{"version":"https://jsonfeed.org/version/1.1","title":"OpenClaw CVE tracker (OpenClawPro)","home_page_url":"https://www.openclawpro.ai/en/security/cve","feed_url":"https://www.openclawpro.ai/feeds/openclaw-cves.json","description":"OpenClaw vulnerabilities published on the NVD. 685 entries, fetched 2026-10-23.","_openclawpro":{"source":"NVD API 2.0","fetched_on":"2026-10-23","by_severity":{"MEDIUM":337,"HIGH":287,"LOW":30,"CRITICAL":31},"license":"Data from NIST NVD (public domain); compilation free to reuse with a link."},"items":[{"id":"CVE-2026-110689","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110689","title":"CVE-2026-110689 (MEDIUM 5.3)","content_text":"A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection…","date_published":"2026-10-14T00:00:00Z","date_modified":"2026-10-20T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-693"],"fixed_in":null}},{"id":"CVE-2026-108757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108757","title":"CVE-2026-108757 (MEDIUM 6.5)","content_text":"Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which…","date_published":"2026-10-11T00:00:00Z","date_modified":"2026-10-16T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-306"],"fixed_in":null}},{"id":"CVE-2026-108156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108156","title":"CVE-2026-108156 (HIGH 7.1)","content_text":"LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a…","date_published":"2026-10-09T00:00:00Z","date_modified":"2026-10-14T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-73"],"fixed_in":null}},{"id":"CVE-2026-101880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101880","title":"CVE-2026-101880 (HIGH 8.8)","content_text":"OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions.…","date_published":"2026-09-30T00:00:00Z","date_modified":"2026-10-01T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-101882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101882","title":"CVE-2026-101882 (HIGH 8.8)","content_text":"OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can…","date_published":"2026-09-30T00:00:00Z","date_modified":"2026-10-01T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-101884","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101884","title":"CVE-2026-101884 (HIGH 7.5)","content_text":"OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access…","date_published":"2026-09-30T00:00:00Z","date_modified":"2026-10-01T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-101879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101879","title":"CVE-2026-101879 (MEDIUM 6.5)","content_text":"OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without…","date_published":"2026-09-30T00:00:00Z","date_modified":"2026-10-02T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.7.1-3"}},{"id":"CVE-2026-101881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101881","title":"CVE-2026-101881 (MEDIUM 6.5)","content_text":"OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of…","date_published":"2026-09-30T00:00:00Z","date_modified":"2026-10-01T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-770"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-101883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101883","title":"CVE-2026-101883 (MEDIUM 5.4)","content_text":"OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue…","date_published":"2026-09-30T00:00:00Z","date_modified":"2026-10-02T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":null}},{"id":"CVE-2026-102806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102806","title":"CVE-2026-102806 (MEDIUM 6.3)","content_text":"OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the…","date_published":"2026-09-29T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.9.5"}},{"id":"CVE-2026-102807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102807","title":"CVE-2026-102807 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to execute MCP App tools requiring operator.write scope. Attackers with operator.read tokens can…","date_published":"2026-09-29T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.9.4"}},{"id":"CVE-2026-100544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100544","title":"CVE-2026-100544 (HIGH 8.8)","content_text":"openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100552","title":"CVE-2026-100552 (HIGH 8.8)","content_text":"OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell,…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100575","title":"CVE-2026-100575 (HIGH 8.8)","content_text":"OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100580","title":"CVE-2026-100580 (HIGH 8.8)","content_text":"OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-178"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100586","title":"CVE-2026-100586 (HIGH 8.8)","content_text":"OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native conversation bindings. Non-owner channel senders with command access can create bindings to the native Codex runtime and execute…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-269"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100587","title":"CVE-2026-100587 (HIGH 8.8)","content_text":"OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100596","title":"CVE-2026-100596 (HIGH 8.8)","content_text":"OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100599","title":"CVE-2026-100599 (HIGH 8.8)","content_text":"OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":null}},{"id":"CVE-2026-100551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100551","title":"CVE-2026-100551 (HIGH 8.3)","content_text":"OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-295"],"fixed_in":null}},{"id":"CVE-2026-100557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100557","title":"CVE-2026-100557 (HIGH 8.3)","content_text":"OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100568","title":"CVE-2026-100568 (HIGH 8.3)","content_text":"OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-200"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100588","title":"CVE-2026-100588 (HIGH 8.3)","content_text":"OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke method, although direct browser.request access requires administrator…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100589","title":"CVE-2026-100589 (HIGH 8.3)","content_text":"OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100567","title":"CVE-2026-100567 (HIGH 8.2)","content_text":"OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":8.2,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":null}},{"id":"CVE-2026-100559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100559","title":"CVE-2026-100559 (HIGH 8)","content_text":"OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":8,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100561","title":"CVE-2026-100561 (HIGH 8)","content_text":"OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":8,"severity":"HIGH","cwe":["CWE-88"],"fixed_in":null}},{"id":"CVE-2026-100585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100585","title":"CVE-2026-100585 (HIGH 8)","content_text":"OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100570","title":"CVE-2026-100570 (HIGH 7.8)","content_text":"OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-88"],"fixed_in":null}},{"id":"CVE-2026-100597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100597","title":"CVE-2026-100597 (HIGH 7.8)","content_text":"OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-367"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100578","title":"CVE-2026-100578 (HIGH 7.6)","content_text":"OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-269"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100579","title":"CVE-2026-100579 (HIGH 7.6)","content_text":"OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments (authentication modes that honor caller identity and narrower operator scopes), a…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-639"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100535","title":"CVE-2026-100535 (HIGH 7.5)","content_text":"OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":null}},{"id":"CVE-2026-100541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100541","title":"CVE-2026-100541 (HIGH 7.5)","content_text":"OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-178"],"fixed_in":null}},{"id":"CVE-2026-100543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100543","title":"CVE-2026-100543 (HIGH 7.5)","content_text":"OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-200"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100558","title":"CVE-2026-100558 (HIGH 7.5)","content_text":"OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-400"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100560","title":"CVE-2026-100560 (HIGH 7.5)","content_text":"OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100530","title":"CVE-2026-100530 (HIGH 7.3)","content_text":"OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100555","title":"CVE-2026-100555 (HIGH 7.1)","content_text":"OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":null}},{"id":"CVE-2026-100598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100598","title":"CVE-2026-100598 (HIGH 7.1)","content_text":"OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-346"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100540","title":"CVE-2026-100540 (MEDIUM 6.8)","content_text":"OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":6.8,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100584","title":"CVE-2026-100584 (MEDIUM 6.7)","content_text":"OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":6.7,"severity":"MEDIUM","cwe":["CWE-426"],"fixed_in":null}},{"id":"CVE-2026-100536","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100536","title":"CVE-2026-100536 (MEDIUM 6.5)","content_text":"OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100538","title":"CVE-2026-100538 (MEDIUM 6.5)","content_text":"OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100566","title":"CVE-2026-100566 (MEDIUM 6.5)","content_text":"OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100582","title":"CVE-2026-100582 (MEDIUM 6.5)","content_text":"OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message,…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100594","title":"CVE-2026-100594 (MEDIUM 6.5)","content_text":"OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-200"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100595","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100595","title":"CVE-2026-100595 (MEDIUM 6.5)","content_text":"OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-200"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100602","title":"CVE-2026-100602 (MEDIUM 6.5)","content_text":"ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":null}},{"id":"CVE-2026-100529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100529","title":"CVE-2026-100529 (MEDIUM 6.4)","content_text":"OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":6.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100546","title":"CVE-2026-100546 (MEDIUM 6.4)","content_text":"OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":6.4,"severity":"MEDIUM","cwe":["CWE-362"],"fixed_in":null}},{"id":"CVE-2026-100556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100556","title":"CVE-2026-100556 (MEDIUM 6.3)","content_text":"OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":null}},{"id":"CVE-2026-100577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100577","title":"CVE-2026-100577 (MEDIUM 6.3)","content_text":"OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100591","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100591","title":"CVE-2026-100591 (MEDIUM 6.3)","content_text":"OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100592","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100592","title":"CVE-2026-100592 (MEDIUM 6.3)","content_text":"OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":null}},{"id":"CVE-2026-100574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100574","title":"CVE-2026-100574 (MEDIUM 5.9)","content_text":"OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":5.9,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100547","title":"CVE-2026-100547 (MEDIUM 5.5)","content_text":"OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:` URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-180"],"fixed_in":null}},{"id":"CVE-2026-100569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100569","title":"CVE-2026-100569 (MEDIUM 5.5)","content_text":"OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in `_ENDPOINT`, so an untrusted workspace `.env` file could set…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-522"],"fixed_in":null}},{"id":"CVE-2026-100581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100581","title":"CVE-2026-100581 (MEDIUM 5.5)","content_text":"OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-312"],"fixed_in":"2026.8.11"}},{"id":"CVE-2026-100528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100528","title":"CVE-2026-100528 (MEDIUM 5.4)","content_text":"OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-200"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100549","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100549","title":"CVE-2026-100549 (MEDIUM 5.4)","content_text":"OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100550","title":"CVE-2026-100550 (MEDIUM 5.4)","content_text":"OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100562","title":"CVE-2026-100562 (MEDIUM 5.4)","content_text":"OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100563","title":"CVE-2026-100563 (MEDIUM 5.4)","content_text":"OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-1236"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100564","title":"CVE-2026-100564 (MEDIUM 5.4)","content_text":"OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-1236"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100576","title":"CVE-2026-100576 (MEDIUM 5.4)","content_text":"OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100593","title":"CVE-2026-100593 (MEDIUM 5.4)","content_text":"OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group channels. An authorized non-owner channel sender can change whether the agent…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100603","title":"CVE-2026-100603 (MEDIUM 5.4)","content_text":"ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-799"],"fixed_in":null}},{"id":"CVE-2026-100604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100604","title":"CVE-2026-100604 (MEDIUM 5.4)","content_text":"ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":null}},{"id":"CVE-2026-100526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100526","title":"CVE-2026-100526 (MEDIUM 5.3)","content_text":"OpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.9.3"}},{"id":"CVE-2026-100527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100527","title":"CVE-2026-100527 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-400"],"fixed_in":"2026.8.2"}},{"id":"CVE-2026-100533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100533","title":"CVE-2026-100533 (MEDIUM 5.3)","content_text":"OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100545","title":"CVE-2026-100545 (MEDIUM 5.3)","content_text":"OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100548","title":"CVE-2026-100548 (MEDIUM 5.3)","content_text":"OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-200"],"fixed_in":null}},{"id":"CVE-2026-100571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100571","title":"CVE-2026-100571 (MEDIUM 5.3)","content_text":"OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-400"],"fixed_in":null}},{"id":"CVE-2026-100572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100572","title":"CVE-2026-100572 (MEDIUM 5.3)","content_text":"OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-400"],"fixed_in":null}},{"id":"CVE-2026-100600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100600","title":"CVE-2026-100600 (MEDIUM 5.3)","content_text":"ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests share a single default quota allowance. A remote, unauthenticated caller can…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-770"],"fixed_in":null}},{"id":"CVE-2026-100601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100601","title":"CVE-2026-100601 (MEDIUM 5.3)","content_text":"ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":null}},{"id":"CVE-2026-100525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100525","title":"CVE-2026-100525 (MEDIUM 4.3)","content_text":"The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.9.3"}},{"id":"CVE-2026-100553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100553","title":"CVE-2026-100553 (MEDIUM 4.3)","content_text":"OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":null}},{"id":"CVE-2026-100583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100583","title":"CVE-2026-100583 (MEDIUM 4.3)","content_text":"OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100590","title":"CVE-2026-100590 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel senders to persist Gateway voice configuration. Attackers with command access can change the voice…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.7.1"}},{"id":"CVE-2026-100554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100554","title":"CVE-2026-100554 (MEDIUM 4.2)","content_text":"OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":4.2,"severity":"MEDIUM","cwe":["CWE-613"],"fixed_in":null}},{"id":"CVE-2026-100573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100573","title":"CVE-2026-100573 (LOW 3.3)","content_text":"OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-30T00:00:00Z","_openclawpro":{"cvss":3.3,"severity":"LOW","cwe":["CWE-862"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100534","title":"CVE-2026-100534 (LOW 3.1)","content_text":"OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":3.1,"severity":"LOW","cwe":["CWE-639"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100537","title":"CVE-2026-100537 (LOW 3.1)","content_text":"OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules,…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-29T00:00:00Z","_openclawpro":{"cvss":3.1,"severity":"LOW","cwe":["CWE-862"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-100542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100542","title":"CVE-2026-100542 (LOW 3.1)","content_text":"OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-09-28T00:00:00Z","_openclawpro":{"cvss":3.1,"severity":"LOW","cwe":["CWE-400"],"fixed_in":null}},{"id":"CVE-2026-100539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100539","title":"CVE-2026-100539 (LOW 2.6)","content_text":"OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory_get tool instances retain the enabled configuration captured at…","date_published":"2026-09-26T00:00:00Z","date_modified":"2026-10-05T00:00:00Z","_openclawpro":{"cvss":2.6,"severity":"LOW","cwe":["CWE-863"],"fixed_in":"2026.8.1"}},{"id":"CVE-2026-95815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95815","title":"CVE-2026-95815 (MEDIUM 6.3)","content_text":"OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged…","date_published":"2026-09-22T00:00:00Z","date_modified":"2026-09-24T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-532"],"fixed_in":"2026.8.11"}},{"id":"CVE-2026-94094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94094","title":"CVE-2026-94094 (MEDIUM 4.3)","content_text":"A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of…","date_published":"2026-09-20T00:00:00Z","date_modified":"2026-09-22T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-404"],"fixed_in":null}},{"id":"CVE-2026-91835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91835","title":"CVE-2026-91835 (LOW 2.8)","content_text":"A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation…","date_published":"2026-09-15T00:00:00Z","date_modified":"2026-09-16T00:00:00Z","_openclawpro":{"cvss":2.8,"severity":"LOW","cwe":["CWE-436"],"fixed_in":null}},{"id":"CVE-2026-91836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91836","title":"CVE-2026-91836 (LOW 2.8)","content_text":"A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors.…","date_published":"2026-09-15T00:00:00Z","date_modified":"2026-09-20T00:00:00Z","_openclawpro":{"cvss":2.8,"severity":"LOW","cwe":["CWE-1023"],"fixed_in":null}},{"id":"CVE-2026-90818","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90818","title":"CVE-2026-90818 (MEDIUM 4.3)","content_text":"A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component…","date_published":"2026-09-14T00:00:00Z","date_modified":"2026-09-16T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":null}},{"id":"CVE-2026-19006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19006","title":"CVE-2026-19006 (MEDIUM 6.3)","content_text":"A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The…","date_published":"2026-08-06T00:00:00Z","date_modified":"2026-08-12T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-285","CWE-863"],"fixed_in":null}},{"id":"CVE-2026-19007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19007","title":"CVE-2026-19007 (MEDIUM 6.3)","content_text":"A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege…","date_published":"2026-08-06T00:00:00Z","date_modified":"2026-08-12T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-266","CWE-269"],"fixed_in":null}},{"id":"CVE-2026-19008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19008","title":"CVE-2026-19008 (MEDIUM 6.3)","content_text":"A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component apply_patch Tool. Such manipulation leads to link…","date_published":"2026-08-06T00:00:00Z","date_modified":"2026-08-12T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-59"],"fixed_in":null}},{"id":"CVE-2026-66418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66418","title":"CVE-2026-66418 (CRITICAL 9.3)","content_text":"OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request,…","date_published":"2026-07-30T00:00:00Z","date_modified":"2026-09-03T00:00:00Z","_openclawpro":{"cvss":9.3,"severity":"CRITICAL","cwe":["CWE-79"],"fixed_in":null}},{"id":"CVE-2026-66421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66421","title":"CVE-2026-66421 (CRITICAL 9.3)","content_text":"OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript…","date_published":"2026-07-30T00:00:00Z","date_modified":"2026-09-03T00:00:00Z","_openclawpro":{"cvss":9.3,"severity":"CRITICAL","cwe":["CWE-79"],"fixed_in":null}},{"id":"CVE-2026-17458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17458","title":"CVE-2026-17458 (MEDIUM 6.3)","content_text":"A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in…","date_published":"2026-07-26T00:00:00Z","date_modified":"2026-07-27T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":null}},{"id":"CVE-2026-17457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17457","title":"CVE-2026-17457 (MEDIUM 4.3)","content_text":"A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of…","date_published":"2026-07-26T00:00:00Z","date_modified":"2026-07-27T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-200","CWE-284"],"fixed_in":null}},{"id":"CVE-2026-62202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62202","title":"CVE-2026-62202 (HIGH 8.8)","content_text":"OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.6.9"}},{"id":"CVE-2026-62203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62203","title":"CVE-2026-62203 (HIGH 8.8)","content_text":"OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-29T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.6.6"}},{"id":"CVE-2026-62207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62207","title":"CVE-2026-62207 (HIGH 8.8)","content_text":"OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools. Attackers can perform actions requiring stronger authorization by exploiting insufficient…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-29T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.6.5"}},{"id":"CVE-2026-62217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62217","title":"CVE-2026-62217 (HIGH 8.8)","content_text":"OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.5.27"}},{"id":"CVE-2026-62218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62218","title":"CVE-2026-62218 (HIGH 8.8)","content_text":"OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management checks. Attackers can perform actions requiring stronger…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.5.27"}},{"id":"CVE-2026-62223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62223","title":"CVE-2026-62223 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-20T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-62228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62228","title":"CVE-2026-62228 (HIGH 8.8)","content_text":"OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node environments.…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-29T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.6.5"}},{"id":"CVE-2026-62229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62229","title":"CVE-2026-62229 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended authorization. Attackers can craft input paths that traverse the…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-30T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-62226","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62226","title":"CVE-2026-62226 (HIGH 8.5)","content_text":"OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":8.5,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.5.19"}},{"id":"CVE-2026-62209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62209","title":"CVE-2026-62209 (HIGH 8.1)","content_text":"OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.6.5"}},{"id":"CVE-2026-62215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62215","title":"CVE-2026-62215 (HIGH 8)","content_text":"OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-20T00:00:00Z","_openclawpro":{"cvss":8,"severity":"HIGH","cwe":["CWE-345"],"fixed_in":"2026.6.5"}},{"id":"CVE-2026-62222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62222","title":"CVE-2026-62222 (HIGH 7.8)","content_text":"OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-29T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-829"],"fixed_in":"2026.5.22"}},{"id":"CVE-2026-62201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62201","title":"CVE-2026-62201 (HIGH 7.7)","content_text":"OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-20T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.6.6"}},{"id":"CVE-2026-62227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62227","title":"CVE-2026-62227 (HIGH 7.7)","content_text":"OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.5.26"}},{"id":"CVE-2026-62205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62205","title":"CVE-2026-62205 (HIGH 7.1)","content_text":"OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.6.6"}},{"id":"CVE-2026-62206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62206","title":"CVE-2026-62206 (HIGH 7.1)","content_text":"OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-20T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.6.9"}},{"id":"CVE-2026-62212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62212","title":"CVE-2026-62212 (HIGH 7.1)","content_text":"OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-20T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-367"],"fixed_in":"2026.5.28"}},{"id":"CVE-2026-62219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62219","title":"CVE-2026-62219 (HIGH 7.1)","content_text":"OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs,…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.5.26"}},{"id":"CVE-2026-62208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62208","title":"CVE-2026-62208 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-20T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-522"],"fixed_in":"2026.6.5"}},{"id":"CVE-2026-62210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62210","title":"CVE-2026-62210 (MEDIUM 6.5)","content_text":"OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-770"],"fixed_in":"2026.6.1"}},{"id":"CVE-2026-62213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62213","title":"CVE-2026-62213 (MEDIUM 6.5)","content_text":"OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-522"],"fixed_in":"2026.5.27"}},{"id":"CVE-2026-62214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62214","title":"CVE-2026-62214 (MEDIUM 6.5)","content_text":"OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-522"],"fixed_in":"2026.5.28"}},{"id":"CVE-2026-62221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62221","title":"CVE-2026-62221 (MEDIUM 5.4)","content_text":"OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.5.26"}},{"id":"CVE-2026-62224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62224","title":"CVE-2026-62224 (MEDIUM 5.4)","content_text":"OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-290","CWE-863"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-62225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62225","title":"CVE-2026-62225 (MEDIUM 5.4)","content_text":"OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-62220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62220","title":"CVE-2026-62220 (MEDIUM 5.3)","content_text":"OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input,…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-307"],"fixed_in":"2026.5.26"}},{"id":"CVE-2026-62211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62211","title":"CVE-2026-62211 (MEDIUM 5)","content_text":"OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that should remain within trusted boundaries. Attackers can exploit…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-29T00:00:00Z","_openclawpro":{"cvss":5,"severity":"MEDIUM","cwe":["CWE-532"],"fixed_in":"2026.6.1"}},{"id":"CVE-2026-62216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62216","title":"CVE-2026-62216 (MEDIUM 5)","content_text":"OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by…","date_published":"2026-07-17T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":5,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":"2026.5.28"}},{"id":"CVE-2026-62190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62190","title":"CVE-2026-62190 (HIGH 8.8)","content_text":"OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-15T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-706","CWE-863"],"fixed_in":"2026.6.9"}},{"id":"CVE-2026-62194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62194","title":"CVE-2026-62194 (HIGH 8.8)","content_text":"OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-15T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-732","CWE-862"],"fixed_in":"2026.6.9"}},{"id":"CVE-2026-62199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62199","title":"CVE-2026-62199 (HIGH 8.8)","content_text":"OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-15T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.6.6"}},{"id":"CVE-2026-62200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62200","title":"CVE-2026-62200 (HIGH 8.8)","content_text":"OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-15T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.6.6"}},{"id":"CVE-2026-62197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62197","title":"CVE-2026-62197 (HIGH 8.5)","content_text":"OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-14T00:00:00Z","_openclawpro":{"cvss":8.5,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.6.6"}},{"id":"CVE-2026-62195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62195","title":"CVE-2026-62195 (HIGH 8.3)","content_text":"OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-15T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-732"],"fixed_in":"2026.6.6"}},{"id":"CVE-2026-62196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62196","title":"CVE-2026-62196 (HIGH 8.3)","content_text":"OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-09-05T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.6.6"}},{"id":"CVE-2026-62187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62187","title":"CVE-2026-62187 (HIGH 8.1)","content_text":"OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":null}},{"id":"CVE-2026-62188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62188","title":"CVE-2026-62188 (HIGH 8.1)","content_text":"OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":null}},{"id":"CVE-2026-62192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62192","title":"CVE-2026-62192 (HIGH 8.1)","content_text":"OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-14T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.6.9"}},{"id":"CVE-2026-62186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62186","title":"CVE-2026-62186 (HIGH 7.6)","content_text":"OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-14T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-862","CWE-863"],"fixed_in":"2026.6.8"}},{"id":"CVE-2026-62189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62189","title":"CVE-2026-62189 (HIGH 7.1)","content_text":"OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-15T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-59","CWE-367"],"fixed_in":"2026.6.9"}},{"id":"CVE-2026-62191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62191","title":"CVE-2026-62191 (HIGH 7.1)","content_text":"OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-14T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-862","CWE-863"],"fixed_in":"2026.6.9"}},{"id":"CVE-2026-62193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62193","title":"CVE-2026-62193 (MEDIUM 4.9)","content_text":"OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or a…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-15T00:00:00Z","_openclawpro":{"cvss":4.9,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.6.9"}},{"id":"CVE-2026-62198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62198","title":"CVE-2026-62198 (MEDIUM 4.3)","content_text":"OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stronger policy checks. Attackers can exploit misconfigured…","date_published":"2026-07-13T00:00:00Z","date_modified":"2026-07-14T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.6.6"}},{"id":"CVE-2026-15193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15193","title":"CVE-2026-15193 (MEDIUM 5.3)","content_text":"A vulnerability was determined in AidanPark openclaw-android up to 0.4.0. The affected element is an unknown function of the file android/app/src/main/java/com/openclaw/android/JsBridge.kt of the component Android WebView Bridge. This…","date_published":"2026-07-09T00:00:00Z","date_modified":"2026-07-09T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-77","CWE-78"],"fixed_in":null}},{"id":"CVE-2026-59261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59261","title":"CVE-2026-59261 (HIGH 7.1)","content_text":"OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials…","date_published":"2026-07-08T00:00:00Z","date_modified":"2026-07-09T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-184","CWE-522"],"fixed_in":"2026.5.28"}},{"id":"CVE-2026-55249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55249","title":"CVE-2026-55249 (MEDIUM 6.3)","content_text":"@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed…","date_published":"2026-06-23T00:00:00Z","date_modified":"2026-07-01T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-78"],"fixed_in":null}},{"id":"CVE-2026-53843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53843","title":"CVE-2026-53843 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-613"],"fixed_in":"2026.5.26"}},{"id":"CVE-2026-53853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53853","title":"CVE-2026-53853 (HIGH 8.3)","content_text":"OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables on Linux and macOS systems. Attackers can bypass configured…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-693","CWE-863"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-53849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53849","title":"CVE-2026-53849 (HIGH 8.1)","content_text":"OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-290"],"fixed_in":"2026.5.7"}},{"id":"CVE-2026-53855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53855","title":"CVE-2026-53855 (HIGH 8.1)","content_text":"OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-184","CWE-863"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-53857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53857","title":"CVE-2026-53857 (HIGH 8.1)","content_text":"OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-290"],"fixed_in":"2026.5.3"}},{"id":"CVE-2026-53864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53864","title":"CVE-2026-53864 (HIGH 8.1)","content_text":"OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.5.26"}},{"id":"CVE-2026-53866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53866","title":"CVE-2026-53866 (HIGH 8.1)","content_text":"OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands. A command request using shell inline-command forms could route…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-53840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53840","title":"CVE-2026-53840 (HIGH 7.1)","content_text":"OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-522"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-53842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53842","title":"CVE-2026-53842 (HIGH 7.1)","content_text":"OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-426"],"fixed_in":"2026.5.2"}},{"id":"CVE-2026-53846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53846","title":"CVE-2026-53846 (HIGH 7.1)","content_text":"OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-426"],"fixed_in":"2026.4.29"}},{"id":"CVE-2026-53858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53858","title":"CVE-2026-53858 (HIGH 7.1)","content_text":"OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-426"],"fixed_in":"2026.5.2"}},{"id":"CVE-2026-53863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53863","title":"CVE-2026-53863 (HIGH 7.1)","content_text":"OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a group ID to the policy resolver could trigger incorrect group-policy…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-639"],"fixed_in":"2026.4.25"}},{"id":"CVE-2026-53865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53865","title":"CVE-2026-53865 (HIGH 7.1)","content_text":"OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-426"],"fixed_in":"2026.5.2"}},{"id":"CVE-2026-53861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53861","title":"CVE-2026-53861 (MEDIUM 6.6)","content_text":"OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers can execute shell content outside the intended allowlist check by using…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":6.6,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":"2026.5.6"}},{"id":"CVE-2026-53844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53844","title":"CVE-2026-53844 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.29"}},{"id":"CVE-2026-53854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53854","title":"CVE-2026-53854 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom state across channel boundaries. Attackers can exploit this by…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.4.25"}},{"id":"CVE-2026-53859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53859","title":"CVE-2026-53859 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model or workspace-derived URLs. Attackers can exploit inconsistent hostname checks…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-918","CWE-1023"],"fixed_in":"2026.5.26"}},{"id":"CVE-2026-53841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53841","title":"CVE-2026-53841 (MEDIUM 6.1)","content_text":"OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-83"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-53850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53850","title":"CVE-2026-53850 (MEDIUM 5.5)","content_text":"OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.25"}},{"id":"CVE-2026-53856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53856","title":"CVE-2026-53856 (MEDIUM 5.5)","content_text":"OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-18T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-732"],"fixed_in":"2026.4.24"}},{"id":"CVE-2026-53847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53847","title":"CVE-2026-53847 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges.…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-266"],"fixed_in":"2026.5.6"}},{"id":"CVE-2026-53852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53852","title":"CVE-2026-53852 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-636"],"fixed_in":"2026.4.25"}},{"id":"CVE-2026-53851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53851","title":"CVE-2026-53851 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-53845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53845","title":"CVE-2026-53845 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-693"],"fixed_in":"2026.5.6"}},{"id":"CVE-2026-53848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53848","title":"CVE-2026-53848 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":"2026.5.26"}},{"id":"CVE-2026-53860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53860","title":"CVE-2026-53860 (MEDIUM 4.2)","content_text":"OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather than stable sender identity. Attackers can influence…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.2,"severity":"MEDIUM","cwe":["CWE-807","CWE-863"],"fixed_in":"2026.5.7"}},{"id":"CVE-2026-53862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53862","title":"CVE-2026-53862 (MEDIUM 4.2)","content_text":"OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate…","date_published":"2026-06-16T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.2,"severity":"MEDIUM","cwe":["CWE-266","CWE-345"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-53838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53838","title":"CVE-2026-53838 (CRITICAL 9.8)","content_text":"OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. Attackers can exploit reconnection logic to restore or present broader node…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-367"],"fixed_in":"2026.5.27"}},{"id":"CVE-2026-53821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53821","title":"CVE-2026-53821 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-53822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53822","title":"CVE-2026-53822 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuild command arguments after allowlist approval to execute unapproved command…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-367","CWE-77"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-53828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53828","title":"CVE-2026-53828 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without proper policy enforcement. Attackers can trigger native command…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.5.6"}},{"id":"CVE-2026-53836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53836","title":"CVE-2026-53836 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-53831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53831","title":"CVE-2026-53831 (HIGH 8.3)","content_text":"OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-367"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-53823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53823","title":"CVE-2026-53823 (HIGH 8.1)","content_text":"OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries,…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-290"],"fixed_in":"2026.5.3"}},{"id":"CVE-2026-53829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53829","title":"CVE-2026-53829 (HIGH 8)","content_text":"OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":8,"severity":"HIGH","cwe":["CWE-451"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-53832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53832","title":"CVE-2026-53832 (HIGH 7.7)","content_text":"OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-290"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-53833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53833","title":"CVE-2026-53833 (HIGH 7.7)","content_text":"OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-290"],"fixed_in":"2026.4.29"}},{"id":"CVE-2026-53834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53834","title":"CVE-2026-53834 (HIGH 7.5)","content_text":"OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-20T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.4.27"}},{"id":"CVE-2026-53820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53820","title":"CVE-2026-53820 (MEDIUM 6.6)","content_text":"OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to bypass intended command restrictions. Attackers can reach the affected bundled…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":6.6,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-53824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53824","title":"CVE-2026-53824 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-613"],"fixed_in":"2026.4.24"}},{"id":"CVE-2026-53825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53825","title":"CVE-2026-53825 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources.…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.4.7"}},{"id":"CVE-2026-53827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53827","title":"CVE-2026-53827 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata to forward action payloads with Gateway credentials to attacker-supplied loopback URLs. Remote…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":"2026.5.2"}},{"id":"CVE-2026-53830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53830","title":"CVE-2026-53830 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active after secrets.reload. Attackers can exploit the stale-secret window to deliver…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-613"],"fixed_in":"2026.4.22"}},{"id":"CVE-2026-53839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53839","title":"CVE-2026-53839 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-1023"],"fixed_in":"2026.5.7"}},{"id":"CVE-2026-53826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53826","title":"CVE-2026-53826 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exploit this by spawning child sessions from sandboxed parents…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-668"],"fixed_in":"2026.4.26"}},{"id":"CVE-2026-53835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53835","title":"CVE-2026-53835 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that allows authenticated senders to create or update bindings without honoring configured config-write controls.…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.5.6"}},{"id":"CVE-2026-53837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53837","title":"CVE-2026-53837 (LOW 3.7)","content_text":"OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events…","date_published":"2026-06-12T00:00:00Z","date_modified":"2026-07-23T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-636"],"fixed_in":"2026.5.6"}},{"id":"CVE-2026-53806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53806","title":"CVE-2026-53806 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers can exploit this by using combined shell options to execute inline shell…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-367"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-53807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53807","title":"CVE-2026-53807 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.5.6"}},{"id":"CVE-2026-53810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53810","title":"CVE-2026-53810 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-829"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-53811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53811","title":"CVE-2026-53811 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom feature that allows authenticated accounts to match policy entries through mutable display name metadata. Attackers with the ability to…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-290"],"fixed_in":"2026.5.7"}},{"id":"CVE-2026-53817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53817","title":"CVE-2026-53817 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens. Attackers can exploit…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-290"],"fixed_in":"2026.5.22"}},{"id":"CVE-2026-53819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53819","title":"CVE-2026-53819 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-426"],"fixed_in":"2026.5.27"}},{"id":"CVE-2026-53814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53814","title":"CVE-2026-53814 (HIGH 8.3)","content_text":"OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority instead of hook-appropriate scope. Attackers with a valid hook token can…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-266"],"fixed_in":"2026.5.20"}},{"id":"CVE-2026-53813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53813","title":"CVE-2026-53813 (HIGH 7.8)","content_text":"OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution. Attackers with access to affected workspaces can load memory-core…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-427"],"fixed_in":"2026.4.25"}},{"id":"CVE-2026-53812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53812","title":"CVE-2026-53812 (HIGH 7.7)","content_text":"OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-53816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53816","title":"CVE-2026-53816 (HIGH 7.2)","content_text":"OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.2,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-53818","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53818","title":"CVE-2026-53818 (MEDIUM 6.6)","content_text":"OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies and before-tool-call hooks. Attackers can invoke owner-only behavior…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.6,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.24"}},{"id":"CVE-2026-53808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53808","title":"CVE-2026-53808 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true despite approvalPolicy: pending configuration. Attackers can exploit this by…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.5.6"}},{"id":"CVE-2026-53815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53815","title":"CVE-2026-53815 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.5.19"}},{"id":"CVE-2026-53809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53809","title":"CVE-2026-53809 (LOW 3.8)","content_text":"OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this…","date_published":"2026-06-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.8,"severity":"LOW","cwe":["CWE-863"],"fixed_in":"2026.4.25"}},{"id":"CVE-2026-35674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35674","title":"CVE-2026-35674 (HIGH 8.8)","content_text":"OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited…","date_published":"2026-05-29T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-32905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32905","title":"CVE-2026-32905 (HIGH 8.3)","content_text":"OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers…","date_published":"2026-05-29T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.5.4"}},{"id":"CVE-2026-35630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35630","title":"CVE-2026-35630 (HIGH 8)","content_text":"OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or…","date_published":"2026-05-29T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.5.18"}},{"id":"CVE-2026-35673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35673","title":"CVE-2026-35673 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers with access to these routes can bypass private-network SSRF policies by…","date_published":"2026-05-29T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.4.29"}},{"id":"CVE-2026-34507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34507","title":"CVE-2026-34507 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated senders to skip DM-only and allowFrom policy checks. Attackers can route admin commands from unauthorized senders or…","date_published":"2026-05-29T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.4.29"}},{"id":"CVE-2026-32906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32906","title":"CVE-2026-32906 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals that allows exec-authorized users to resolve plugin approvals through the exec approver gate. Attackers with limited exec approval…","date_published":"2026-05-29T00:00:00Z","date_modified":"2026-07-21T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.5.12"}},{"id":"CVE-2026-45006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45006","title":"CVE-2026-45006 (HIGH 8.8)","content_text":"OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configuration changes by bypassing an incomplete…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.4.23"}},{"id":"CVE-2026-45004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45004","title":"CVE-2026-45004 (HIGH 7.8)","content_text":"OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-427"],"fixed_in":"2026.4.23"}},{"id":"CVE-2026-44995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44995","title":"CVE-2026-44995 (HIGH 7.3)","content_text":"OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code. Malicious workspace configurations can pass dangerous…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-829"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-8305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8305","title":"CVE-2026-8305 (HIGH 7.3)","content_text":"A vulnerability was detected in OpenClaw up to 2026.1.24. The impacted element is the function handleBlueBubblesWebhookRequest of the file extensions/bluebubbles/src/monitor.ts of the component bluebubbles Webhook. Performing a…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-287"],"fixed_in":null}},{"id":"CVE-2026-45001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45001","title":"CVE-2026-45001 (HIGH 7.1)","content_text":"OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trusted settings including sandbox policy, plugin enablement, gateway…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-45005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45005","title":"CVE-2026-45005 (MEDIUM 6)","content_text":"OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6,"severity":"MEDIUM","cwe":["CWE-672"],"fixed_in":"2026.4.23"}},{"id":"CVE-2026-44993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44993","title":"CVE-2026-44993 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversations. Attackers can bypass dmPolicy enforcement by triggering card-action…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-44998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44998","title":"CVE-2026-44998 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.4.20 contains a tool policy bypass vulnerability allowing bundled MCP and LSP tools to circumvent configured tool restrictions. Attackers with local agent access can append restricted tools to the effective tool set…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-44994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44994","title":"CVE-2026-44994 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to read sensitive configuration fields. Attackers can access the bootstrap…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.22"}},{"id":"CVE-2026-44999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44999","title":"CVE-2026-44999 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be recorded as trusted system events. Attackers can exploit this trust-labeling…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-345"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-45002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45002","title":"CVE-2026-45002 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restriction. Attackers can render externally influenced session keys through…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-44992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44992","title":"CVE-2026-44992 (MEDIUM 5)","content_text":"OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST. Attackers can redirect credentialed MiniMax API requests to attacker-controlled…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5,"severity":"MEDIUM","cwe":["CWE-441"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-45000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45000","title":"CVE-2026-45000 (MEDIUM 5)","content_text":"OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-45003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45003","title":"CVE-2026-45003 (MEDIUM 5)","content_text":"OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5,"severity":"MEDIUM","cwe":["CWE-441"],"fixed_in":"2026.4.22"}},{"id":"CVE-2026-44997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44997","title":"CVE-2026-44997 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to inherit depth, child-count limits, control scope, or target-agent…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-266"],"fixed_in":"2026.4.22"}},{"id":"CVE-2026-44991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44991","title":"CVE-2026-44991 (MEDIUM 4.2)","content_text":"OpenClaw before 2026.4.21 contains an authorization bypass vulnerability in command-auth.ts that allows non-owner senders to execute owner-enforced slash commands when wildcard inbound senders are configured without explicit owner…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.2,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.4.21"}},{"id":"CVE-2026-44996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44996","title":"CVE-2026-44996 (LOW 3.7)","content_text":"OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root containment checks. Attackers can influence agent or tool-produced…","date_published":"2026-05-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-22"],"fixed_in":"2026.4.15"}},{"id":"CVE-2026-43575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43575","title":"CVE-2026-43575 (CRITICAL 9.8)","content_text":"OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials. Attackers can access the noVNC helper route without…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-862"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-44109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44109","title":"CVE-2026-44109 (CRITICAL 9.8)","content_text":"OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command dispatch. Missing encryptKey configuration and blank callback…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-1188"],"fixed_in":"2026.4.15"}},{"id":"CVE-2026-43581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43581","title":"CVE-2026-43581 (CRITICAL 9.6)","content_text":"OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.6,"severity":"CRITICAL","cwe":["CWE-1188"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-44112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44112","title":"CVE-2026-44112 (CRITICAL 9.6)","content_text":"OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.6,"severity":"CRITICAL","cwe":["CWE-367"],"fixed_in":"2026.4.22"}},{"id":"CVE-2026-43578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43578","title":"CVE-2026-43578 (CRITICAL 9.1)","content_text":"OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.1,"severity":"CRITICAL","cwe":["CWE-184"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43584","title":"CVE-2026-43584 (HIGH 8.8)","content_text":"OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-risk interpreter startup variables including VIMINIT, EXINIT,…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-44110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44110","title":"CVE-2026-44110 (HIGH 8.8)","content_text":"OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing-store entries. Attackers with DM-paired sender IDs can execute room control commands without…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.4.15"}},{"id":"CVE-2026-44115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44115","title":"CVE-2026-44115 (HIGH 8.8)","content_text":"OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.4.22"}},{"id":"CVE-2026-44116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44116","title":"CVE-2026-44116 (HIGH 8.6)","content_text":"OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSRF guard. Attackers can bypass SSRF protection by providing…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.6,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.4.22"}},{"id":"CVE-2026-43585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43585","title":"CVE-2026-43585 (HIGH 8.1)","content_text":"OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket handlers fail to re-resolve authentication per-request,…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-672"],"fixed_in":"2026.4.15"}},{"id":"CVE-2026-44114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44114","title":"CVE-2026-44114 (HIGH 7.8)","content_text":"OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtime variables. Malicious workspaces can set variables like…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-44118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44118","title":"CVE-2026-44118 (HIGH 7.8)","content_text":"OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-290"],"fixed_in":"2026.4.22"}},{"id":"CVE-2026-43576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43576","title":"CVE-2026-43576 (HIGH 7.7)","content_text":"OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted second-hop targets. The webSocketDebuggerUrl response field is not…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-601","CWE-918"],"fixed_in":"2026.4.5"}},{"id":"CVE-2026-43580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43580","title":"CVE-2026-43580 (HIGH 7.7)","content_text":"OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-44113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44113","title":"CVE-2026-44113 (HIGH 7.7)","content_text":"OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-367"],"fixed_in":"2026.4.22"}},{"id":"CVE-2026-43577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43577","title":"CVE-2026-43577 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers can pivot into the local CDP origin and create or read disallowed file://…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.9"}},{"id":"CVE-2026-43579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43579","title":"CVE-2026-43579 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority.…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43582","title":"CVE-2026-43582 (MEDIUM 6.3)","content_text":"OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-44117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44117","title":"CVE-2026-44117 (MEDIUM 5.8)","content_text":"OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.8,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-43583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43583","title":"CVE-2026-43583 (MEDIUM 5.3)","content_text":"OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered queued outbound media to bypass group tool policy enforcement and weaken…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.14"}},{"id":"CVE-2026-44111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44111","title":"CVE-2026-44111 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read any Markdown files within the workspace root. Attackers with access to the memory tool can bypass…","date_published":"2026-05-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-183"],"fixed_in":"2026.4.15"}},{"id":"CVE-2026-43534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43534","title":"CVE-2026-43534 (CRITICAL 9.1)","content_text":"OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.1,"severity":"CRITICAL","cwe":["CWE-345"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43566","title":"CVE-2026-43566 (CRITICAL 9.1)","content_text":"OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content. Attackers can exploit this by sending untrusted webhook…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.1,"severity":"CRITICAL","cwe":["CWE-184"],"fixed_in":"2026.4.14"}},{"id":"CVE-2026-42434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42434","title":"CVE-2026-42434 (HIGH 8.8)","content_text":"OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node. Attackers can bypass sandbox boundaries and route execution to remote nodes…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-42435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42435","title":"CVE-2026-42435 (HIGH 8.8)","content_text":"OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at the argv level. Attackers can bypass exec preflight…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.4.12"}},{"id":"CVE-2026-43530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43530","title":"CVE-2026-43530 (HIGH 8.8)","content_text":"OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obscure which applet would actually run. Attackers can exploit opaque…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.4.12"}},{"id":"CVE-2026-43569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43569","title":"CVE-2026-43569 (HIGH 8.8)","content_text":"OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider auth choices are shadowed. Attackers can exploit this by…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-829"],"fixed_in":"2026.4.9"}},{"id":"CVE-2026-43571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43571","title":"CVE-2026-43571 (HIGH 8.8)","content_text":"OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins. Attackers can exploit this by crafting malicious…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-829"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43533","title":"CVE-2026-43533 (HIGH 8.6)","content_text":"OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storage boundary. Attackers can craft malicious reply text…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.6,"severity":"HIGH","cwe":["CWE-23"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-42439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42439","title":"CVE-2026-42439 (HIGH 8.5)","content_text":"OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured browser SSRF policy protections by exploiting the…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.5,"severity":"HIGH","cwe":["CWE-862","CWE-918"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43526","title":"CVE-2026-43526 (HIGH 8.2)","content_text":"OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.2,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.4.12"}},{"id":"CVE-2026-42436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42436","title":"CVE-2026-42436 (HIGH 7.7)","content_text":"OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the final browser target after navigation. Authenticated callers can bypass…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.4.14"}},{"id":"CVE-2026-42438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42438","title":"CVE-2026-42438 (HIGH 7.7)","content_text":"OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized local file disclosure. Attackers with denied read access via…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43527","title":"CVE-2026-43527 (HIGH 7.7)","content_text":"OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration to access internal services or metadata…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-918","CWE-1188"],"fixed_in":"2026.4.14"}},{"id":"CVE-2026-43532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43532","title":"CVE-2026-43532 (HIGH 7.7)","content_text":"OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43573","title":"CVE-2026-43573 (HIGH 7.7)","content_text":"OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-862","CWE-918"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-42437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42437","title":"CVE-2026-42437 (HIGH 7.5)","content_text":"OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-770"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43531","title":"CVE-2026-43531 (HIGH 7.3)","content_text":"OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-15"],"fixed_in":"2026.4.9"}},{"id":"CVE-2026-43535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43535","title":"CVE-2026-43535 (MEDIUM 6.8)","content_text":"OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final sender's authorization context. Attackers can exploit this by…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.8,"severity":"MEDIUM","cwe":["CWE-266"],"fixed_in":"2026.4.14"}},{"id":"CVE-2026-42433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42433","title":"CVE-2026-42433 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43528","title":"CVE-2026-43528 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-212"],"fixed_in":"2026.4.14"}},{"id":"CVE-2026-43567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43567","title":"CVE-2026-43567 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43568","title":"CVE-2026-43568 (MEDIUM 6.5)","content_text":"OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming settings. Attackers with write-scoped gateway access can toggle admin-class…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-43570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43570","title":"CVE-2026-43570 (MEDIUM 6.5)","content_text":"OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-61"],"fixed_in":"2026.4.5"}},{"id":"CVE-2026-43574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43574","title":"CVE-2026-43574 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval authorization. Attackers can resolve pending approvals without…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-183"],"fixed_in":"2026.4.12"}},{"id":"CVE-2026-43572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43572","title":"CVE-2026-43572 (MEDIUM 5.3)","content_text":"OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks. Attackers can bypass sender authorization by sending SSO…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.14"}},{"id":"CVE-2026-43529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43529","title":"CVE-2026-43529 (LOW 2.5)","content_text":"OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boundary checks. An attacker with workspace write access can…","date_published":"2026-05-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":2.5,"severity":"LOW","cwe":["CWE-367"],"fixed_in":"2026.4.10"}},{"id":"CVE-2026-41386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41386","title":"CVE-2026-41386 (CRITICAL 9.1)","content_text":"OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.1,"severity":"CRITICAL","cwe":["CWE-648"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-41378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41378","title":"CVE-2026-41378 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41404","title":"CVE-2026-41404 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can exploit this by declaring operator scopes on…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-42422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42422","title":"CVE-2026-42422 (HIGH 8.8)","content_text":"OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-42426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42426","title":"CVE-2026-42426 (HIGH 8.8)","content_text":"OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41371","title":"CVE-2026-41371 (HIGH 8.5)","content_text":"OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":8.5,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41914","title":"CVE-2026-41914 (HIGH 8.5)","content_text":"OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.5,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41394","title":"CVE-2026-41394 (HIGH 8.2)","content_text":"OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.2,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41364","title":"CVE-2026-41364 (HIGH 8.1)","content_text":"OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers can exploit this by uploading tar archives containing symlinks to escape the…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-59"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41383","title":"CVE-2026-41383 (HIGH 8.1)","content_text":"OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values.…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-42431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42431","title":"CVE-2026-42431 (HIGH 8.1)","content_text":"OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41384","title":"CVE-2026-41384 (HIGH 7.8)","content_text":"OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-15"],"fixed_in":"2026.3.24"}},{"id":"CVE-2026-41387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41387","title":"CVE-2026-41387 (HIGH 7.8)","content_text":"OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-183"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-41396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41396","title":"CVE-2026-41396 (HIGH 7.8)","content_text":"OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-829"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-42432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42432","title":"CVE-2026-42432 (HIGH 7.8)","content_text":"OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the operator.admin scope requirement. Attackers can bypass re-pairing authentication…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41912","title":"CVE-2026-41912 (HIGH 7.6)","content_text":"OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks. Attackers can exploit browser interactions to bypass SSRF protections…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41395","title":"CVE-2026-41395 (HIGH 7.5)","content_text":"OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-325"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41399","title":"CVE-2026-41399 (HIGH 7.5)","content_text":"OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network attackers can exhaust socket and worker capacity to disrupt WebSocket…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-770"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41405","title":"CVE-2026-41405 (HIGH 7.5)","content_text":"OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-408"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-42423","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42423","title":"CVE-2026-42423 (HIGH 7.5)","content_text":"OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-636"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41380","title":"CVE-2026-41380 (HIGH 7.3)","content_text":"OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targets. Attackers can exploit positional…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-807"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41390","title":"CVE-2026-41390 (HIGH 7.3)","content_text":"OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-807"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41379","title":"CVE-2026-41379 (HIGH 7.1)","content_text":"OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice configuration persistence. Attackers with operator.write privileges can…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-42428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42428","title":"CVE-2026-42428 (HIGH 7.1)","content_text":"OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-353"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-42429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42429","title":"CVE-2026-42429 (HIGH 7.1)","content_text":"OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.read requests to runtime operator.write permissions. Attackers can…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41397","title":"CVE-2026-41397 (MEDIUM 6.8)","content_text":"OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file synchronization operations. Remote attackers can bypass sandbox restrictions…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.8,"severity":"MEDIUM","cwe":["CWE-59"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41392","title":"CVE-2026-41392 (MEDIUM 6.7)","content_text":"OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations. Attackers can exploit shell options like --rcfile, --init-file, and…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.7,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41368","title":"CVE-2026-41368 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.28 contains an environment variable disclosure vulnerability in the jq safe-bin policy that fails to block the $ENV filter. Attackers can bypass safe-bin restrictions by using $ENV in jq programs to access…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-668"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41369","title":"CVE-2026-41369 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can exploit this by injecting…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-668"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41370","title":"CVE-2026-41370 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.31 contains a path traversal vulnerability in ACP dispatch that allows attackers to read arbitrary files by manipulating inbound channel attachment paths. Remote attackers can bypass attachment-cache and root…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41375","title":"CVE-2026-41375 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin scope checks for external channels. Attackers can bypass authentication…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41385","title":"CVE-2026-41385 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-312"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41388","title":"CVE-2026-41388 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers can restart the application to rehydrate revoked Tlon configuration from file…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-372"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41911","title":"CVE-2026-41911 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries. Attackers can exploit upload_file and upload_image endpoints to access files…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-42430","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42430","title":"CVE-2026-42430 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF checks. Attackers can exploit request-time navigation to reach private targets…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41373","title":"CVE-2026-41373 (MEDIUM 6.1)","content_text":"OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted models to substitute CC, CXX, CARGO_BUILD_RUSTC, and CMAKE_C_COMPILER via…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-427"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41372","title":"CVE-2026-41372 (MEDIUM 5.8)","content_text":"OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":5.8,"severity":"MEDIUM","cwe":["CWE-639"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-42424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42424","title":"CVE-2026-42424 (MEDIUM 5.7)","content_text":"OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references to cause…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.7,"severity":"MEDIUM","cwe":["CWE-73"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41366","title":"CVE-2026-41366 (MEDIUM 5.5)","content_text":"OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-732"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41365","title":"CVE-2026-41365 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-441"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41376","title":"CVE-2026-41376 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to properly validate message senders. Attackers can fetch thread-root and reply context messages that…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-346"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41381","title":"CVE-2026-41381 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allowlist restrictions. Attackers can send Discord voice ingress requests…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41382","title":"CVE-2026-41382 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist restrictions. Attackers can exploit stale-role validation gaps and improper…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41406","title":"CVE-2026-41406 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fetched quoted, root, and thread context messages to bypass sender allowlist…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-639"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41916","title":"CVE-2026-41916 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state,…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-613"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-42421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42421","title":"CVE-2026-42421 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-613"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41363","title":"CVE-2026-41363 (MEDIUM 5.3)","content_text":"OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":null}},{"id":"CVE-2026-41374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41374","title":"CVE-2026-41374 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume resources. Remote attackers can trigger audio preflight processing without…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-408"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41391","title":"CVE-2026-41391 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41400","title":"CVE-2026-41400 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. Remote attackers can send oversized pre-start WebSocket frames to cause…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-770"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41915","title":"CVE-2026-41915 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit this by setting GIT_DIR and related variables to redirect git operations and…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-42427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42427","title":"CVE-2026-42427 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS. Attackers can inject malicious build…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41367","title":"CVE-2026-41367 (MEDIUM 5)","content_text":"OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":null}},{"id":"CVE-2026-41393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41393","title":"CVE-2026-41393 (MEDIUM 4.8)","content_text":"OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-tailnet position and CA-trusted endpoint access can exfiltrate operator…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.8,"severity":"MEDIUM","cwe":["CWE-346"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41377","title":"CVE-2026-41377 (MEDIUM 4.6)","content_text":"OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.6,"severity":"MEDIUM","cwe":["CWE-636"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41398","title":"CVE-2026-41398 (MEDIUM 4.6)","content_text":"OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. Attackers can inject unauthorized agent.request runs by loading…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.6,"severity":"MEDIUM","cwe":["CWE-346"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-41362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41362","title":"CVE-2026-41362 (MEDIUM 4.3)","content_text":"OpenClaw versions 2026.2.19 before 2026.3.31 contain an improper cache isolation vulnerability in the Zalo webhook replay-dedupe mechanism that is shared across authenticated webhook targets. Attackers controlling one authenticated Zalo…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-668"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41408","title":"CVE-2026-41408 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup operations. Attackers can exhaust disk space by downloading media files without…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-770"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41910","title":"CVE-2026-41910 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An authorized non-owner sender can bypass access controls to perform allowlist modifications against different…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-42420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42420","title":"CVE-2026-42420 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exploit multiple code paths to cause memory exhaustion or denial of service…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-770"],"fixed_in":"2026.4.8"}},{"id":"CVE-2026-41402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41402","title":"CVE-2026-41402 (MEDIUM 4.2)","content_text":"OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages across sibling targets using the same messageId. Attackers can exploit overly…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.2,"severity":"MEDIUM","cwe":["CWE-706"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41407","title":"CVE-2026-41407 (LOW 3.7)","content_text":"OpenClaw before 2026.4.2 contains a timing side channel vulnerability in shared-secret comparison call sites that use early length-mismatch checks instead of fixed-length comparison helpers. Attackers can measure timing differences to…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-208"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-41913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41913","title":"CVE-2026-41913 (LOW 3.7)","content_text":"OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per-key rate-limit budget. Attackers can exploit this by sending multiple…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-362"],"fixed_in":"2026.4.4"}},{"id":"CVE-2026-41403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41403","title":"CVE-2026-41403 (LOW 2.9)","content_text":"OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied…","date_published":"2026-04-28T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":2.9,"severity":"LOW","cwe":["CWE-807"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41349","title":"CVE-2026-41349 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter. Remote attackers can exploit this to bypass security controls and execute…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41352","title":"CVE-2026-41352 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41353","title":"CVE-2026-41353 (HIGH 8.1)","content_text":"OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-472"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-41336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41336","title":"CVE-2026-41336 (HIGH 7.8)","content_text":"OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling loading of attacker-controlled hook code. Attackers can replace trusted default-on bundled hooks from…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-829"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41342","title":"CVE-2026-41342 (HIGH 7.3)","content_text":"OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints without explicit trust confirmation. Attackers can spoof discovery endpoints…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-346"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41355","title":"CVE-2026-41355 (HIGH 7.3)","content_text":"OpenClaw before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into workspace hooks. Attackers with mirror mode access can execute arbitrary code on the host during…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-829"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41347","title":"CVE-2026-41347 (HIGH 7.1)","content_text":"OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-352"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41359","title":"CVE-2026-41359 (HIGH 7.1)","content_text":"OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Telegram configuration and cron persistence settings via the send endpoint. Attackers…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-269"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41361","title":"CVE-2026-41361 (HIGH 7.1)","content_text":"OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting URLs targeting internal or non-routable IPv6 addresses to bypass SSRF…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-184","CWE-918"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41360","title":"CVE-2026-41360 (MEDIUM 6.7)","content_text":"OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operands consistently with pnpm exec flows. Attackers can replace approved local scripts before execution without…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.7,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-41334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41334","title":"CVE-2026-41334 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.31 contains a decompression bomb vulnerability in image processing that fails to properly enforce pixel-limit guards on sips. Attackers can exploit this by uploading oversized images to cause denial of service…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-636"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41340","title":"CVE-2026-41340 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where Telegram legacy allowFrom migration incorrectly fans default-account trust into all named accounts. Attackers can exploit this trust propagation to bypass…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-372"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41909","title":"CVE-2026-41909 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.4.20 contains an improper authorization vulnerability in paired-device pairing management that allows limited-scope sessions to enumerate and act on pairing requests. Attackers with paired-device access can approve…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-41341","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41341","title":"CVE-2026-41341 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as direct messages in extensions/discord/src/monitor/agent-components-helpers.ts. Attackers can exploit…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-351"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41344","title":"CVE-2026-41344 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verboseLevel session overrides. Attackers can exploit the /verbose…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41348","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41348","title":"CVE-2026-41348 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths that fail to enforce group DM channel allowlist restrictions. Authorized Discord users can bypass channel…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41356","title":"CVE-2026-41356 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-613"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41358","title":"CVE-2026-41358 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.4.2 fails to filter Slack thread context by sender allowlist, allowing non-allowlisted messages to enter agent context. Attackers can inject unauthorized thread messages through allowlisted user replies to bypass…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-346"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-41332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41332","title":"CVE-2026-41332 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41335","title":"CVE-2026-41335 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-497"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41337","title":"CVE-2026-41337 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback origin before replay rejection. Attackers with captured valid callbacks for live…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41343","title":"CVE-2026-41343 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient availability loss. Remote attackers can flood the webhook endpoint with concurrent requests…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-799"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41345","title":"CVE-2026-41345 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects. Attackers can exploit this by crafting malicious cross-origin…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-522"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41346","title":"CVE-2026-41346 (MEDIUM 5.3)","content_text":"OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-799"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41351","title":"CVE-2026-41351 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.31 contains a replay detection bypass vulnerability in webhook signature handling that treats Base64 and Base64URL encoded signatures as distinct requests. Attackers can re-encode Telnyx webhook signatures to…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-294"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41338","title":"CVE-2026-41338 (MEDIUM 5)","content_text":"OpenClaw before 2026.3.31 contains a time-of-check-time-of-use vulnerability in sandbox file operations that allows attackers to bypass fd-based defenses. Attackers can exploit check-then-act patterns in apply_patch, remove, and mkdir…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41908","title":"CVE-2026-41908 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.read scope to access protected assistant-media files and metadata. Attackers can…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.4.20"}},{"id":"CVE-2026-41339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41339","title":"CVE-2026-41339 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. Non-admin clients can recover host-specific filesystem paths and deployment details, enabling…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-497"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-41350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41350","title":"CVE-2026-41350 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to enforce configured tools.sessions.visibility restrictions for unsandboxed invocations. Attackers can invoke…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41333","title":"CVE-2026-41333 (LOW 3.7)","content_text":"OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-799"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41354","title":"CVE-2026-41354 (LOW 3.7)","content_text":"OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-706"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-41357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41357","title":"CVE-2026-41357 (LOW 3.3)","content_text":"OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes. Attackers can exploit this by leveraging non-default SSH environment…","date_published":"2026-04-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.3,"severity":"LOW","cwe":["CWE-214"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41329","title":"CVE-2026-41329 (CRITICAL 9.9)","content_text":"OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation. Attackers can exploit improper context validation to…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.9,"severity":"CRITICAL","cwe":["CWE-648"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41303","title":"CVE-2026-41303 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41294","title":"CVE-2026-41294 (HIGH 8.6)","content_text":"OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.6,"severity":"HIGH","cwe":["CWE-15"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41296","title":"CVE-2026-41296 (HIGH 8.2)","content_text":"OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape. Attackers can exploit the separate path validation and file read operations to…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.2,"severity":"HIGH","cwe":["CWE-367"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41295","title":"CVE-2026-41295 (HIGH 7.8)","content_text":"OpenClaw before 2026.4.2 contains an improper trust boundary vulnerability allowing untrusted workspace channel shadows to execute during built-in channel setup and login. Attackers can clone a workspace with a malicious plugin claiming…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-829"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-41297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41297","title":"CVE-2026-41297 (HIGH 7.6)","content_text":"OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access internal resources by following unvalidated redirects. The marketplace.ts…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41302","title":"CVE-2026-41302 (HIGH 7.6)","content_text":"OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests. Attackers can exploit unguarded fetch()…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41299","title":"CVE-2026-41299 (HIGH 7.1)","content_text":"OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-declared client metadata from WebSocket handshake rather than verified…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-807"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-41300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41300","title":"CVE-2026-41300 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote onboarding flows. Attackers can route gateway credentials to malicious endpoints by having their discovered URL…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-372"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-40045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40045","title":"CVE-2026-40045 (MEDIUM 5.7)","content_text":"OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attackers can forge discovery results or craft setup codes to redirect clients to…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.7,"severity":"MEDIUM","cwe":["CWE-319"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-41298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41298","title":"CVE-2026-41298 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes. Read-scoped callers can terminate running subagent sessions by sending requests to this endpoint,…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-41301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41301","title":"CVE-2026-41301 (MEDIUM 5.3)","content_text":"OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows pairing challenges to be issued before event signature validation. An unauthenticated remote…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-347"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41331","title":"CVE-2026-41331 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows unauthorized group senders to trigger transcription processing. Attackers can exploit insufficient allowlist…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-408"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41330","title":"CVE-2026-41330 (MEDIUM 4.4)","content_text":"OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding…","date_published":"2026-04-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.4,"severity":"MEDIUM","cwe":["CWE-453"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-41389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41389","title":"CVE-2026-41389 (MEDIUM 5.8)","content_text":"OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side…","date_published":"2026-04-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.8,"severity":"MEDIUM","cwe":["CWE-73"],"fixed_in":"2026.4.15"}},{"id":"CVE-2026-3690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3690","title":"CVE-2026-3690 (HIGH 7.4)","content_text":"OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability.\n\nThe specific…","date_published":"2026-04-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.4,"severity":"HIGH","cwe":["CWE-291"],"fixed_in":null}},{"id":"CVE-2026-3689","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3689","title":"CVE-2026-3689 (MEDIUM 6.5)","content_text":"OpenClaw Canvas Path Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenClaw. Authentication is required to exploit this…","date_published":"2026-04-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":null}},{"id":"CVE-2026-3691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3691","title":"CVE-2026-3691 (MEDIUM 5.3)","content_text":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this…","date_published":"2026-04-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-200"],"fixed_in":null}},{"id":"CVE-2026-35643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35643","title":"CVE-2026-35643 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-940"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35663","title":"CVE-2026-35663 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass pairing requirements to reconnect as operator.admin,…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-648"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35666","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35666","title":"CVE-2026-35666 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-706"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35669","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35669","title":"CVE-2026-35669 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-648"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35653","title":"CVE-2026-35653 (HIGH 8.1)","content_text":"OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions.…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.24"}},{"id":"CVE-2026-35660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35660","title":"CVE-2026-35660 (HIGH 8.1)","content_text":"OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-862"],"fixed_in":"2026.3.23"}},{"id":"CVE-2026-35641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35641","title":"CVE-2026-35641 (HIGH 7.8)","content_text":"OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-349"],"fixed_in":"2026.3.24"}},{"id":"CVE-2026-35668","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35668","title":"CVE-2026-35668 (HIGH 7.7)","content_text":"OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.3.24"}},{"id":"CVE-2026-35650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35650","title":"CVE-2026-35650 (HIGH 7.5)","content_text":"OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-15"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35621","title":"CVE-2026-35621 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, allowing operator.write-scoped clients to mutate channel authorization…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.3.24"}},{"id":"CVE-2026-35649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35649","title":"CVE-2026-35649 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty allowlist handling. The vulnerability treats explicit empty allowlists as unset…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-183"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35652","title":"CVE-2026-35652 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.22 contains an authorization bypass vulnerability in interactive callback dispatch that allows non-allowlisted senders to execute action handlers. Attackers can bypass sender authorization checks by dispatching…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-696"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35656","title":"CVE-2026-35656 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.22 contains an authentication bypass vulnerability in the X-Forwarded-For header processing when trustedProxies is configured, allowing attackers to spoof loopback hops. Remote attackers can inject forged…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-290"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35657","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35657","title":"CVE-2026-35657 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation. Attackers can access session history without proper operator read…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35658","title":"CVE-2026-35658 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-668"],"fixed_in":"2026.3.2"}},{"id":"CVE-2026-35667","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35667","title":"CVE-2026-35667 (MEDIUM 6.1)","content_text":"OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-utils.ts that sends SIGKILL immediately without graceful SIGTERM shutdown.…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-404"],"fixed_in":"2026.3.24"}},{"id":"CVE-2026-35670","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35670","title":"CVE-2026-35670 (MEDIUM 5.9)","content_text":"OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies to unintended users by exploiting mutable username matching instead of stable numeric user identifiers. Attackers can…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.9,"severity":"MEDIUM","cwe":["CWE-807"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35655","title":"CVE-2026-35655 (MEDIUM 5.7)","content_text":"OpenClaw before 2026.3.22 contains an identity spoofing vulnerability in ACP permission resolution that trusts conflicting tool identity hints from rawInput and metadata. Attackers can spoof tool identities through rawInput parameters…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.7,"severity":"MEDIUM","cwe":["CWE-807"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-6011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6011","title":"CVE-2026-6011 (MEDIUM 5.6)","content_text":"A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.6,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":null}},{"id":"CVE-2026-35620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35620","title":"CVE-2026-35620 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner command-authorized senders to change owner-only session delivery policy…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.3.24"}},{"id":"CVE-2026-35647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35647","title":"CVE-2026-35647 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.25 contains an access control vulnerability where verification notices bypass DM policy checks and reply to unpaired peers. Attackers can send verification notices to users outside allowed direct message policies…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-288"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35654","title":"CVE-2026-35654 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Microsoft Teams feedback invokes that allows unauthorized senders to record session feedback. Attackers can bypass sender allowlist checks via feedback invoke…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-288"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35661","title":"CVE-2026-35661 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-288"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35664","title":"CVE-2026-35664 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can send raw card commands to bypass DM pairing restrictions…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-288"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35665","title":"CVE-2026-35665 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout before signature verification. An unauthenticated…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-405"],"fixed_in":"2026.3.24"}},{"id":"CVE-2026-35659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35659","title":"CVE-2026-35659 (MEDIUM 4.6)","content_text":"OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.6,"severity":"MEDIUM","cwe":["CWE-345"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35619","title":"CVE-2026-35619 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements. Attackers with only operator.approvals scope can enumerate gateway model…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.24"}},{"id":"CVE-2026-35651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35651","title":"CVE-2026-35651 (MEDIUM 4.3)","content_text":"OpenClaw versions 2026.2.13 through 2026.3.24 contain an ANSI escape sequence injection vulnerability in approval prompts that allows attackers to spoof terminal output. Untrusted tool metadata can carry ANSI control sequences into…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-150"],"fixed_in":null}},{"id":"CVE-2026-35662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35662","title":"CVE-2026-35662 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond their authorized scope. Attackers can exploit this by using the send action to…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35648","title":"CVE-2026-35648 (LOW 3.7)","content_text":"OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy…","date_published":"2026-04-10T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-367"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35638","title":"CVE-2026-35638 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain self-declared privileged scopes without device identity verification. Attackers can exploit the…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-286"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35639","title":"CVE-2026-35639 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-648"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-34512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34512","title":"CVE-2026-34512 (HIGH 8.1)","content_text":"OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35645","title":"CVE-2026-35645 (HIGH 8.1)","content_text":"OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-648","CWE-863"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35625","title":"CVE-2026-35625 (HIGH 7.8)","content_text":"OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-648"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35629","title":"CVE-2026-35629 (HIGH 7.4)","content_text":"OpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail to properly guard configured base URLs against SSRF attacks. Attackers can exploit unprotected fetch() calls against…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.4,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35637","title":"CVE-2026-35637 (HIGH 7.3)","content_text":"OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-696"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35632","title":"CVE-2026-35632 (HIGH 7.1)","content_text":"OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-61"],"fixed_in":null}},{"id":"CVE-2026-35618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35618","title":"CVE-2026-35618 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters. The verification path derives replay keys from the…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-294"],"fixed_in":"2026.3.23"}},{"id":"CVE-2026-35627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35627","title":"CVE-2026-35627 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attackers can trigger unauthorized pre-authentication computation by…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-696"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35631","title":"CVE-2026-35631 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unauthorized modifications. Attackers without admin privileges can execute mutating control-plane actions by directly…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35636","title":"CVE-2026-35636 (MEDIUM 6.5)","content_text":"OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before enforcing visibility checks. Sandboxed child sessions can exploit…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-696"],"fixed_in":null}},{"id":"CVE-2026-35644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35644","title":"CVE-2026-35644 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-312"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35622","title":"CVE-2026-35622 (MEDIUM 5.9)","content_text":"OpenClaw before 2026.3.22 contains an improper authentication verification vulnerability in Google Chat app-url webhook handling that accepts add-on principals outside intended deployment bindings. Attackers can bypass webhook…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.9,"severity":"MEDIUM","cwe":["CWE-290"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35626","title":"CVE-2026-35626 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-405"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35633","title":"CVE-2026-35633 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-789","CWE-770"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35640","title":"CVE-2026-35640 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-696"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35634","title":"CVE-2026-35634 (MEDIUM 5.1)","content_text":"OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-direct requests without validating bearer tokens or canvas capabilities.…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.1,"severity":"MEDIUM","cwe":["CWE-288"],"fixed_in":"2026.3.23"}},{"id":"CVE-2026-35623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35623","title":"CVE-2026-35623 (MEDIUM 4.8)","content_text":"OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.8,"severity":"MEDIUM","cwe":["CWE-307"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35628","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35628","title":"CVE-2026-35628 (MEDIUM 4.8)","content_text":"OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerability enables repeated authentication guesses without…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.8,"severity":"MEDIUM","cwe":["CWE-307"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35635","title":"CVE-2026-35635 (MEDIUM 4.8)","content_text":"OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.8,"severity":"MEDIUM","cwe":["CWE-706","CWE-863"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-35646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35646","title":"CVE-2026-35646 (MEDIUM 4.8)","content_text":"OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.8,"severity":"MEDIUM","cwe":["CWE-307"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35642","title":"CVE-2026-35642 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism. Attackers can trigger reactions in mention-gated groups to enqueue agent-visible…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-288"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35617","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35617","title":"CVE-2026-35617 (MEDIUM 4.2)","content_text":"OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind group policies by changing or colliding space display…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.2,"severity":"MEDIUM","cwe":["CWE-807"],"fixed_in":"2026.3.25"}},{"id":"CVE-2026-35624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35624","title":"CVE-2026-35624 (MEDIUM 4.2)","content_text":"OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain…","date_published":"2026-04-09T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.2,"severity":"MEDIUM","cwe":["CWE-807"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-40037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40037","title":"CVE-2026-40037 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering…","date_published":"2026-04-08T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-601"],"fixed_in":"2026.3.31"}},{"id":"CVE-2026-34511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34511","title":"CVE-2026-34511 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE…","date_published":"2026-04-03T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-330"],"fixed_in":"2026.4.2"}},{"id":"CVE-2026-34426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34426","title":"CVE-2026-34426 (HIGH 7.6)","content_text":"OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment…","date_published":"2026-04-02T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":null}},{"id":"CVE-2026-34425","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34425","title":"CVE-2026-34425 (MEDIUM 5.4)","content_text":"OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content by using piped or complex command forms that the parser…","date_published":"2026-04-02T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":null}},{"id":"CVE-2026-34510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34510","title":"CVE-2026-34510 (MEDIUM 5.3)","content_text":"OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file…","date_published":"2026-04-01T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-41"],"fixed_in":"2026.3.22"}},{"id":"CVE-2026-33579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33579","title":"CVE-2026-33579 (CRITICAL 9.9)","content_text":"OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":9.9,"severity":"CRITICAL","cwe":["CWE-863"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-32917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32917","title":"CVE-2026-32917 (CRITICAL 9.8)","content_text":"OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-25T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-78"],"fixed_in":"2026.3.13"}},{"id":"CVE-2026-32916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32916","title":"CVE-2026-32916 (CRITICAL 9.4)","content_text":"OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-25T00:00:00Z","_openclawpro":{"cvss":9.4,"severity":"CRITICAL","cwe":["CWE-266"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32920","title":"CVE-2026-32920 (HIGH 8.4)","content_text":"OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-25T00:00:00Z","_openclawpro":{"cvss":8.4,"severity":"HIGH","cwe":["CWE-829"],"fixed_in":"2026.3.12"}},{"id":"CVE-2026-34504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34504","title":"CVE-2026-34504 (HIGH 8.3)","content_text":"OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URLs. A malicious or compromised fal relay can exploit…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-33577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33577","title":"CVE-2026-33577 (HIGH 8.1)","content_text":"OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-34503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34503","title":"CVE-2026-34503 (HIGH 8.1)","content_text":"OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-613"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-32982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32982","title":"CVE-2026-32982 (HIGH 7.5)","content_text":"OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-25T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-532"],"fixed_in":"2026.3.13"}},{"id":"CVE-2026-32988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32988","title":"CVE-2026-32988 (HIGH 7.5)","content_text":"OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and population are not pinned to a verified parent directory. Attackers can exploit a race condition in…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-25T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-367"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32971","title":"CVE-2026-32971 (HIGH 7.1)","content_text":"OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the executed argv. Attackers can place wrapper binaries and induce wrapper-shaped…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-25T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-451"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32976","title":"CVE-2026-32976 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-25T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-639"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-34505","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34505","title":"CVE-2026-34505 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-307"],"fixed_in":"2026.3.12"}},{"id":"CVE-2026-33576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33576","title":"CVE-2026-33576 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-33580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33580","title":"CVE-2026-33580 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-307"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-33581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33581","title":"CVE-2026-33581 (MEDIUM 6.5)","content_text":"OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.3.24"}},{"id":"CVE-2026-32921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32921","title":"CVE-2026-32921 (MEDIUM 6.3)","content_text":"OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-25T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.3.8"}},{"id":"CVE-2026-32977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32977","title":"CVE-2026-32977 (MEDIUM 6.3)","content_text":"OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the final move operation. An attacker can exploit a…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-25T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-34506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34506","title":"CVE-2026-34506 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.8"}},{"id":"CVE-2026-33578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33578","title":"CVE-2026-33578 (MEDIUM 4.3)","content_text":"OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-24T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-32970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32970","title":"CVE-2026-32970 (LOW 2.5)","content_text":"OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode.…","date_published":"2026-03-31T00:00:00Z","date_modified":"2026-07-25T00:00:00Z","_openclawpro":{"cvss":2.5,"severity":"LOW","cwe":["CWE-636"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32922","title":"CVE-2026-32922 (CRITICAL 9.9)","content_text":"OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.9,"severity":"CRITICAL","cwe":["CWE-266"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32924","title":"CVE-2026-32924 (CRITICAL 9.8)","content_text":"OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-863"],"fixed_in":"2026.3.12"}},{"id":"CVE-2026-32973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32973","title":"CVE-2026-32973 (CRITICAL 9.8)","content_text":"OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ?…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-625"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32975","title":"CVE-2026-32975 (CRITICAL 9.8)","content_text":"OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-807"],"fixed_in":"2026.3.12"}},{"id":"CVE-2026-32987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32987","title":"CVE-2026-32987 (CRITICAL 9.8)","content_text":"OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-294"],"fixed_in":"2026.3.13"}},{"id":"CVE-2026-32914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32914","title":"CVE-2026-32914 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner-only surfaces. Attackers with command authorization can…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.12"}},{"id":"CVE-2026-32915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32915","title":"CVE-2026-32915 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-33573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33573","title":"CVE-2026-33573 (HIGH 8.8)","content_text":"OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-668"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32974","title":"CVE-2026-32974 (HIGH 8.6)","content_text":"OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.6,"severity":"HIGH","cwe":["CWE-347"],"fixed_in":"2026.3.12"}},{"id":"CVE-2026-32918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32918","title":"CVE-2026-32918 (HIGH 8.4)","content_text":"OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.4,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-33572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33572","title":"CVE-2026-33572 (HIGH 8.4)","content_text":"OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.4,"severity":"HIGH","cwe":["CWE-378"],"fixed_in":"2026.2.17"}},{"id":"CVE-2026-32978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32978","title":"CVE-2026-32978 (HIGH 8)","content_text":"OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands,…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32980","title":"CVE-2026-32980 (HIGH 7.5)","content_text":"OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-770"],"fixed_in":"2026.3.13"}},{"id":"CVE-2026-33575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33575","title":"CVE-2026-33575 (HIGH 7.5)","content_text":"OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-522"],"fixed_in":"2026.3.12"}},{"id":"CVE-2026-32979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32979","title":"CVE-2026-32979 (HIGH 7.3)","content_text":"OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local code by modifying scripts between approval and execution when exact file binding cannot occur. Remote attackers can…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-367"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32972","title":"CVE-2026-32972 (HIGH 7.1)","content_text":"OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile management routes through browser.request. Attackers can…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-33574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33574","title":"CVE-2026-33574 (MEDIUM 6.2)","content_text":"OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archive download and copy operations. A local attacker can…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.2,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.3.8"}},{"id":"CVE-2026-32919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32919","title":"CVE-2026-32919 (MEDIUM 6.1)","content_text":"OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with operator.write scope can issue agent requests containing /new or /reset slash…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32923","title":"CVE-2026-32923 (MEDIUM 5.4)","content_text":"OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reaction ingestion that fails to enforce member users and roles allowlist checks. Non-allowlisted guild members can trigger reaction events…","date_published":"2026-03-29T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-32846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32846","title":"CVE-2026-32846 (HIGH 7.5)","content_text":"OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit…","date_published":"2026-03-26T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.3.28"}},{"id":"CVE-2026-32913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32913","title":"CVE-2026-32913 (CRITICAL 9.3)","content_text":"OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to…","date_published":"2026-03-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.3,"severity":"CRITICAL","cwe":["CWE-522"],"fixed_in":"2026.3.7"}},{"id":"CVE-2026-27646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27646","title":"CVE-2026-27646 (MEDIUM 6.1)","content_text":"OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime. Attackers can bypass sandbox restrictions by invoking…","date_published":"2026-03-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.7"}},{"id":"CVE-2026-27183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27183","title":"CVE-2026-27183 (MEDIUM 5.3)","content_text":"OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip shell wrapper approval requirements. The approval classifier and execution…","date_published":"2026-03-23T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.7"}},{"id":"CVE-2026-32042","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32042","title":"CVE-2026-32042 (HIGH 8.8)","content_text":"OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements and self-assign elevated operator scopes including operator.admin.…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32051","title":"CVE-2026-32051 (HIGH 8.8)","content_text":"OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces including gateway and cron through agent runs in…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.3.1"}},{"id":"CVE-2026-32064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32064","title":"CVE-2026-32064 (HIGH 7.7)","content_text":"OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-10-08T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-306"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-32055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32055","title":"CVE-2026-32055 (HIGH 7.6)","content_text":"OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the workspace through in-workspace symlinks pointing to non-existent out-of-root…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-32048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32048","title":"CVE-2026-32048 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-732"],"fixed_in":"2026.3.1"}},{"id":"CVE-2026-32049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32049","title":"CVE-2026-32049 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-770"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32056","title":"CVE-2026-32056 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32057","title":"CVE-2026-32057 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-807"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32043","title":"CVE-2026-32043 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32053","title":"CVE-2026-32053 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-294"],"fixed_in":"2026.2.23"}},{"id":"CVE-2026-32054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32054","title":"CVE-2026-32054 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers to escape the managed temp root directory. An attacker with local access can…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-59"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32052","title":"CVE-2026-32052 (MEDIUM 6.4)","content_text":"OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands by injecting positional argv carriers after inline shell payloads. Attackers…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.4,"severity":"MEDIUM","cwe":["CWE-436","CWE-77"],"fixed_in":"2026.2.24"}},{"id":"CVE-2026-32045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32045","title":"CVE-2026-32045 (MEDIUM 5.9)","content_text":"OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements. Attackers on trusted networks can exploit this misconfiguration…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.9,"severity":"MEDIUM","cwe":["CWE-290"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-32044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32044","title":"CVE-2026-32044 (MEDIUM 5.5)","content_text":"OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other archive formats. Attackers can craft malicious tar.bz2 skill archives to bypass…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-409"],"fixed_in":"2026.3.2"}},{"id":"CVE-2026-32895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32895","title":"CVE-2026-32895 (MEDIUM 5.4)","content_text":"OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to be enqueued. Attackers can bypass Slack DM allowlists and per-channel user…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-32898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32898","title":"CVE-2026-32898 (MEDIUM 5.4)","content_text":"OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-807"],"fixed_in":"2026.2.23"}},{"id":"CVE-2026-32046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32046","title":"CVE-2026-32046 (MEDIUM 5.3)","content_text":"OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerabilities without requiring a sandbox escape. Attackers can…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-1188"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-32065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32065","title":"CVE-2026-32065 (MEDIUM 4.8)","content_text":"OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.8,"severity":"MEDIUM","cwe":["CWE-436"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32896","title":"CVE-2026-32896 (MEDIUM 4.8)","content_text":"The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-09-17T00:00:00Z","_openclawpro":{"cvss":4.8,"severity":"MEDIUM","cwe":["CWE-306"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-32899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32899","title":"CVE-2026-32899 (MEDIUM 4.3)","content_text":"OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context. Attackers can bypass configured DM policies and channel user…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32050","title":"CVE-2026-32050 (LOW 3.7)","content_text":"OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-863"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32067","title":"CVE-2026-32067 (LOW 3.7)","content_text":"OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-863"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-32897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32897","title":"CVE-2026-32897 (LOW 3.7)","content_text":"OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset, creating dual-use of…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-320"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32058","title":"CVE-2026-32058 (LOW 2.6)","content_text":"OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests with modified environment variables. Attackers with access…","date_published":"2026-03-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":2.6,"severity":"LOW","cwe":["CWE-863"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-22172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22172","title":"CVE-2026-22172 (CRITICAL 9.9)","content_text":"OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding.…","date_published":"2026-03-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.9,"severity":"CRITICAL","cwe":["CWE-862"],"fixed_in":"2026.3.12"}},{"id":"CVE-2026-32038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32038","title":"CVE-2026-32038 (CRITICAL 9.8)","content_text":"OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can configure the docker.network parameter with container:<id>…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-284"],"fixed_in":"2026.2.24"}},{"id":"CVE-2026-32013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32013","title":"CVE-2026-32013 (HIGH 8.8)","content_text":"OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and writing files outside the agent workspace. Attackers can exploit symlinked…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-59"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-31998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31998","title":"CVE-2026-31998 (HIGH 8.6)","content_text":"OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserIds fails open. Attackers with Synology sender access can…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.6,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":null}},{"id":"CVE-2026-32034","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32034","title":"CVE-2026-32034 (HIGH 8.1)","content_text":"OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is exposed over plaintext HTTP, allowing attackers to bypass device…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-32014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32014","title":"CVE-2026-32014 (HIGH 8)","content_text":"OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client without being bound into the device-auth signature. An attacker with a paired…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8,"severity":"HIGH","cwe":["CWE-290"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-32015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32015","title":"CVE-2026-32015 (HIGH 7.8)","content_text":"OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that allows attackers to bypass allowlist checks by controlling process PATH resolution. Attackers who can influence the…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-426"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-32016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32016","title":"CVE-2026-32016 (HIGH 7.8)","content_text":"OpenClaw versions prior to 2026.2.22 on macOS contain a path validation bypass vulnerability in the exec-approval allowlist mode that allows local attackers to execute unauthorized binaries by exploiting basename-only allowlist entries.…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-426"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32032","title":"CVE-2026-32032 (HIGH 7.8)","content_text":"OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-426"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-28461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28461","title":"CVE-2026-28461 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-770"],"fixed_in":"2026.3.1"}},{"id":"CVE-2026-32011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32011","title":"CVE-2026-32011 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Google Chat that parse request bodies before performing authentication and signature validation. Unauthenticated…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-770"],"fixed_in":"2026.3.2"}},{"id":"CVE-2026-32025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32025","title":"CVE-2026-32025 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-307"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32030","title":"CVE-2026-32030 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that accepts arbitrary absolute paths when iMessage remote attachment fetching is enabled. An attacker who can tamper with…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-31989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31989","title":"CVE-2026-31989 (HIGH 7.4)","content_text":"OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy. An attacker who can influence citation redirect targets…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.4,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.3.1"}},{"id":"CVE-2026-32019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32019","title":"CVE-2026-32019 (HIGH 7.4)","content_text":"OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ranges to bypass SSRF policy checks. Attackers with network reachability to…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.4,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-27566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27566","title":"CVE-2026-27566 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-28460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28460","title":"CVE-2026-28460 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by splitting command substitution using shell line-continuation characters. Attackers…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-31992","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31992","title":"CVE-2026-31992 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.2.23"}},{"id":"CVE-2026-31994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31994","title":"CVE-2026-31994 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and expansion-sensitive characters in gateway.cmd files. Local…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-32000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32000","title":"CVE-2026-32000 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-32017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32017","title":"CVE-2026-32017 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.19 contain an allowlist bypass vulnerability in the exec safeBins policy that allows attackers to write arbitrary files using short-option payloads. Attackers can bypass argument validation by attaching…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-32023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32023","title":"CVE-2026-32023 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers can suppress shell-wrapper detection. Attackers can exploit this by chaining…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.2.24"}},{"id":"CVE-2026-32041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32041","title":"CVE-2026-32041 (MEDIUM 6.9)","content_text":"OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessible without authentication. Local processes or loopback-reachable SSRF paths…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.9,"severity":"MEDIUM","cwe":["CWE-306"],"fixed_in":"2026.3.1"}},{"id":"CVE-2026-29607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29607","title":"CVE-2026-29607 (MEDIUM 6.8)","content_text":"OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval checks by persisting wrapper-level allowlist entries instead of validating…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.8,"severity":"MEDIUM","cwe":["CWE-78"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32005","title":"CVE-2026-32005 (MEDIUM 6.8)","content_text":"OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks including block_action, view_submission, and view_closed in shared workspace deployments. Unauthorized workspace members can…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.8,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32007","title":"CVE-2026-32007 (MEDIUM 6.8)","content_text":"OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outside the workspace directory by exploiting inconsistent…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.8,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.2.23"}},{"id":"CVE-2026-29608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29608","title":"CVE-2026-29608 (MEDIUM 6.7)","content_text":"OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.7,"severity":"MEDIUM","cwe":["CWE-88"],"fixed_in":null}},{"id":"CVE-2026-32003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32003","title":"CVE-2026-32003 (MEDIUM 6.6)","content_text":"OpenClaw versions prior to 2026.2.22 contain an environment variable injection vulnerability in the system.run function that allows attackers to bypass command allowlist restrictions via SHELLOPTS and PS4 environment variables. An…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.6,"severity":"MEDIUM","cwe":["CWE-78"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-28449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28449","title":"CVE-2026-28449 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-294"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32004","title":"CVE-2026-32004 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization.…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-288"],"fixed_in":"2026.3.2"}},{"id":"CVE-2026-32008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32008","title":"CVE-2026-32008 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authenticated users with browser-tool access to navigate to file:// URLs.…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-610"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-32021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32021","title":"CVE-2026-32021 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the Feishu allowFrom allowlist implementation that accepts mutable sender display names instead of enforcing ID-only matching. An attacker can set a…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32022","title":"CVE-2026-32022 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the grep tool within tools.exec.safeBins that allows attackers to read arbitrary files by supplying a pattern via the -e flag parameter. Attackers…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-32026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32026","title":"CVE-2026-32026 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temporary directory outside the active sandbox root. Attackers can exploit this…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.2.24"}},{"id":"CVE-2026-32027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32027","title":"CVE-2026-32027 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checks. Attackers can exploit this cross-context…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-32033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32033","title":"CVE-2026-32033 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validation due to canonicalization mismatch. Attackers can exploit this by crafting…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.2.24"}},{"id":"CVE-2026-32036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32036","title":"CVE-2026-32036 (MEDIUM 6.5)","content_text":"OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-289","CWE-22"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-31999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31999","title":"CVE-2026-31999 (MEDIUM 6.3)","content_text":"OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files that allows attackers to influence execution behavior through cwd…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-78"],"fixed_in":"2026.3.1"}},{"id":"CVE-2026-32010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32010","title":"CVE-2026-32010 (MEDIUM 6.3)","content_text":"OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safe-bin configuration when sort is manually added to tools.exec.safeBins. Attackers can invoke sort with the --compress-program flag to execute…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-78"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-22176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22176","title":"CVE-2026-22176 (MEDIUM 6.1)","content_text":"OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-78"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-31990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31990","title":"CVE-2026-31990 (MEDIUM 6.1)","content_text":"OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace.…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-59"],"fixed_in":"2026.3.2"}},{"id":"CVE-2026-31997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31997","title":"CVE-2026-31997 (MEDIUM 6)","content_text":"OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable rebind attacks. Attackers can modify PATH resolution after approval to…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.3.1"}},{"id":"CVE-2026-32037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32037","title":"CVE-2026-32037 (MEDIUM 6)","content_text":"OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads. Attackers can supply or influence attachment URLs to force redirects to…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32035","title":"CVE-2026-32035 (MEDIUM 5.9)","content_text":"OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true. Non-owner voice participants can exploit this omission to access…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.9,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.3.2"}},{"id":"CVE-2026-32039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32039","title":"CVE-2026-32039 (MEDIUM 5.9)","content_text":"OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the toolsBySender group policy matching that allows attackers to inherit elevated tool permissions through identifier collision attacks. Attackers can…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.9,"severity":"MEDIUM","cwe":["CWE-639"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32009","title":"CVE-2026-32009 (MEDIUM 5.7)","content_text":"OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories including writable package-manager paths like /opt/homebrew/bin and /usr/local/bin.…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.7,"severity":"MEDIUM","cwe":["CWE-426"],"fixed_in":"2026.2.24"}},{"id":"CVE-2026-32024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32024","title":"CVE-2026-32024 (MEDIUM 5.5)","content_text":"OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the configured workspace boundary. Remote attackers can exploit this by requesting…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-59"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32001","title":"CVE-2026-32001 (MEDIUM 5.4)","content_text":"OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=node without device identity verification. Attackers can exploit this…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.4,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-27670","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27670","title":"CVE-2026-27670 (MEDIUM 5.3)","content_text":"OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.3.2"}},{"id":"CVE-2026-31995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31995","title":"CVE-2026-31995 (MEDIUM 5.3)","content_text":"OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments.…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-78"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-32002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32002","title":"CVE-2026-32002 (MEDIUM 5.3)","content_text":"OpenClaw versions prior to 2026.2.23 contain a sandbox bypass vulnerability in the sandboxed image tool that fails to enforce tools.fs.workspaceOnly restrictions on mounted sandbox paths, allowing attackers to read out-of-workspace…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-200"],"fixed_in":"2026.2.23"}},{"id":"CVE-2026-32028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32028","title":"CVE-2026-32028 (MEDIUM 5.3)","content_text":"OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications, allowing non-allowlisted users to enqueue reaction-derived system events. Attackers can…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.2.25"}},{"id":"CVE-2026-32029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32029","title":"CVE-2026-32029 (MEDIUM 5.3)","content_text":"OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoof client IP addresses. In proxy chains that append or…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-345"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-31993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31993","title":"CVE-2026-31993 (MEDIUM 4.8)","content_text":"OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.8,"severity":"MEDIUM","cwe":["CWE-184"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32031","title":"CVE-2026-32031 (MEDIUM 4.8)","content_text":"OpenClaw versions prior to 2026.2.26 server-http contains an authentication bypass vulnerability in gateway authentication for plugin channel endpoints due to path canonicalization mismatch between the gateway guard and plugin handler…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.8,"severity":"MEDIUM","cwe":["CWE-288"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-32040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32040","title":"CVE-2026-32040 (MEDIUM 4.6)","content_text":"OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript by injecting malicious mimeType values in image content blocks. Attackers…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.6,"severity":"MEDIUM","cwe":["CWE-79"],"fixed_in":"2026.2.23"}},{"id":"CVE-2026-31996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31996","title":"CVE-2026-31996 (MEDIUM 4.4)","content_text":"OpenClaw versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vulnerability that allows attackers to execute unintended filesystem operations through sort output flags or recursive grep flags. Attackers…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.4,"severity":"MEDIUM","cwe":["CWE-78"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-31991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31991","title":"CVE-2026-31991 (LOW 3.7)","content_text":"OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-863"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-32018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32018","title":"CVE-2026-32018 (LOW 3.6)","content_text":"OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.6,"severity":"LOW","cwe":["CWE-362"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-32020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32020","title":"CVE-2026-32020 (LOW 3.3)","content_text":"OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file reads. Attackers can place symlinks under the Control UI root directory to…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.3,"severity":"LOW","cwe":["CWE-59","CWE-22"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32006","title":"CVE-2026-32006 (LOW 3.1)","content_text":"OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist identities when dmPolicy=pairing and groupPolicy=allowlist. Remote attackers…","date_published":"2026-03-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.1,"severity":"LOW","cwe":["CWE-863"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-22171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22171","title":"CVE-2026-22171 (HIGH 8.2)","content_text":"OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.2,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-22181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22181","title":"CVE-2026-22181 (HIGH 7.6)","content_text":"OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when environment proxy variables are configured. When HTTP_PROXY, HTTPS_PROXY, or…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.3.2"}},{"id":"CVE-2026-22179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22179","title":"CVE-2026-22179 (HIGH 7.2)","content_text":"OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens.…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.2,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-22175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22175","title":"CVE-2026-22175 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through unrecognized multiplexer shell wrappers like busybox and toybox sh -c commands.…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-184"],"fixed_in":"2026.2.23"}},{"id":"CVE-2026-22174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22174","title":"CVE-2026-22174 (MEDIUM 6.8)","content_text":"OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to capture the Gateway authentication token. An attacker controlling a loopback…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.8,"severity":"MEDIUM","cwe":["CWE-306"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-22169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22169","title":"CVE-2026-22169 (MEDIUM 6.7)","content_text":"OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option. When sort is explicitly added to…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.7,"severity":"MEDIUM","cwe":["CWE-78"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-22168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22168","title":"CVE-2026-22168 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-88"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-22170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22170","title":"CVE-2026-22170 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration causes dmPolicy pairing and allowlist restrictions to be ineffective. Remote…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-863"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-22178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22178","title":"CVE-2026-22178 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-1333"],"fixed_in":"2026.2.19"}},{"id":"CVE-2026-27522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27522","title":"CVE-2026-27522 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hydrate media from local absolute paths to read arbitrary…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.2.24"}},{"id":"CVE-2026-22177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22177","title":"CVE-2026-22177 (MEDIUM 6.1)","content_text":"OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-15"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-22217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22217","title":"CVE-2026-22217 (MEDIUM 6.1)","content_text":"OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-controlled binaries by exploiting trusted-prefix fallback logic for the $SHELL…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-829"],"fixed_in":"2026.2.23"}},{"id":"CVE-2026-27523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27523","title":"CVE-2026-27523 (MEDIUM 6.1)","content_text":"OpenClaw versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing attackers to bypass allowed-root and blocked-path checks via symlinked parent directories with non-existent leaf paths. Attackers can craft…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.2.24"}},{"id":"CVE-2026-27545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27545","title":"CVE-2026-27545 (MEDIUM 6.1)","content_text":"OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended filesystem locations by rebinding writable parent symlinks in the current…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-367"],"fixed_in":"2026.2.26"}},{"id":"CVE-2026-22180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22180","title":"CVE-2026-22180 (MEDIUM 5.3)","content_text":"OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser output handling that allows writes outside intended root directories. Attackers can exploit insufficient canonical path-boundary validation…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-59"],"fixed_in":"2026.3.2"}},{"id":"CVE-2026-27524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27524","title":"CVE-2026-27524 (MEDIUM 4.3)","content_text":"OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authorized /debug set callers can inject __proto__, constructor, or prototype keys…","date_published":"2026-03-18T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-1321"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-32302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32302","title":"CVE-2026-32302 (HIGH 8.1)","content_text":"OpenClaw is a personal AI assistant. Prior to 2026.3.11, browser-originated WebSocket connections could bypass origin validation when gateway.auth.mode was set to trusted-proxy and the request arrived with proxy headers. A page served…","date_published":"2026-03-13T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-346"],"fixed_in":"2026.3.11"}},{"id":"CVE-2026-4039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4039","title":"CVE-2026-4039 (MEDIUM 6.3)","content_text":"A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to…","date_published":"2026-03-12T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.3,"severity":"MEDIUM","cwe":["CWE-74","CWE-94"],"fixed_in":null}},{"id":"CVE-2026-4040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4040","title":"CVE-2026-4040 (LOW 3.3)","content_text":"A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack…","date_published":"2026-03-12T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.3,"severity":"LOW","cwe":["CWE-200","CWE-203"],"fixed_in":null}},{"id":"CVE-2026-30741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30741","title":"CVE-2026-30741 (CRITICAL 9.8)","content_text":"A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Side prompt injection attack.","date_published":"2026-03-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-94"],"fixed_in":null}},{"id":"CVE-2026-32059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32059","title":"CVE-2026-32059 (HIGH 8.8)","content_text":"OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allowing attackers to bypass denied-flag checks via abbreviated options. Remote…","date_published":"2026-03-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.2.23"}},{"id":"CVE-2026-32060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32060","title":"CVE-2026-32060 (HIGH 8.8)","content_text":"OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox…","date_published":"2026-03-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-32062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32062","title":"CVE-2026-32062 (HIGH 7.5)","content_text":"OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated…","date_published":"2026-03-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-770"],"fixed_in":"2026.2.22"}},{"id":"CVE-2026-32063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32063","title":"CVE-2026-32063 (HIGH 7.1)","content_text":"OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-controlled environment values are not validated for CR/LF characters, allowing newline injection…","date_published":"2026-03-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-77"],"fixed_in":"2026.2.21"}},{"id":"CVE-2026-32061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32061","title":"CVE-2026-32061 (MEDIUM 4.4)","content_text":"OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outside the config directory boundary. Attackers with config modification…","date_published":"2026-03-11T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.4,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.2.17"}},{"id":"CVE-2026-28466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28466","title":"CVE-2026-28466 (CRITICAL 9.9)","content_text":"OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.9,"severity":"CRITICAL","cwe":["CWE-863"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28391","title":"CVE-2026-28391 (CRITICAL 9.8)","content_text":"OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to bypass command approval restrictions. Remote attackers can…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-78"],"fixed_in":"2026.2.2"}},{"id":"CVE-2026-28470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28470","title":"CVE-2026-28470 (CRITICAL 9.8)","content_text":"OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting command substitution syntax. Attackers can bypass the…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-78"],"fixed_in":"2026.2.2"}},{"id":"CVE-2026-28474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28474","title":"CVE-2026-28474 (CRITICAL 9.8)","content_text":"OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-09-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-863"],"fixed_in":"2026.2.6"}},{"id":"CVE-2026-28446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28446","title":"CVE-2026-28446 (CRITICAL 9.4)","content_text":"OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist policy validation that accepts empty caller IDs and uses suffix-based matching…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.4,"severity":"CRITICAL","cwe":["CWE-303"],"fixed_in":"2026.2.1"}},{"id":"CVE-2026-29610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29610","title":"CVE-2026-29610 (HIGH 8.8)","content_text":"OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH environment variables through node-host execution or project-local bootstrapping.…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-427"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28463","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28463","title":"CVE-2026-28463 (HIGH 8.4)","content_text":"OpenClaw versions prior to 2026.2.14 contain an arbitrary file read vulnerability in the exec-approvals allowlist validation that checks pre-expansion argv tokens but executes using real shell expansion. Attackers with authorization or…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.4,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28485","title":"CVE-2026-28485 (HIGH 8.4)","content_text":"OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke privileged operations. Remote attackers on the local…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.4,"severity":"HIGH","cwe":["CWE-306"],"fixed_in":"2026.2.12"}},{"id":"CVE-2026-28451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28451","title":"CVE-2026-28451 (HIGH 8.3)","content_text":"OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remote URLs without SSRF protections via sendMediaFeishu function and…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28476","title":"CVE-2026-28476 (HIGH 8.3)","content_text":"OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authentication without proper validation. Attackers who can influence…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.3,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28447","title":"CVE-2026-28447 (HIGH 8.1)","content_text":"OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensions directory. Attackers can craft scoped package names…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.2.1"}},{"id":"CVE-2026-28458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28458","title":"CVE-2026-28458 (HIGH 8.1)","content_text":"OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing websites to…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-306"],"fixed_in":"2026.2.1"}},{"id":"CVE-2026-28472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28472","title":"CVE-2026-28472 (HIGH 8.1)","content_text":"OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when auth.token is present but not validated. Attackers can connect to the gateway…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-306"],"fixed_in":"2026.2.2"}},{"id":"CVE-2026-28473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28473","title":"CVE-2026-28473 (HIGH 8.1)","content_text":"OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending the /approve chat command. The /approve command path invokes…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.1,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.2.2"}},{"id":"CVE-2026-28393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28393","title":"CVE-2026-28393 (HIGH 7.7)","content_text":"OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter accepts absolute paths…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28468","title":"CVE-2026-28468 (HIGH 7.7)","content_text":"OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiring gateway authentication, allowing local attackers to access browser control…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-306"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28392","title":"CVE-2026-28392 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28453","title":"CVE-2026-28453 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28454","title":"CVE-2026-28454 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-345"],"fixed_in":"2026.2.2"}},{"id":"CVE-2026-28462","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28462","title":"CVE-2026-28462 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories.…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.2.13"}},{"id":"CVE-2026-28469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28469","title":"CVE-2026-28469 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misrouting when multiple webhook targets share the same HTTP path. Attackers can…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-639"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28478","title":"CVE-2026-28478 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits. Remote unauthenticated attackers can send oversized JSON payloads or slow…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-770"],"fixed_in":"2026.2.13"}},{"id":"CVE-2026-28479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28479","title":"CVE-2026-28479 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vulnerable to collision attacks. An attacker can exploit SHA-1 collisions to…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-327"],"fixed_in":"2026.2.15"}},{"id":"CVE-2026-29609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29609","title":"CVE-2026-29609 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing maxBytes limits. Remote attackers can trigger memory…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-770"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-29611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29611","title":"CVE-2026-29611 (HIGH 7.5)","content_text":"OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling that allows attackers to read arbitrary files from the local filesystem. The…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-73"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28448","title":"CVE-2026-28448 (HIGH 7.3)","content_text":"OpenClaw versions 2026.1.29 prior to 2026.2.1 contain a vulnerability in the Twitch plugin (must be installed and enabled) in which it fails to enforce the allowFrom allowlist when allowedRoles is unset or empty, allowing unauthorized…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-285"],"fixed_in":"2026.2.1"}},{"id":"CVE-2026-28456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28456","title":"CVE-2026-28456 (HIGH 7.2)","content_text":"OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths before passing them to dynamic import(), allowing code execution. An attacker…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.2,"severity":"HIGH","cwe":["CWE-427"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28459","title":"CVE-2026-28459 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary locations on the host filesystem. Attackers can supply a sessionFile path…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-73"],"fixed_in":"2026.2.12"}},{"id":"CVE-2026-28477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28477","title":"CVE-2026-28477 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An attacker can convince a user to paste attacker-controlled…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-352"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28482","title":"CVE-2026-28482 (HIGH 7.1)","content_text":"OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory containment. Authenticated attackers can exploit path traversal sequences like…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":"2026.2.12"}},{"id":"CVE-2026-28450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28450","title":"CVE-2026-28450 (MEDIUM 6.8)","content_text":"OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.8,"severity":"MEDIUM","cwe":["CWE-306"],"fixed_in":"2026.2.12"}},{"id":"CVE-2026-28394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28394","title":"CVE-2026-28394 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion by parsing oversized or deeply nested HTML responses.…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-770"],"fixed_in":"2026.2.15"}},{"id":"CVE-2026-28395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28395","title":"CVE-2026-28395 (MEDIUM 6.5)","content_text":"OpenClaw version 2026.1.14-1 prior to 2026.2.12 contains an improper network binding vulnerability in the Chrome extension (must be installed and enabled) relay server that treats wildcard hosts as loopback addresses, allowing the relay…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-1327"],"fixed_in":"2026.2.12"}},{"id":"CVE-2026-28467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28467","title":"CVE-2026-28467 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.2 contain a server-side request forgery vulnerability in attachment and media URL hydration that allows remote attackers to fetch arbitrary HTTP(S) URLs. Attackers who can influence media URLs through…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-918"],"fixed_in":"2026.2.2"}},{"id":"CVE-2026-28480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28480","title":"CVE-2026-28480 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-290"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28481","title":"CVE-2026-28481 (MEDIUM 6.5)","content_text":"OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional extension must be enabled) that leaks bearer tokens to allowlisted suffix…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-201"],"fixed_in":null}},{"id":"CVE-2026-29606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29606","title":"CVE-2026-29606 (MEDIUM 6.5)","content_text":"OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-306"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28457","title":"CVE-2026-28457 (MEDIUM 6.1)","content_text":"OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring (must be enabled) that uses the skill frontmatter name parameter unsanitized when copying skills into the sandbox workspace.…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28486","title":"CVE-2026-28486 (MEDIUM 6.1)","content_text":"OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrary file writes outside the intended directory. Attackers can craft malicious…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.1,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28464","title":"CVE-2026-28464 (MEDIUM 5.9)","content_text":"OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.9,"severity":"MEDIUM","cwe":["CWE-208"],"fixed_in":"2026.2.12"}},{"id":"CVE-2026-28465","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28465","title":"CVE-2026-28465 (MEDIUM 5.9)","content_text":"OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-09-17T00:00:00Z","_openclawpro":{"cvss":5.9,"severity":"MEDIUM","cwe":["CWE-290"],"fixed_in":"2026.2.3"}},{"id":"CVE-2026-29613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29613","title":"CVE-2026-29613 (MEDIUM 5.9)","content_text":"OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remoteAddress without validating forwarding headers, allowing…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.9,"severity":"MEDIUM","cwe":["CWE-306"],"fixed_in":"2026.2.12"}},{"id":"CVE-2026-28452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28452","title":"CVE-2026-28452 (MEDIUM 5.5)","content_text":"OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-770"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-29612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29612","title":"CVE-2026-29612 (MEDIUM 5.5)","content_text":"OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-770"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-28471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28471","title":"CVE-2026-28471 (MEDIUM 5.3)","content_text":"OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in which DM allowlist matching could be bypassed by exact-matching against sender display names and localparts without…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-287"],"fixed_in":"2026.2.2"}},{"id":"CVE-2026-28475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28475","title":"CVE-2026-28475 (MEDIUM 4.8)","content_text":"OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can…","date_published":"2026-03-05T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.8,"severity":"MEDIUM","cwe":["CWE-208"],"fixed_in":"2026.2.13"}},{"id":"CVE-2026-28363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28363","title":"CVE-2026-28363 (CRITICAL 9.9)","content_text":"In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to…","date_published":"2026-02-27T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.9,"severity":"CRITICAL","cwe":["CWE-184"],"fixed_in":"2026.2.23"}},{"id":"CVE-2026-27487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27487","title":"CVE-2026-27487 (HIGH 7.6)","content_text":"OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security…","date_published":"2026-02-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":null}},{"id":"CVE-2026-27488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27488","title":"CVE-2026-27488 (HIGH 7.3)","content_text":"OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy…","date_published":"2026-02-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.3,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":null}},{"id":"CVE-2026-27486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27486","title":"CVE-2026-27486 (MEDIUM 5.3)","content_text":"OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern matching to terminate processes without verifying if they are owned by the…","date_published":"2026-02-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.3,"severity":"MEDIUM","cwe":["CWE-283"],"fixed_in":null}},{"id":"CVE-2026-27485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27485","title":"CVE-2026-27485 (MEDIUM 4.4)","content_text":"OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If…","date_published":"2026-02-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.4,"severity":"MEDIUM","cwe":["CWE-61"],"fixed_in":null}},{"id":"CVE-2026-27484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27484","title":"CVE-2026-27484 (MEDIUM 4.3)","content_text":"OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender…","date_published":"2026-02-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-862"],"fixed_in":null}},{"id":"CVE-2026-27576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27576","title":"CVE-2026-27576 (MEDIUM 4)","content_text":"OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt payloads before forwarding them to chat.send. Because ACP runs over local…","date_published":"2026-02-21T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4,"severity":"MEDIUM","cwe":["CWE-400"],"fixed_in":null}},{"id":"CVE-2026-27002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27002","title":"CVE-2026-27002 (CRITICAL 9.8)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling…","date_published":"2026-02-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":9.8,"severity":"CRITICAL","cwe":["CWE-250"],"fixed_in":"2026.2.15"}},{"id":"CVE-2026-27001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27001","title":"CVE-2026-27001 (HIGH 7.8)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, OpenClaw embedded the current working directory (workspace path) into the agent system prompt without sanitization. If an attacker can cause OpenClaw to run inside a…","date_published":"2026-02-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.8,"severity":"HIGH","cwe":["CWE-77"],"fixed_in":"2026.2.15"}},{"id":"CVE-2026-26972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26972","title":"CVE-2026-26972 (MEDIUM 6.7)","content_text":"OpenClaw is a personal AI assistant. In versions 2026.1.12 through 2026.2.12, OpenClaw browser download helpers accepted an unsanitized output path. When invoked via the browser control gateway routes, this allowed path traversal to…","date_published":"2026-02-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.7,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":null}},{"id":"CVE-2026-27008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27008","title":"CVE-2026-27008 (MEDIUM 6.7)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in `download` skill installation allowed `targetDir` values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated. In the…","date_published":"2026-02-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.7,"severity":"MEDIUM","cwe":["CWE-73"],"fixed_in":"2026.2.15"}},{"id":"CVE-2026-26328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26328","title":"CVE-2026-26328 (MEDIUM 6.5)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group…","date_published":"2026-02-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-284","CWE-863"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-26329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26329","title":"CVE-2026-26329 (MEDIUM 6.5)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.14, authenticated attackers can read arbitrary files from the Gateway host by supplying absolute paths or path traversal sequences to the browser tool's `upload` action. The…","date_published":"2026-02-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-27009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27009","title":"CVE-2026-27009 (MEDIUM 5.8)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `<script>` tag without script-context-safe escaping. A crafted…","date_published":"2026-02-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.8,"severity":"MEDIUM","cwe":["CWE-79"],"fixed_in":"2026.2.15"}},{"id":"CVE-2026-27003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27003","title":"CVE-2026-27003 (MEDIUM 5.5)","content_text":"OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot<token>/...`). Prior to version 2026.2.15, OpenClaw logged these…","date_published":"2026-02-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-522"],"fixed_in":"2026.2.15"}},{"id":"CVE-2026-27004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27004","title":"CVE-2026-27004 (MEDIUM 5.5)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools (`sessions_list`, `sessions_history`, `sessions_send`) allowed broader session targeting than some operators…","date_published":"2026-02-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":5.5,"severity":"MEDIUM","cwe":["CWE-209","CWE-346"],"fixed_in":"2026.2.15"}},{"id":"CVE-2026-27007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27007","title":"CVE-2026-27007 (LOW 3.3)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, `normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration…","date_published":"2026-02-20T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.3,"severity":"LOW","cwe":["CWE-1254"],"fixed_in":"2026.2.15"}},{"id":"CVE-2026-26323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26323","title":"CVE-2026-26323 (HIGH 8.8)","content_text":"OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script `scripts/update-clawtributors.ts`. The issue affects contributors/maintainers (or CI) who run `bun…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":null}},{"id":"CVE-2026-26322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26322","title":"CVE-2026-26322 (HIGH 7.6)","content_text":"OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Gateway tool accepted a tool-supplied `gatewayUrl` without sufficient restrictions, which could cause the OpenClaw host to attempt outbound WebSocket…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.6,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":null}},{"id":"CVE-2026-25474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25474","title":"CVE-2026-25474 (HIGH 7.5)","content_text":"OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-345"],"fixed_in":null}},{"id":"CVE-2026-26316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26316","title":"CVE-2026-26316 (HIGH 7.5)","content_text":"OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (`127.0.0.1`, `::1`,…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-863"],"fixed_in":"2026.2.13"}},{"id":"CVE-2026-26319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26319","title":"CVE-2026-26319 (HIGH 7.5)","content_text":"OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbound webhook requests when telnyx.publicKey is not configured, enabling…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-306"],"fixed_in":null}},{"id":"CVE-2026-26321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26321","title":"CVE-2026-26321 (HIGH 7.5)","content_text":"OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. If an…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-22"],"fixed_in":null}},{"id":"CVE-2026-26324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26324","title":"CVE-2026-26324 (HIGH 7.5)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.14, OpenClaw's SSRF protection could be bypassed using full-form IPv4-mapped IPv6 literals such as `0:0:0:0:0:ffff:7f00:1` (which is `127.0.0.1`). This could allow requests…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.5,"severity":"HIGH","cwe":["CWE-918"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-26325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26325","title":"CVE-2026-26325 (HIGH 7.2)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.14, a mismatch between `rawCommand` and `command[]` in the node host `system.run` handler could cause allowlist/approval evaluation to be performed on one command while…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.2,"severity":"HIGH","cwe":["CWE-284"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-26317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26317","title":"CVE-2026-26317 (HIGH 7.1)","content_text":"OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.1,"severity":"HIGH","cwe":["CWE-352"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-26320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26320","title":"CVE-2026-26320 (MEDIUM 6.5)","content_text":"OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unattended `key`, the app shows a confirmation dialog that previously displayed only…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-451"],"fixed_in":null}},{"id":"CVE-2026-26327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26327","title":"CVE-2026-26327 (MEDIUM 6.5)","content_text":"OpenClaw is a personal AI assistant. Discovery beacons (Bonjour/mDNS and DNS-SD) include TXT records such as `lanHost`, `tailnetDns`, `gatewayPort`, and `gatewayTlsSha256`. TXT records are unauthenticated. Prior to version 2026.2.14,…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-345"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-26326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26326","title":"CVE-2026-26326 (MEDIUM 4.3)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.2.14, `skills.status` could disclose secrets to `operator.read` clients by returning raw resolved config values in `configChecks` for skill `requires.config` paths. Version…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":4.3,"severity":"MEDIUM","cwe":["CWE-200"],"fixed_in":"2026.2.14"}},{"id":"CVE-2026-24764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24764","title":"CVE-2026-24764 (LOW 3.7)","content_text":"OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's…","date_published":"2026-02-19T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":3.7,"severity":"LOW","cwe":["CWE-74","CWE-94"],"fixed_in":null}},{"id":"CVE-2026-25593","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25593","title":"CVE-2026-25593 (HIGH 8.4)","content_text":"OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery,…","date_published":"2026-02-06T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.4,"severity":"HIGH","cwe":["CWE-78","CWE-306"],"fixed_in":"2026.1.20"}},{"id":"CVE-2026-25157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25157","title":"CVE-2026-25157 (HIGH 7.7)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly…","date_published":"2026-02-04T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":7.7,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.1.29"}},{"id":"CVE-2026-25475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25475","title":"CVE-2026-25475 (MEDIUM 6.5)","content_text":"OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent…","date_published":"2026-02-04T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":6.5,"severity":"MEDIUM","cwe":["CWE-22","CWE-200"],"fixed_in":"2026.1.30"}},{"id":"CVE-2026-24763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24763","title":"CVE-2026-24763 (HIGH 8.8)","content_text":"OpenClaw (formerly  Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw’s Docker sandbox execution mechanism due to unsafe handling of the PATH…","date_published":"2026-02-02T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-78"],"fixed_in":"2026.1.29"}},{"id":"CVE-2026-25253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25253","title":"CVE-2026-25253 (HIGH 8.8)","content_text":"OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.","date_published":"2026-02-01T00:00:00Z","date_modified":"2026-06-17T00:00:00Z","_openclawpro":{"cvss":8.8,"severity":"HIGH","cwe":["CWE-669"],"fixed_in":"2026.1.29"}}]}