configured tools.sessions.visib… |
CVE-2026-41349 | High | 8.8 | 2026-04-23 | OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch paramete… |
CVE-2026-41348 | Medium | 5.4 | 2026-04-23 | OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths that fail to enforce group DM channel… |
CVE-2026-41347 | High | 7.1 | 2026-04-23 | OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery… |
CVE-2026-41346 | Medium | 5.3 | 2026-04-23 | OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pen… |
CVE-2026-41345 | Medium | 5.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin… |
CVE-2026-41344 | Medium | 5.4 | 2026-04-23 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-onl… |
CVE-2026-41343 | Medium | 5.3 | 2026-04-23 | OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient availability loss… |
CVE-2026-41342 | High | 7.3 | 2026-04-23 | OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints… |
CVE-2026-41341 | Medium | 5.4 | 2026-04-23 | OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as direct messages in extens… |
CVE-2026-41340 | Medium | 6.5 | 2026-04-23 | OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where Telegram legacy allowFrom migration incorrectly fans default-account trust in… |
CVE-2026-41339 | Medium | 4.3 | 2026-04-23 | OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. Non-admin clients ca… |
CVE-2026-41338 | Medium | 5.0 | 2026-04-23 | OpenClaw before 2026.3.31 contains a time-of-check-time-of-use vulnerability in sandbox file operations that allows attackers to bypass fd-based defenses. Atta… |
CVE-2026-41337 | Medium | 5.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback orig… |
CVE-2026-41336 | High | 7.8 | 2026-04-23 | OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling loading of attacker-controlled… |
CVE-2026-41335 | Medium | 5.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent ide… |
CVE-2026-41334 | Medium | 6.5 | 2026-04-23 | OpenClaw before 2026.3.31 contains a decompression bomb vulnerability in image processing that fails to properly enforce pixel-limit guards on sips. Attackers… |
CVE-2026-41333 | Low | 3.7 | 2026-04-23 | OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections u… |
CVE-2026-41332 | Medium | 5.3 | 2026-04-23 | OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not blocked in the host-en… |
CVE-2026-41909 | Medium | 5.4 | 2026-04-23 | OpenClaw before 2026.4.20 contains an improper authorization vulnerability in paired-device pairing management that allows limited-scope sessions to enumerate… |
CVE-2026-41908 | Medium | 4.3 | 2026-04-23 | OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.rea… |
CVE-2026-41331 | Medium | 5.3 | 2026-04-21 | OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows unauthorized group senders to tri… |
CVE-2026-41330 | Medium | 4.4 | 2026-04-21 | OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Gi… |
CVE-2026-41329 | Critical | 9.9 | 2026-04-21 | OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner… |
CVE-2026-41303 | High | 8.8 | 2026-04-21 | OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec ap… |
CVE-2026-41302 | High | 7.6 | 2026-04-21 | OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to… |
CVE-2026-41301 | Medium | 5.3 | 2026-04-21 | OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows pairing challenges… |
CVE-2026-41300 | Medium | 6.5 | 2026-04-21 | OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote onboarding flows. Attackers can route g… |
CVE-2026-41299 | High | 7.1 | 2026-04-21 | OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-dec… |
CVE-2026-41298 | Medium | 5.4 | 2026-04-21 | OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes. Read-scoped callers can… |
CVE-2026-41297 | High | 7.6 | 2026-04-21 | OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access… |
CVE-2026-41296 | High | 8.2 | 2026-04-21 | OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape. Att… |
CVE-2026-41295 | High | 7.8 | 2026-04-21 | OpenClaw before 2026.4.2 contains an improper trust boundary vulnerability allowing untrusted workspace channel shadows to execute during built-in channel setu… |
CVE-2026-41294 | High | 8.6 | 2026-04-21 | OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attack… |
CVE-2026-40045 | Medium | 5.7 | 2026-04-21 | OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attacker… |
CVE-2026-41389 | Medium | 5.8 | 2026-04-20 | OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. At… |
CVE-2026-3691 | Medium | 5.3 | 2026-04-11 | OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected insta… |
CVE-2026-3690 | High | 7.4 | 2026-04-11 | OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw… |
CVE-2026-3689 | Medium | 6.5 | 2026-04-11 | OpenClaw Canvas Path Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected i… |
CVE-2026-35670 | Medium | 5.9 | 2026-04-10 | OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies to unintended users by exploiting mutabl… |
CVE-2026-35669 | High | 8.8 | 2026-04-10 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtim… |
CVE-2026-35668 | High | 7.7 | 2026-04-10 | OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' w… |
CVE-2026-35667 | Medium | 6.1 | 2026-04-10 | OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-util… |
CVE-2026-35666 | High | 8.8 | 2026-04-10 | OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass… |
CVE-2026-35665 | Medium | 5.3 | 2026-04-10 | OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB a… |