Openclaw
Page 5 of 6 — Openclaw CVEs from a corpus of 539, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32896 | Medium | 4.8 | 2026-03-21 | The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhoo… |
CVE-2026-32895 | Medium | 5.4 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to… |
CVE-2026-32067 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that a… |
CVE-2026-32065 | Medium | 4.8 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity… |
CVE-2026-32064 | High | 7.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated ac… |
CVE-2026-32058 | Low | 2.6 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously… |
CVE-2026-32057 | High | 7.1 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=co… |
CVE-2026-32056 | High | 7.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to by… |
CVE-2026-32055 | High | 7.6 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the w… |
CVE-2026-32054 | Medium | 6.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers t… |
CVE-2026-32053 | Medium | 6.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowin… |
CVE-2026-32052 | Medium | 6.4 | 2026-03-21 | OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands… |
CVE-2026-32051 | High | 8.8 | 2026-03-21 | OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner… |
CVE-2026-32050 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enque… |
CVE-2026-32049 | High | 7.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel in… |
CVE-2026-32048 | High | 7.5 | 2026-03-21 | OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create chi… |
CVE-2026-32046 | Medium | 5.3 | 2026-03-21 | OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting rend… |
CVE-2026-32045 | Medium | 5.9 | 2026-03-21 | OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password… |
CVE-2026-32044 | Medium | 5.5 | 2026-03-21 | OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other arc… |
CVE-2026-32043 | Medium | 6.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is valida… |
CVE-2026-32042 | High | 8.8 | 2026-03-21 | OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requ… |
CVE-2026-22172 | Critical | 9.9 | 2026-03-20 | OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authentic… |
CVE-2026-32041 | Medium | 6.9 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessibl… |
CVE-2026-32040 | Medium | 4.6 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript… |
CVE-2026-32039 | Medium | 5.9 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the toolsBySender group policy matching that allows attackers to inherit… |
CVE-2026-32038 | Critical | 9.8 | 2026-03-19 | OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace… |
CVE-2026-32037 | Medium | 6.0 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads… |
CVE-2026-32036 | Medium | 6.5 | 2026-03-19 | OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks b… |
CVE-2026-32035 | Medium | 5.9 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default… |
CVE-2026-32034 | High | 8.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gate… |
CVE-2026-32033 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validati… |
CVE-2026-32032 | High | 7.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path fr… |
CVE-2026-32031 | Medium | 4.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 server-http contains an authentication bypass vulnerability in gateway authentication for plugin channel endpoints due to… |
CVE-2026-32030 | High | 7.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that accepts arbitrary absolute paths when iMessa… |
CVE-2026-32029 | Medium | 5.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allow… |
CVE-2026-32028 | Medium | 5.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications, allowing non… |
CVE-2026-32027 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowli… |
CVE-2026-32026 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temp… |
CVE-2026-32025 | High | 7.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks… |
CVE-2026-32024 | Medium | 5.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the con… |
CVE-2026-32023 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers ca… |
CVE-2026-32022 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the grep tool within tools.exec.safeBins that allows attackers to read… |
CVE-2026-32021 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the Feishu allowFrom allowlist implementation that accepts mutable sender… |
CVE-2026-32020 | Low | 3.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file r… |
CVE-2026-32019 | High | 7.4 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ra… |
CVE-2026-32018 | Low | 3.6 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox contain… |
CVE-2026-32017 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain an allowlist bypass vulnerability in the exec safeBins policy that allows attackers to write arbitrary files using… |
CVE-2026-32016 | High | 7.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 on macOS contain a path validation bypass vulnerability in the exec-approval allowlist mode that allows local attackers to… |
CVE-2026-32015 | High | 7.8 | 2026-03-19 | OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that allows attackers to bypass allowlist checks b… |
CVE-2026-32014 | High | 8.0 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client wi… |
CVE-2026-32013 | High | 8.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and wri… |
CVE-2026-32011 | High | 7.5 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Google Chat that parse request bodies bef… |
CVE-2026-32010 | Medium | 6.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safe-bin configuration when sort is manually added to tools.exec.safeBins… |
CVE-2026-32009 | Medium | 5.7 | 2026-03-19 | OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories includin… |
CVE-2026-32008 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authe… |
CVE-2026-32007 | Medium | 6.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to m… |
CVE-2026-32006 | Low | 3.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist… |
CVE-2026-32005 | Medium | 6.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks including block_action, view_submission, and view_cl… |
CVE-2026-32004 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mism… |
CVE-2026-32003 | Medium | 6.6 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an environment variable injection vulnerability in the system.run function that allows attackers to bypass command… |
CVE-2026-32002 | Medium | 5.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain a sandbox bypass vulnerability in the sandboxed image tool that fails to enforce tools.fs.workspaceOnly restrictio… |
CVE-2026-32001 | Medium | 5.4 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as… |
CVE-2026-32000 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with sh… |
CVE-2026-31999 | Medium | 6.3 | 2026-03-19 | OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files… |
CVE-2026-31998 | High | 8.6 | 2026-03-19 | OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist wit… |
CVE-2026-31997 | Medium | 6.0 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable… |
CVE-2026-31996 | Medium | 4.4 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vulnerability that allows attackers to execute unintended filesyst… |
CVE-2026-31995 | Medium | 5.3 | 2026-03-19 | OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allow… |
CVE-2026-31994 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd… |
CVE-2026-31993 | Medium | 4.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypa… |
CVE-2026-31992 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintend… |
CVE-2026-31991 | Low | 3.7 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities fr… |
CVE-2026-31990 | Medium | 6.1 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media s… |
CVE-2026-31989 | High | 7.4 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-… |
CVE-2026-29608 | Medium | 6.7 | 2026-03-19 | OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can… |
CVE-2026-29607 | Medium | 6.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval… |
CVE-2026-28461 | High | 7.5 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trig… |
CVE-2026-28460 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by split… |
CVE-2026-28449 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without… |
CVE-2026-27670 | Medium | 5.3 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended de… |
CVE-2026-27566 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper… |
CVE-2026-22176 | Medium | 6.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are writ… |
CVE-2026-27545 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended… |
CVE-2026-27524 | Medium | 4.3 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authori… |
CVE-2026-27523 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing attackers to bypass allowed-root and blocked-path checks via syml… |
CVE-2026-27522 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is uns… |
CVE-2026-22217 | Medium | 6.1 | 2026-03-18 | OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-control… |
CVE-2026-22181 | High | 7.6 | 2026-03-18 | OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when e… |
CVE-2026-22180 | Medium | 5.3 | 2026-03-18 | OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser output handling that allows writes outside intended root directo… |
CVE-2026-22179 | High | 7.2 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowl… |
CVE-2026-22178 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex i… |
CVE-2026-22177 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution… |
CVE-2026-22175 | High | 7.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through un… |
CVE-2026-22174 | Medium | 6.8 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to… |
CVE-2026-22171 | High | 8.2 | 2026-03-18 | OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated direc… |
CVE-2026-22170 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration ca… |
CVE-2026-22169 | Medium | 6.7 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers t… |
CVE-2026-22168 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrar… |
CVE-2026-32302 | High | 8.1 | 2026-03-13 | OpenClaw is a personal AI assistant. Prior to 2026.3.11, browser-originated WebSocket connections could bypass origin validation when gateway.auth.mode was set… |
CVE-2026-4040 | Low | 3.3 | 2026-03-12 | A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The ma… |