Openclaw
Page 4 of 6 — Openclaw CVEs from a corpus of 539, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-35664 | Medium | 5.3 | 2026-04-10 | OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payl… |
CVE-2026-35663 | High | 8.8 | 2026-04-10 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. A… |
CVE-2026-35662 | Medium | 4.3 | 2026-04-10 | OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond th… |
CVE-2026-35661 | Medium | 5.3 | 2026-04-10 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state with… |
CVE-2026-35660 | High | 8.1 | 2026-04-10 | OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write pe… |
CVE-2026-35659 | Medium | 4.6 | 2026-04-10 | OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual se… |
CVE-2026-35658 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attacke… |
CVE-2026-35657 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validat… |
CVE-2026-35656 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.22 contains an authentication bypass vulnerability in the X-Forwarded-For header processing when trustedProxies is configured, allowing… |
CVE-2026-35655 | Medium | 5.7 | 2026-04-10 | OpenClaw before 2026.3.22 contains an identity spoofing vulnerability in ACP permission resolution that trusts conflicting tool identity hints from rawInput an… |
CVE-2026-35654 | Medium | 5.3 | 2026-04-10 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Microsoft Teams feedback invokes that allows unauthorized senders to record session… |
CVE-2026-35653 | High | 8.1 | 2026-04-10 | OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator… |
CVE-2026-35652 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.22 contains an authorization bypass vulnerability in interactive callback dispatch that allows non-allowlisted senders to execute action… |
CVE-2026-35651 | Medium | 4.3 | 2026-04-10 | OpenClaw versions 2026.2.13 through 2026.3.24 contain an ANSI escape sequence injection vulnerability in approval prompts that allows attackers to spoof termin… |
CVE-2026-35650 | High | 7.5 | 2026-04-10 | OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy t… |
CVE-2026-35649 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty al… |
CVE-2026-35648 | Low | 3.7 | 2026-04-10 | OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. A… |
CVE-2026-35647 | Medium | 5.3 | 2026-04-10 | OpenClaw before 2026.3.25 contains an access control vulnerability where verification notices bypass DM policy checks and reply to unpaired peers. Attackers ca… |
CVE-2026-35643 | High | 8.8 | 2026-04-10 | OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted page… |
CVE-2026-35641 | High | 7.8 | 2026-04-10 | OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious c… |
CVE-2026-35621 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal ca… |
CVE-2026-35620 | Medium | 5.4 | 2026-04-10 | OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner… |
CVE-2026-35619 | Medium | 4.3 | 2026-04-10 | OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements… |
CVE-2026-6011 | Medium | 5.6 | 2026-04-10 | A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of t… |
CVE-2026-35646 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak w… |
CVE-2026-35645 | High | 8.1 | 2026-04-09 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic op… |
CVE-2026-35644 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in cha… |
CVE-2026-35642 | Medium | 4.3 | 2026-04-09 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism. Attack… |
CVE-2026-35640 | Medium | 5.3 | 2026-04-09 | OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsi… |
CVE-2026-35639 | High | 8.8 | 2026-04-09 | OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve p… |
CVE-2026-35638 | High | 8.8 | 2026-04-09 | OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain self-declared privileg… |
CVE-2026-35637 | High | 7.3 | 2026-04-09 | OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final… |
CVE-2026-35636 | Medium | 6.5 | 2026-04-09 | OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session key… |
CVE-2026-35635 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-accoun… |
CVE-2026-35634 | Medium | 5.1 | 2026-04-09 | OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-dir… |
CVE-2026-35633 | Medium | 5.3 | 2026-04-09 | OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive… |
CVE-2026-35632 | High | 7.1 | 2026-04-09 | OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without… |
CVE-2026-35631 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unauthorized modifications. Attackers without… |
CVE-2026-35629 | High | 7.4 | 2026-04-09 | OpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail to properly guard configured base URLs… |
CVE-2026-35628 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook s… |
CVE-2026-35627 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation… |
CVE-2026-35626 | Medium | 5.3 | 2026-04-09 | OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provi… |
CVE-2026-35625 | High | 7.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening… |
CVE-2026-35624 | Medium | 4.2 | 2026-04-09 | OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Atta… |
CVE-2026-35623 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords… |
CVE-2026-35622 | Medium | 5.9 | 2026-04-09 | OpenClaw before 2026.3.22 contains an improper authentication verification vulnerability in Google Chat app-url webhook handling that accepts add-on principals… |
CVE-2026-35618 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modi… |
CVE-2026-35617 | Medium | 4.2 | 2026-04-09 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. At… |
CVE-2026-34512 | High | 8.1 | 2026-04-09 | OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated u… |
CVE-2026-40037 | Medium | 6.5 | 2026-04-08 | OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be rese… |
CVE-2026-34511 | Medium | 5.3 | 2026-04-03 | OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who ca… |
CVE-2026-34426 | High | 7.6 | 2026-04-02 | OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and… |
CVE-2026-34425 | Medium | 5.4 | 2026-04-02 | OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocke… |
CVE-2026-34510 | Medium | 5.3 | 2026-04-01 | OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-… |
CVE-2026-34504 | High | 8.3 | 2026-03-31 | OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers… |
CVE-2026-34503 | High | 8.1 | 2026-03-31 | OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can… |
CVE-2026-33581 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and… |
CVE-2026-33580 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak… |
CVE-2026-33579 | Critical | 9.9 | 2026-03-31 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core app… |
CVE-2026-33578 | Medium | 4.3 | 2026-03-31 | OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies s… |
CVE-2026-33577 | High | 8.1 | 2026-03-31 | OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to appr… |
CVE-2026-33576 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network… |
CVE-2026-34506 | Medium | 4.3 | 2026-03-31 | OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended aut… |
CVE-2026-34505 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook… |
CVE-2026-32988 | High | 7.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and population are not pinn… |
CVE-2026-32982 | High | 7.5 | 2026-03-31 | OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages… |
CVE-2026-32977 | Medium | 6.3 | 2026-03-31 | OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during… |
CVE-2026-32976 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite co… |
CVE-2026-32971 | High | 7.1 | 2026-03-31 | OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the… |
CVE-2026-32970 | Low | 2.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are trea… |
CVE-2026-32921 | Medium | 6.3 | 2026-03-31 | OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phas… |
CVE-2026-32920 | High | 8.4 | 2026-03-31 | OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code exe… |
CVE-2026-32917 | Critical | 9.8 | 2026-03-31 | OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary… |
CVE-2026-32916 | Critical | 9.4 | 2026-03-31 | OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthe… |
CVE-2026-33575 | High | 7.5 | 2026-03-29 | OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Att… |
CVE-2026-33574 | Medium | 6.2 | 2026-03-29 | OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutabl… |
CVE-2026-33573 | High | 8.8 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permi… |
CVE-2026-33572 | High | 8.4 | 2026-03-29 | OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attac… |
CVE-2026-32987 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify… |
CVE-2026-32980 | High | 7.5 | 2026-03-29 | OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthentica… |
CVE-2026-32979 | High | 7.3 | 2026-03-29 | OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local code by modifying scripts between approval… |
CVE-2026-32978 | High | 8.0 | 2026-03-29 | OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners… |
CVE-2026-32975 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable gro… |
CVE-2026-32974 | High | 8.6 | 2026-03-29 | OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey… |
CVE-2026-32973 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and… |
CVE-2026-32972 | High | 7.1 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-o… |
CVE-2026-32924 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversat… |
CVE-2026-32923 | Medium | 5.4 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reaction ingestion that fails to enforce member users and roles allow… |
CVE-2026-32922 | Critical | 9.9 | 2026-03-29 | OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens w… |
CVE-2026-32919 | Medium | 6.1 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with… |
CVE-2026-32918 | High | 8.4 | 2026-03-29 | OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or siblin… |
CVE-2026-32915 | High | 8.8 | 2026-03-29 | OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against… |
CVE-2026-32914 | High | 8.8 | 2026-03-29 | OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-o… |
CVE-2026-32846 | High | 7.5 | 2026-03-26 | OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation i… |
CVE-2026-32913 | Critical | 9.3 | 2026-03-23 | OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-ori… |
CVE-2026-27646 | Medium | 6.1 | 2026-03-23 | OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize ho… |
CVE-2026-27183 | Medium | 5.3 | 2026-03-23 | OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip… |
CVE-2026-32899 | Medium | 4.3 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-ev… |
CVE-2026-32898 | Medium | 5.4 | 2026-03-21 | OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall… |
CVE-2026-32897 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to ha… |