Openclaw vulnerabilities

Products

• Openclaw 645
• Windows Node 6
• Clawhub 5
• Crabbox 5
• Feishu 4
• Msteams 4
• Clawscan 3
• Voice-call 3
• Clawdbot 2
• Discord 2
• Matrix 2
• Openclaw\/feishu 2
• Slack 2

Newest

• openclaw clawscan OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism CVE-2026-110689 4.8 MediumOctober 14, 2026
• openclaw windows node OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override CVE-2026-101884 7.7 HighSeptember 30, 2026
• openclaw windows node OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present CVE-2026-101883 5.3 MediumSeptember 30, 2026
• openclaw windows node OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set CVE-2026-101882 8.7 HighSeptember 30, 2026
• openclaw windows node OpenClaw Windows Node before 2026.7.1 Denial of Service CVE-2026-101881 7.1 HighSeptember 30, 2026
• openclaw windows node OpenClaw Windows Node before 2026.7.1 Authorization Bypass CVE-2026-101880 8.7 HighSeptember 30, 2026
• openclaw windows node OpenClaw Windows Node before 2026.7.1-3 Missing Authorization CVE-2026-101879 7.1 HighSeptember 30, 2026
• openclaw OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket CVE-2026-102807 6.0 MediumSeptember 29, 2026
• openclaw OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines CVE-2026-102806 6.0 MediumSeptember 29, 2026
• openclaw clawhub ClawHub Authentication Bypass via Former Publisher Skill Control CVE-2026-100604 5.3 MediumSeptember 26, 2026
• openclaw clawhub ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports CVE-2026-100603 8.7 HighSeptember 26, 2026
• openclaw clawhub ClawHub Changelog Preview Information Disclosure via Authorization Bypass CVE-2026-100602 7.1 HighSeptember 26, 2026
• openclaw clawhub ClawHub SSRF via Unchecked DNS Resolution in Profile Image CVE-2026-100601 6.9 MediumSeptember 26, 2026
• openclaw clawhub ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API CVE-2026-100600 6.9 MediumSeptember 26, 2026
• openclaw OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome CVE-2026-100599 8.7 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Approval Binding Logic Error CVE-2026-100598 7.5 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Path Traversal via Filesystem Race CVE-2026-100597 8.8 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration CVE-2026-100596 8.7 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authorization Bypass via diagnostics CVE-2026-100595 7.1 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authorization Bypass via trajectory export CVE-2026-100594 7.1 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authentication Bypass via activation CVE-2026-100593 5.3 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming CVE-2026-100592 5.3 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authentication Bypass via Active Memory CVE-2026-100591 5.3 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authorization Bypass via voice set CVE-2026-100590 5.3 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node CVE-2026-100589 8.7 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authentication Bypass via node.invoke CVE-2026-100588 8.7 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authorization Bypass via Codex Install CVE-2026-100587 8.7 HighSeptember 26, 2026
• openclaw OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind CVE-2026-100586 8.7 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel CVE-2026-100585 8.6 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows CVE-2026-100584 5.4 MediumSeptember 26, 2026
• openclaw discord OpenClaw Discord before 2026.7.1 Authorization Bypass CVE-2026-100583 5.3 MediumSeptember 26, 2026
• openclaw feishu, googlechat, matrix +1 more +3 more OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass CVE-2026-100582 Fix available 7.1 HighSeptember 26, 2026
• openclaw OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension CVE-2026-100581 6.8 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Remote Code Execution via cron tool CVE-2026-100580 8.7 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester CVE-2026-100579 7.2 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.7.1 Authorization Bypass via chat.send CVE-2026-100578 7.2 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset CVE-2026-100577 5.3 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates CVE-2026-100576 5.3 MediumSeptember 26, 2026
• openclaw slack OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM CVE-2026-100575 8.7 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS CVE-2026-100574 8.2 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback CVE-2026-100573 4.8 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 Denial of Service via Rate Limit CVE-2026-100572 6.9 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass CVE-2026-100571 6.9 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS CVE-2026-100570 8.5 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override CVE-2026-100569 6.8 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 Unauthorized Command Job Access CVE-2026-100568 8.7 HighSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname CVE-2026-100567 8.9 HighSeptember 26, 2026
• openclaw line OpenClaw LINE before 2026.8.1 Access Control Inheritance CVE-2026-100566 6.9 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export CVE-2026-100564 5.3 MediumSeptember 26, 2026
• openclaw OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels CVE-2026-100563 5.3 MediumSeptember 26, 2026
• Show olderLoading…