Skip to contentOpenclaw vulnerabilities
Newest
- openclawOpenClaw has a local file disclosure via sendMediaFeishu in Feishu extensionCVE-2026-26321Fix available7.5 High
- openclawOpenClaw macOS deep link confirmation truncation can conceal executed agent messageCVE-2026-26320Fix available7.1 High
- openclawOpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated RequestsCVE-2026-26319Fix available7.5 High
- openclawOpenClaw 2026.1.29-beta.1 < 2026.2.1 - Path Traversal in Plugin Installation via Package NameCVE-2026-28447Fix available7.0 High
- openclawOpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat CommandCVE-2026-28473Fix available7.2 High
- openclawOpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix MatchingCVE-2026-28481Fix available5.9 Medium
- openclawOpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access ControlCVE-2026-28448Fix available6.3 Medium
- openclawOpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix MatchingCVE-2026-28446Fix available9.2 Critical
- openclaw, openclaw nextcloud-talk +1 moreOpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name SpoofingCVE-2026-28474Fix available9.3 Critical
- openclawOpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram WebhookCVE-2026-28454Fix available8.2 High
- openclawOpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix PluginCVE-2026-28471Fix available6.3 Medium
- openclaw, openclaw @openclaw/bluebubbles +1 moreOpenClaw has BlueBubbles webhook auth bypass via loopback proxy trustCVE-2026-26316Fix available7.5 High
- openclaw, openclaw voice-call +1 moreOpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded HeadersCVE-2026-28465Fix available8.2 High
- openclawOpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP EndpointsCVE-2026-28450Fix available8.3 High
- openclawOpenClaw < 2026.2.2 - SSRF via Attachment Media URL HydrationCVE-2026-28467Fix available6.3 Medium
- openclawOpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypassCVE-2026-25474Fix available7.5 High
- clawdbot, openclaw +1 moreOpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel DescriptionsCVE-2026-24764Fix available3.7 Low
- openclawOpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress TrustCVE-2026-29613Fix available8.2 High
- openclawOpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrlCVE-2026-28395Fix available6.3 Medium
- openclawOpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double QuotesCVE-2026-28470Fix available9.2 Critical
- openclawOpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket EndpointCVE-2026-28458Fix available7.4 High
- openclawOpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist EnforcementCVE-2026-28391Fix available9.2 Critical
- openclawOpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile PathCVE-2026-28459Fix available7.1 High
- openclawOpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect HandshakeCVE-2026-28472Fix available9.2 Critical
- openclawOpenClaw Affected by Unauthenticated Local RCE via WebSocket config.applyCVE-2026-25593Fix available8.4 High
- openclawOpenClaw Vulnerable to Local File Inclusion via MEDIA: Path ExtractionCVE-2026-25475Fix available6.5 Medium
- openclawOpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommandCVE-2026-25157Fix available7.8 High
- clawdbot, openclaw +1 moreAuthenticated Command Injection in OpenClaw Docker Execution via PATH Environment VariableCVE-2026-24763Fix available8.8 High
- openclawOpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrlCVE-2026-25253Public exploitFix availableEPSS 32.4%8.8 High