Skip to contentOpenclaw vulnerabilities
Newest
- openclawOpenClaw < 2026.3.24 - Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl ParametersCVE-2026-35668Fix available7.1 High
- openclawOpenClaw < 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.tsCVE-2026-35667Fix available6.9 Medium
- openclawOpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval PromptCVE-2026-35651Fix available5.3 Medium
- openclawOpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization BypassCVE-2026-35661Fix available6.9 Medium
- openclawOpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token ValidationCVE-2026-35646Fix available6.3 Medium
- openclawOpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback InvokeCVE-2026-35654Fix available6.9 Medium
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSessionCVE-2026-35645Fix available6.1 Medium
- openclawOpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card CallbacksCVE-2026-35664Fix available6.9 Medium
- openclawOpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request ParsingCVE-2026-35640Fix available6.9 Medium
- openclawOpenClaw < 2026.3.25 - Server-Side Request Forgery via Unguarded Configured Base URLs in Channel ExtensionsCVE-2026-35629Fix available5.3 Medium
- openclawOpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayNameCVE-2026-35617Fix available2.3 Low
- openclawOpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId ResolutionCVE-2026-35636Fix available7.1 High
- openclawOpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History RouteCVE-2026-35657Fix available7.1 High
- openclawOpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate LimitingCVE-2026-356286.3 Medium
- openclawOpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention BypassCVE-2026-356425.3 Medium
- openclawOpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification NoticesCVE-2026-356476.9 Medium
- openclawOpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate LimitingCVE-2026-356236.3 Medium
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication ScopeCVE-2026-356698.7 High
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth ReconnectCVE-2026-356258.5 High
- openclawOpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-ClaimCVE-2026-356638.7 High
- openclawOpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill EndpointCVE-2026-345127.2 High
- openclawOpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/updateCVE-2026-356326.9 Medium
- openclawOpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image ToolCVE-2026-35658Fix available6.0 Medium
- openclawOpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission ResolutionCVE-2026-35655Fix available6.9 Medium
- openclawOpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology ChatCVE-2026-35635Fix available6.3 Medium
- openclawOpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send ActionCVE-2026-35662Fix available5.3 Medium
- openclawOpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate LimiterCVE-2026-35656Fix available6.3 Medium
- openclawOpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope ValidationCVE-2026-35639Fix available8.7 High
- openclawOpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat WebhookCVE-2026-35622Fix available6.0 Medium
- openclawOpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud TalkCVE-2026-35624Fix available2.3 Low
- openclawOpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty AllowlistCVE-2026-35649Fix available6.3 Medium
- openclawOpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DMCVE-2026-35637Fix available6.9 Medium
- openclawOpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat CommandsCVE-2026-35631Fix available7.1 High
- openclawOpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback DispatchCVE-2026-35652Fix available6.9 Medium
- openclawOpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway SnapshotsCVE-2026-35644Fix available7.1 High
- openclawOpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node ActionsCVE-2026-35648Fix available2.3 Low
- openclawOpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent SanitizationCVE-2026-35650Fix available7.7 High
- openclawOpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UICVE-2026-35638Fix available8.7 High
- openclawOpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call WebhookCVE-2026-35626Fix available6.9 Medium
- openclawOpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD DiscoveryCVE-2026-35659Fix available5.1 Medium
- openclawOpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error ResponsesCVE-2026-35633Fix available6.9 Medium
- openclawOpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterfaceCVE-2026-35643Fix available8.6 High
- openclawOpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch WrapperCVE-2026-35666Fix available7.7 High
- openclawOpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM HandlingCVE-2026-35627Fix available6.9 Medium
- openclawOpenClaw < 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology ChatCVE-2026-35670Fix available6.0 Medium
- openclawOpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media LoadersCVE-2026-34510Fix available6.9 Medium
- openclawOpenClaw - Approval Bypass via Environment Variable NormalizationCVE-2026-34426Fix available6.9 Medium
- openclawOpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session ResetCVE-2026-35660Fix available7.2 High
- openclawOpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas GatewayCVE-2026-35634Fix available5.1 Medium
- openclawOpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 VerificationCVE-2026-35618Fix available8.3 High
- Show moreLoading…