Openclaw
Page 5 of 7 — Openclaw CVEs from a corpus of 668, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-35621 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal ca… |
CVE-2026-35620 | Medium | 5.4 | 2026-04-10 | OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner… |
CVE-2026-35619 | Medium | 4.3 | 2026-04-10 | OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements… |
CVE-2026-6011 | Medium | 5.6 | 2026-04-10 | A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of t… |
CVE-2026-35646 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak w… |
CVE-2026-35645 | High | 8.1 | 2026-04-09 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic op… |
CVE-2026-35644 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in cha… |
CVE-2026-35642 | Medium | 4.3 | 2026-04-09 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism. Attack… |
CVE-2026-35640 | Medium | 5.3 | 2026-04-09 | OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsi… |
CVE-2026-35639 | High | 8.8 | 2026-04-09 | OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve p… |
CVE-2026-35638 | High | 8.8 | 2026-04-09 | OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain self-declared privileg… |
CVE-2026-35637 | High | 7.3 | 2026-04-09 | OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final… |
CVE-2026-35636 | Medium | 6.5 | 2026-04-09 | OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session key… |
CVE-2026-35635 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-accoun… |
CVE-2026-35634 | Medium | 5.1 | 2026-04-09 | OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-dir… |
CVE-2026-35633 | Medium | 5.3 | 2026-04-09 | OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive… |
CVE-2026-35632 | High | 7.1 | 2026-04-09 | OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without… |
CVE-2026-35631 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unauthorized modifications. Attackers without… |
CVE-2026-35629 | High | 7.4 | 2026-04-09 | OpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail to properly guard configured base URLs… |
CVE-2026-35628 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook s… |
CVE-2026-35627 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation… |
CVE-2026-35626 | Medium | 5.3 | 2026-04-09 | OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provi… |
CVE-2026-35625 | High | 7.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening… |
CVE-2026-35624 | Medium | 4.2 | 2026-04-09 | OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Atta… |
CVE-2026-35623 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords… |
CVE-2026-35622 | Medium | 5.9 | 2026-04-09 | OpenClaw before 2026.3.22 contains an improper authentication verification vulnerability in Google Chat app-url webhook handling that accepts add-on principals… |
CVE-2026-35618 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modi… |
CVE-2026-35617 | Medium | 4.2 | 2026-04-09 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. At… |
CVE-2026-34512 | High | 8.1 | 2026-04-09 | OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated u… |
CVE-2026-40037 | Medium | 6.5 | 2026-04-08 | OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be rese… |
CVE-2026-34511 | Medium | 5.3 | 2026-04-03 | OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who ca… |
CVE-2026-34426 | High | 7.6 | 2026-04-02 | OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and… |
CVE-2026-34425 | Medium | 5.4 | 2026-04-02 | OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocke… |
CVE-2026-34510 | Medium | 5.3 | 2026-04-01 | OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-… |
CVE-2026-34504 | High | 8.3 | 2026-03-31 | OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers… |
CVE-2026-34503 | High | 8.1 | 2026-03-31 | OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can… |
CVE-2026-33581 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and… |
CVE-2026-33580 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak… |
CVE-2026-33579 | Critical | 9.9 | 2026-03-31 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core app… |
CVE-2026-33578 | Medium | 4.3 | 2026-03-31 | OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies s… |
CVE-2026-33577 | High | 8.1 | 2026-03-31 | OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to appr… |
CVE-2026-33576 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network… |
CVE-2026-34506 | Medium | 4.3 | 2026-03-31 | OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended aut… |
CVE-2026-34505 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook… |
CVE-2026-32988 | High | 7.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and population are not pinn… |
CVE-2026-32982 | High | 7.5 | 2026-03-31 | OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages… |
CVE-2026-32977 | Medium | 6.3 | 2026-03-31 | OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during… |
CVE-2026-32976 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite co… |
CVE-2026-32971 | High | 7.1 | 2026-03-31 | OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the… |
CVE-2026-32970 | Low | 2.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are trea… |
CVE-2026-32921 | Medium | 6.3 | 2026-03-31 | OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phas… |
CVE-2026-32920 | High | 8.4 | 2026-03-31 | OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code exe… |
CVE-2026-32917 | Critical | 9.8 | 2026-03-31 | OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary… |
CVE-2026-32916 | Critical | 9.4 | 2026-03-31 | OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthe… |
CVE-2026-33575 | High | 7.5 | 2026-03-29 | OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Att… |
CVE-2026-33574 | Medium | 6.2 | 2026-03-29 | OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutabl… |
CVE-2026-33573 | High | 8.8 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permi… |
CVE-2026-33572 | High | 8.4 | 2026-03-29 | OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attac… |
CVE-2026-32987 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify… |
CVE-2026-32980 | High | 7.5 | 2026-03-29 | OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthentica… |
CVE-2026-32979 | High | 7.3 | 2026-03-29 | OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local code by modifying scripts between approval… |
CVE-2026-32978 | High | 8.0 | 2026-03-29 | OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners… |
CVE-2026-32975 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable gro… |
CVE-2026-32974 | High | 8.6 | 2026-03-29 | OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey… |
CVE-2026-32973 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and… |
CVE-2026-32972 | High | 7.1 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-o… |
CVE-2026-32924 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversat… |
CVE-2026-32923 | Medium | 5.4 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reaction ingestion that fails to enforce member users and roles allow… |
CVE-2026-32922 | Critical | 9.9 | 2026-03-29 | OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens w… |
CVE-2026-32919 | Medium | 6.1 | 2026-03-29 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with… |
CVE-2026-32918 | High | 8.4 | 2026-03-29 | OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or siblin… |
CVE-2026-32915 | High | 8.8 | 2026-03-29 | OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against… |
CVE-2026-32914 | High | 8.8 | 2026-03-29 | OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-o… |
CVE-2026-32846 | High | 7.5 | 2026-03-26 | OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation i… |
CVE-2026-32913 | Critical | 9.3 | 2026-03-23 | OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-ori… |
CVE-2026-27646 | Medium | 6.1 | 2026-03-23 | OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize ho… |
CVE-2026-27183 | Medium | 5.3 | 2026-03-23 | OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip… |
CVE-2026-32899 | Medium | 4.3 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-ev… |
CVE-2026-32898 | Medium | 5.4 | 2026-03-21 | OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall… |
CVE-2026-32897 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to ha… |
CVE-2026-32896 | Medium | 4.8 | 2026-03-21 | The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhoo… |
CVE-2026-32895 | Medium | 5.4 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to… |
CVE-2026-32067 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that a… |
CVE-2026-32065 | Medium | 4.8 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity… |
CVE-2026-32064 | High | 7.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated ac… |
CVE-2026-32058 | Low | 2.6 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously… |
CVE-2026-32057 | High | 7.1 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=co… |
CVE-2026-32056 | High | 7.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to by… |
CVE-2026-32055 | High | 7.6 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the w… |
CVE-2026-32054 | Medium | 6.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers t… |
CVE-2026-32053 | Medium | 6.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowin… |
CVE-2026-32052 | Medium | 6.4 | 2026-03-21 | OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands… |
CVE-2026-32051 | High | 8.8 | 2026-03-21 | OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner… |
CVE-2026-32050 | Low | 3.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enque… |
CVE-2026-32049 | High | 7.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel in… |
CVE-2026-32048 | High | 7.5 | 2026-03-21 | OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create chi… |
CVE-2026-32046 | Medium | 5.3 | 2026-03-21 | OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting rend… |
CVE-2026-32045 | Medium | 5.9 | 2026-03-21 | OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password… |
CVE-2026-32044 | Medium | 5.5 | 2026-03-21 | OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other arc… |
CVE-2026-32043 | Medium | 6.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is valida… |