Openclaw
Page 6 of 6 — Openclaw CVEs from a corpus of 539, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4039 | Medium | 6.3 | 2026-03-12 | A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler… |
CVE-2026-30741 | Critical | 9.8 | 2026-03-11 | A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Side prompt injection… |
CVE-2026-32063 | High | 7.1 | 2026-03-11 | OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-controlled environmen… |
CVE-2026-32062 | High | 7.5 | 2026-03-11 | OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media… |
CVE-2026-32061 | Medium | 4.4 | 2026-03-11 | OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outs… |
CVE-2026-32060 | High | 8.8 | 2026-03-11 | OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configure… |
CVE-2026-32059 | High | 8.8 | 2026-03-11 | OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allow… |
CVE-2026-29613 | Medium | 5.9 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based sole… |
CVE-2026-29612 | Medium | 5.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger… |
CVE-2026-29611 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling… |
CVE-2026-29610 | High | 8.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH enviro… |
CVE-2026-29609 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory… |
CVE-2026-29606 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the… |
CVE-2026-28486 | Medium | 6.1 | 2026-03-05 | OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrar… |
CVE-2026-28485 | High | 8.4 | 2026-03-05 | OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized loca… |
CVE-2026-28482 | High | 7.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory c… |
CVE-2026-28481 | Medium | 6.5 | 2026-03-05 | OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional… |
CVE-2026-28480 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immut… |
CVE-2026-28479 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vul… |
CVE-2026-28478 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limit… |
CVE-2026-28477 | High | 7.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSR… |
CVE-2026-28476 | High | 8.3 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base U… |
CVE-2026-28475 | Medium | 4.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measu… |
CVE-2026-28474 | Critical | 9.8 | 2026-03-05 | OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, all… |
CVE-2026-28473 | High | 8.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval req… |
CVE-2026-28472 | High | 8.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when… |
CVE-2026-28471 | Medium | 5.3 | 2026-03-05 | OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in which DM allowlist matching could be b… |
CVE-2026-28470 | Critical | 9.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary comma… |
CVE-2026-28469 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misr… |
CVE-2026-28468 | High | 7.7 | 2026-03-05 | OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiri… |
CVE-2026-28467 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain a server-side request forgery vulnerability in attachment and media URL hydration that allows remote attackers to f… |
CVE-2026-28466 | Critical | 9.9 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, a… |
CVE-2026-28465 | Medium | 5.9 | 2026-03-05 | OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to… |
CVE-2026-28464 | Medium | 5.9 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measu… |
CVE-2026-28463 | High | 8.4 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain an arbitrary file read vulnerability in the exec-approvals allowlist validation that checks pre-expansion argv tok… |
CVE-2026-28462 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download f… |
CVE-2026-28459 | High | 7.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitr… |
CVE-2026-28458 | High | 8.1 | 2026-03-05 | OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in… |
CVE-2026-28457 | Medium | 6.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring (must be enabled) that uses the skill frontmatter name p… |
CVE-2026-28456 | High | 7.2 | 2026-03-05 | OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths b… |
CVE-2026-28454 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to… |
CVE-2026-28453 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the i… |
CVE-2026-28452 | Medium | 5.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers… |
CVE-2026-28451 | High | 8.3 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-control… |
CVE-2026-28450 | Medium | 6.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and… |
CVE-2026-28448 | High | 7.3 | 2026-03-05 | OpenClaw versions 2026.1.29 prior to 2026.2.1 contain a vulnerability in the Twitch plugin (must be installed and enabled) in which it fails to enforce the all… |
CVE-2026-28447 | High | 8.1 | 2026-03-05 | OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names t… |
CVE-2026-28446 | Critical | 9.4 | 2026-03-05 | OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist pol… |
CVE-2026-28395 | Medium | 6.5 | 2026-03-05 | OpenClaw version 2026.1.14-1 prior to 2026.2.12 contains an improper network binding vulnerability in the Chrome extension (must be installed and enabled) rela… |
CVE-2026-28394 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through… |
CVE-2026-28393 | High | 7.7 | 2026-03-05 | OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execu… |
CVE-2026-28392 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct mes… |
CVE-2026-28391 | Critical | 9.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allo… |
CVE-2026-28363 | Critical | 9.9 | 2026-02-27 | In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlis… |
CVE-2026-27576 | Medium | 4.0 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt pa… |
CVE-2026-27488 | High | 7.3 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook tar… |
CVE-2026-27487 | High | 7.6 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell com… |
CVE-2026-27486 | Medium | 5.3 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern… |
CVE-2026-27485 | Medium | 4.4 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors pa… |
CVE-2026-27484 | Medium | 4.3 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from req… |
CVE-2026-27009 | Medium | 5.8 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar)… |
CVE-2026-27008 | Medium | 6.7 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in `download` skill installation allowed `targetDir` values from skill frontmatter to re… |
CVE-2026-27007 | Low | 3.3 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, `normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that conta… |
CVE-2026-27004 | Medium | 5.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools (`sessions_list`, `sessions_history`… |
CVE-2026-27003 | Medium | 5.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.tel… |
CVE-2026-27002 | Critical | 9.8 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker option… |
CVE-2026-27001 | High | 7.8 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, OpenClaw embedded the current working directory (workspace path) into the agent system prompt… |
CVE-2026-26972 | Medium | 6.7 | 2026-02-20 | OpenClaw is a personal AI assistant. In versions 2026.1.12 through 2026.2.12, OpenClaw browser download helpers accepted an unsanitized output path. When invok… |
CVE-2026-26329 | Medium | 6.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, authenticated attackers can read arbitrary files from the Gateway host by supplying absolute p… |
CVE-2026-26328 | Medium | 6.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender ident… |
CVE-2026-26327 | Medium | 6.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Discovery beacons (Bonjour/mDNS and DNS-SD) include TXT records such as `lanHost`, `tailnetDns`, `gatewayPort`, and `gatew… |
CVE-2026-26326 | Medium | 4.3 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, `skills.status` could disclose secrets to `operator.read` clients by returning raw resolved co… |
CVE-2026-26325 | High | 7.2 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, a mismatch between `rawCommand` and `command[]` in the node host `system.run` handler could ca… |
CVE-2026-26324 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to version 2026.2.14, OpenClaw's SSRF protection could be bypassed using full-form IPv4-mapped IPv6 literals such as… |
CVE-2026-26323 | High | 8.8 | 2026-02-19 | OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script `scripts/update-clawtributors.ts… |
CVE-2026-26322 | High | 7.6 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Gateway tool accepted a tool-supplied `gatewayUrl` without sufficient restriction… |
CVE-2026-26321 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlle… |
CVE-2026-26320 | Medium | 6.5 | 2026-02-19 | OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unatten… |
CVE-2026-26319 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbo… |
CVE-2026-26317 | High | 7.1 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origi… |
CVE-2026-26316 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based… |
CVE-2026-25474 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may… |
CVE-2026-24764 | Low | 3.7 | 2026-02-19 | OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled… |
CVE-2026-25593 | High | 8.4 | 2026-02-06 | OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply a… |
CVE-2026-25475 | Medium | 6.5 | 2026-02-04 | OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolu… |
CVE-2026-25157 | High | 7.7 | 2026-02-04 | OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. Th… |
CVE-2026-24763 | High | 8.8 | 2026-02-02 | OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw… |
CVE-2026-25253 | High | 8.8 | 2026-02-01 | OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without promp… |