Openclaw
Page 3 of 7 — Openclaw CVEs from a corpus of 668, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45003 | Medium | 5.0 | 2026-05-11 | OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers wi… |
CVE-2026-45002 | Medium | 5.3 | 2026-05-11 | OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restrict… |
CVE-2026-45001 | High | 7.1 | 2026-05-11 | OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect opera… |
CVE-2026-45000 | Medium | 5.0 | 2026-05-11 | OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attac… |
CVE-2026-44999 | Medium | 5.3 | 2026-05-11 | OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be re… |
CVE-2026-44998 | Medium | 5.4 | 2026-05-11 | OpenClaw before 2026.4.20 contains a tool policy bypass vulnerability allowing bundled MCP and LSP tools to circumvent configured tool restrictions. Attackers… |
CVE-2026-44997 | Medium | 4.3 | 2026-05-11 | OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to i… |
CVE-2026-44996 | Low | 3.7 | 2026-05-11 | OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root contai… |
CVE-2026-44995 | High | 7.3 | 2026-05-11 | OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute… |
CVE-2026-44994 | Medium | 5.3 | 2026-05-11 | OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to… |
CVE-2026-44993 | Medium | 5.4 | 2026-05-11 | OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversat… |
CVE-2026-44992 | Medium | 5.0 | 2026-05-11 | OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Att… |
CVE-2026-44991 | Medium | 4.2 | 2026-05-11 | OpenClaw before 2026.4.21 contains an authorization bypass vulnerability in command-auth.ts that allows non-owner senders to execute owner-enforced slash comma… |
CVE-2026-44118 | High | 7.8 | 2026-05-06 | OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can pres… |
CVE-2026-44117 | Medium | 5.8 | 2026-05-06 | OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSR… |
CVE-2026-44116 | High | 8.6 | 2026-05-06 | OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo UR… |
CVE-2026-44115 | High | 8.8 | 2026-05-06 | OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass al… |
CVE-2026-44114 | High | 7.8 | 2026-05-06 | OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to overri… |
CVE-2026-44113 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside th… |
CVE-2026-44112 | Critical | 9.6 | 2026-05-06 | OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes o… |
CVE-2026-44111 | Medium | 4.3 | 2026-05-06 | OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read any Markdown files w… |
CVE-2026-44110 | High | 8.8 | 2026-05-06 | OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing-store entries. Att… |
CVE-2026-44109 | Critical | 9.8 | 2026-05-06 | OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to… |
CVE-2026-43585 | High | 8.1 | 2026-05-06 | OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTT… |
CVE-2026-43584 | High | 8.8 | 2026-05-06 | OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied ove… |
CVE-2026-43583 | Medium | 5.3 | 2026-05-06 | OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered q… |
CVE-2026-43582 | Medium | 6.3 | 2026-05-06 | OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation… |
CVE-2026-43581 | Critical | 9.6 | 2026-05-06 | OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0… |
CVE-2026-43580 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforc… |
CVE-2026-43579 | Medium | 6.5 | 2026-05-06 | OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permission… |
CVE-2026-43578 | Critical | 9.1 | 2026-05-06 | OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background asy… |
CVE-2026-43577 | Medium | 6.5 | 2026-05-06 | OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers… |
CVE-2026-43576 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to unt… |
CVE-2026-43575 | Critical | 9.8 | 2026-05-06 | OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser… |
CVE-2026-43574 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as exp… |
CVE-2026-43573 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypa… |
CVE-2026-43572 | Medium | 5.3 | 2026-05-05 | OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender… |
CVE-2026-43571 | High | 8.8 | 2026-05-05 | OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bun… |
CVE-2026-43570 | Medium | 6.5 | 2026-05-05 | OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to e… |
CVE-2026-43569 | High | 8.8 | 2026-05-05 | OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboard… |
CVE-2026-43568 | Medium | 6.5 | 2026-05-05 | OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming s… |
CVE-2026-43567 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards… |
CVE-2026-43566 | Critical | 9.1 | 2026-05-05 | OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carryi… |
CVE-2026-43535 | Medium | 6.8 | 2026-05-05 | OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to in… |
CVE-2026-43534 | Critical | 9.1 | 2026-05-05 | OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can… |
CVE-2026-43533 | High | 8.6 | 2026-05-05 | OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the int… |
CVE-2026-43532 | High | 7.7 | 2026-05-05 | OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media norm… |
CVE-2026-43531 | High | 7.3 | 2026-05-05 | OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Att… |
CVE-2026-43530 | High | 8.8 | 2026-05-05 | OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attacker… |
CVE-2026-43529 | Low | 2.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to byp… |
CVE-2026-43528 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfi… |
CVE-2026-43527 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attack… |
CVE-2026-43526 | High | 8.2 | 2026-05-05 | OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary conte… |
CVE-2026-42439 | High | 8.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can… |
CVE-2026-42438 | High | 7.7 | 2026-05-05 | OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthor… |
CVE-2026-42437 | High | 7.5 | 2026-05-05 | OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames w… |
CVE-2026-42436 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate… |
CVE-2026-42435 | High | 8.8 | 2026-05-05 | OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variab… |
CVE-2026-42434 | High | 8.8 | 2026-05-05 | OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node… |
CVE-2026-42433 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requir… |
CVE-2026-42432 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the ope… |
CVE-2026-42431 | High | 8.1 | 2026-04-28 | OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles. Attackers… |
CVE-2026-42430 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF check… |
CVE-2026-42429 | High | 7.1 | 2026-04-28 | OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing oper… |
CVE-2026-42428 | High | 7.1 | 2026-04-28 | OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin pack… |
CVE-2026-42427 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC… |
CVE-2026-42426 | High | 8.8 | 2026-04-28 | OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrow… |
CVE-2026-42424 | Medium | 5.7 | 2026-04-28 | OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers ca… |
CVE-2026-42423 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec… |
CVE-2026-42422 | High | 8.8 | 2026-04-28 | OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers ca… |
CVE-2026-42421 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can mai… |
CVE-2026-42420 | Medium | 4.3 | 2026-04-28 | OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exp… |
CVE-2026-41916 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. New… |
CVE-2026-41915 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit t… |
CVE-2026-41914 | High | 8.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit… |
CVE-2026-41913 | Low | 3.7 | 2026-04-28 | OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per… |
CVE-2026-41912 | High | 7.6 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF che… |
CVE-2026-41911 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries… |
CVE-2026-41910 | Medium | 4.3 | 2026-04-28 | OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An authorized non-owner sender can bypass… |
CVE-2026-41408 | Medium | 4.3 | 2026-04-28 | OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup op… |
CVE-2026-41407 | Low | 3.7 | 2026-04-28 | OpenClaw before 2026.4.2 contains a timing side channel vulnerability in shared-secret comparison call sites that use early length-mismatch checks instead of f… |
CVE-2026-41406 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fe… |
CVE-2026-41405 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhau… |
CVE-2026-41404 | High | 8.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalat… |
CVE-2026-41403 | Low | 2.9 | 2026-04-28 | OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauth… |
CVE-2026-41402 | Medium | 4.2 | 2026-04-28 | OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages ac… |
CVE-2026-41400 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. R… |
CVE-2026-41399 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network… |
CVE-2026-41398 | Medium | 4.6 | 2026-04-28 | OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. A… |
CVE-2026-41397 | Medium | 6.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file… |
CVE-2026-41396 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification… |
CVE-2026-41395 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashe… |
CVE-2026-41394 | High | 8.2 | 2026-04-28 | OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes… |
CVE-2026-41393 | Medium | 4.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-… |
CVE-2026-41392 | Medium | 6.7 | 2026-04-28 | OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations… |
CVE-2026-41391 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to red… |
CVE-2026-41390 | High | 7.3 | 2026-04-28 | OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers b… |
CVE-2026-41388 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers ca… |
CVE-2026-41387 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts… |
CVE-2026-41386 | Critical | 9.1 | 2026-04-28 | OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pa… |