Openclaw
Page 6 of 7 — Openclaw CVEs from a corpus of 668, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32042 | High | 8.8 | 2026-03-21 | OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requ… |
CVE-2026-22172 | Critical | 9.9 | 2026-03-20 | OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authentic… |
CVE-2026-32041 | Medium | 6.9 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessibl… |
CVE-2026-32040 | Medium | 4.6 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript… |
CVE-2026-32039 | Medium | 5.9 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the toolsBySender group policy matching that allows attackers to inherit… |
CVE-2026-32038 | Critical | 9.8 | 2026-03-19 | OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace… |
CVE-2026-32037 | Medium | 6.0 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads… |
CVE-2026-32036 | Medium | 6.5 | 2026-03-19 | OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks b… |
CVE-2026-32035 | Medium | 5.9 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default… |
CVE-2026-32034 | High | 8.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gate… |
CVE-2026-32033 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validati… |
CVE-2026-32032 | High | 7.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path fr… |
CVE-2026-32031 | Medium | 4.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 server-http contains an authentication bypass vulnerability in gateway authentication for plugin channel endpoints due to… |
CVE-2026-32030 | High | 7.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that accepts arbitrary absolute paths when iMessa… |
CVE-2026-32029 | Medium | 5.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allow… |
CVE-2026-32028 | Medium | 5.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications, allowing non… |
CVE-2026-32027 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowli… |
CVE-2026-32026 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temp… |
CVE-2026-32025 | High | 7.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks… |
CVE-2026-32024 | Medium | 5.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the con… |
CVE-2026-32023 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers ca… |
CVE-2026-32022 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the grep tool within tools.exec.safeBins that allows attackers to read… |
CVE-2026-32021 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the Feishu allowFrom allowlist implementation that accepts mutable sender… |
CVE-2026-32020 | Low | 3.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file r… |
CVE-2026-32019 | High | 7.4 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ra… |
CVE-2026-32018 | Low | 3.6 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox contain… |
CVE-2026-32017 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain an allowlist bypass vulnerability in the exec safeBins policy that allows attackers to write arbitrary files using… |
CVE-2026-32016 | High | 7.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 on macOS contain a path validation bypass vulnerability in the exec-approval allowlist mode that allows local attackers to… |
CVE-2026-32015 | High | 7.8 | 2026-03-19 | OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that allows attackers to bypass allowlist checks b… |
CVE-2026-32014 | High | 8.0 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client wi… |
CVE-2026-32013 | High | 8.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and wri… |
CVE-2026-32011 | High | 7.5 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Google Chat that parse request bodies bef… |
CVE-2026-32010 | Medium | 6.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safe-bin configuration when sort is manually added to tools.exec.safeBins… |
CVE-2026-32009 | Medium | 5.7 | 2026-03-19 | OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories includin… |
CVE-2026-32008 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authe… |
CVE-2026-32007 | Medium | 6.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to m… |
CVE-2026-32006 | Low | 3.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist… |
CVE-2026-32005 | Medium | 6.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks including block_action, view_submission, and view_cl… |
CVE-2026-32004 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mism… |
CVE-2026-32003 | Medium | 6.6 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an environment variable injection vulnerability in the system.run function that allows attackers to bypass command… |
CVE-2026-32002 | Medium | 5.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain a sandbox bypass vulnerability in the sandboxed image tool that fails to enforce tools.fs.workspaceOnly restrictio… |
CVE-2026-32001 | Medium | 5.4 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as… |
CVE-2026-32000 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with sh… |
CVE-2026-31999 | Medium | 6.3 | 2026-03-19 | OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files… |
CVE-2026-31998 | High | 8.6 | 2026-03-19 | OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist wit… |
CVE-2026-31997 | Medium | 6.0 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable… |
CVE-2026-31996 | Medium | 4.4 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vulnerability that allows attackers to execute unintended filesyst… |
CVE-2026-31995 | Medium | 5.3 | 2026-03-19 | OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allow… |
CVE-2026-31994 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd… |
CVE-2026-31993 | Medium | 4.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypa… |
CVE-2026-31992 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintend… |
CVE-2026-31991 | Low | 3.7 | 2026-03-19 | OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities fr… |
CVE-2026-31990 | Medium | 6.1 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media s… |
CVE-2026-31989 | High | 7.4 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-… |
CVE-2026-29608 | Medium | 6.7 | 2026-03-19 | OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can… |
CVE-2026-29607 | Medium | 6.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval… |
CVE-2026-28461 | High | 7.5 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trig… |
CVE-2026-28460 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by split… |
CVE-2026-28449 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without… |
CVE-2026-27670 | Medium | 5.3 | 2026-03-19 | OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended de… |
CVE-2026-27566 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper… |
CVE-2026-22176 | Medium | 6.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are writ… |
CVE-2026-27545 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended… |
CVE-2026-27524 | Medium | 4.3 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authori… |
CVE-2026-27523 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing attackers to bypass allowed-root and blocked-path checks via syml… |
CVE-2026-27522 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is uns… |
CVE-2026-22217 | Medium | 6.1 | 2026-03-18 | OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-control… |
CVE-2026-22181 | High | 7.6 | 2026-03-18 | OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when e… |
CVE-2026-22180 | Medium | 5.3 | 2026-03-18 | OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser output handling that allows writes outside intended root directo… |
CVE-2026-22179 | High | 7.2 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowl… |
CVE-2026-22178 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex i… |
CVE-2026-22177 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution… |
CVE-2026-22175 | High | 7.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through un… |
CVE-2026-22174 | Medium | 6.8 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to… |
CVE-2026-22171 | High | 8.2 | 2026-03-18 | OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated direc… |
CVE-2026-22170 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration ca… |
CVE-2026-22169 | Medium | 6.7 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers t… |
CVE-2026-22168 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrar… |
CVE-2026-32302 | High | 8.1 | 2026-03-13 | OpenClaw is a personal AI assistant. Prior to 2026.3.11, browser-originated WebSocket connections could bypass origin validation when gateway.auth.mode was set… |
CVE-2026-4040 | Low | 3.3 | 2026-03-12 | A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The ma… |
CVE-2026-4039 | Medium | 6.3 | 2026-03-12 | A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler… |
CVE-2026-30741 | Critical | 9.8 | 2026-03-11 | A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Side prompt injection… |
CVE-2026-32063 | High | 7.1 | 2026-03-11 | OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-controlled environmen… |
CVE-2026-32062 | High | 7.5 | 2026-03-11 | OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media… |
CVE-2026-32061 | Medium | 4.4 | 2026-03-11 | OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outs… |
CVE-2026-32060 | High | 8.8 | 2026-03-11 | OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configure… |
CVE-2026-32059 | High | 8.8 | 2026-03-11 | OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allow… |
CVE-2026-29613 | Medium | 5.9 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based sole… |
CVE-2026-29612 | Medium | 5.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger… |
CVE-2026-29611 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling… |
CVE-2026-29610 | High | 8.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH enviro… |
CVE-2026-29609 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory… |
CVE-2026-29606 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the… |
CVE-2026-28486 | Medium | 6.1 | 2026-03-05 | OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrar… |
CVE-2026-28485 | High | 8.4 | 2026-03-05 | OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized loca… |
CVE-2026-28482 | High | 7.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory c… |
CVE-2026-28481 | Medium | 6.5 | 2026-03-05 | OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional… |
CVE-2026-28480 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immut… |
CVE-2026-28479 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vul… |
CVE-2026-28478 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limit… |