Skip to contentOpenclaw vulnerabilities
Newest
- openclawOpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit BypassCVE-2026-622206.3 Medium
- openclawOpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDsCVE-2026-622196.0 Medium
- openclawOpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approveCVE-2026-622188.7 High
- openclawOpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvalsCVE-2026-622177.7 High
- openclawOpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media UploadCVE-2026-622162.3 Low
- openclawOpenClaw < 2026.6.5 Authentication Bypass via HTTP CanvasCVE-2026-622155.1 Medium
- openclaw, openclaw msteams +1 moreOpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter ValidationCVE-2026-622146.0 Medium
- openclaw, openclaw msteams +1 moreOpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound RequestsCVE-2026-622136.0 Medium
- openclawOpenClaw < 2026.5.28 Authentication Bypass via safeFetchCVE-2026-622125.1 Medium
- openclawOpenClaw < 2026.6.1 Credential Redaction Bypass via Trajectory ExportCVE-2026-622114.1 Medium
- openclawOpenClaw < 2026.6.1 Denial of Service via Remote Media URLsCVE-2026-622106.0 Medium
- openclawOpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatchCVE-2026-622097.6 High
- openclawOpenClaw < 2026.6.5 Authentication Bypass via Admin ToolsCVE-2026-622077.7 High
- openclawOpenClaw < 2026.6.9 Authentication Bypass via Moderation ActionsCVE-2026-622066.0 Medium
- openclawOpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actionsCVE-2026-622056.0 Medium
- openclawOpenClaw < 2026.6.6 Environment Variable Injection via rustupCVE-2026-622037.7 High
- openclawOpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via CronCVE-2026-622027.7 High
- openclawOpenClaw < 2026.6.6 Network Policy Bypass via exec-serverCVE-2026-62201Public exploit4.9 Medium
- openclawOpenClaw < 2026.6.6 Authentication Bypass via Git ext transportCVE-2026-622008.7 High
- openclawOpenClaw < 2026.6.6 Authentication Bypass via Environment FilteringCVE-2026-621998.7 High
- openclawOpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web SearchCVE-2026-621985.3 Medium
- openclawOpenClaw < 2026.6.6 Policy Bypass via CDP DiscoveryCVE-2026-62197Fix available6.3 Medium
- openclawOpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDsCVE-2026-621968.7 High
- openclawOpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopbackCVE-2026-621958.7 High
- openclawOpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin InstallCVE-2026-621948.7 High
- openclawOpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin InstallCVE-2026-621936.9 Medium
- openclawOpenClaw 2026.6.6 < 2026.6.9 Authorization BypassCVE-2026-621927.2 High
- openclawOpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message MutationsCVE-2026-621917.1 High
- openclawOpenClaw < 2026.6.9 Authorization Bypass via flock wrapperCVE-2026-621908.7 High
- openclawOpenClaw < 2026.6.9 Symlink Following via Mirror SyncCVE-2026-621897.6 High
- openclaw feishu, openclaw\/feishu +1 moreOpenClaw < 2026.6.9 Feishu Authorization BypassCVE-2026-62188Fix available8.6 High
- openclaw feishu, openclaw\/feishu +1 moreOpenClaw < 2026.6.9 Feishu tools Authorization BypassCVE-2026-62187Fix available8.6 High
- openclawOpenClaw < 2026.6.8 Authorization Bypass via HTTP Model OverrideCVE-2026-621867.2 High
- openclawOpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv FilesCVE-2026-592618.4 High
- openclawOpenClaw < 2026.6.5 Authorization Header Forwarding via SSECVE-2026-62208Fix available6.0 Medium
- openclawOpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command ParsingCVE-2026-53866Fix available7.6 High
- openclawOpenClaw < 2026.5.2 - Arbitrary Command Execution via Workspace-Derived Service PATHCVE-2026-53865Fix available7.2 High
- openclawOpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control VariablesCVE-2026-53864Fix available7.6 High
- openclawOpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group PolicyCVE-2026-53863Fix available6.0 Medium
- openclawOpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope WideningCVE-2026-53862Fix available2.3 Low
- openclawOpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOSCVE-2026-53861Fix available5.3 Medium
- openclawOpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubblesCVE-2026-53860Fix available2.3 Low
- openclawOpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot InconsistencyCVE-2026-53859Fix available6.0 Medium
- openclawOpenClaw < 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE_DIRECTORY Environment VariableCVE-2026-53858Fix available7.0 High
- openclawOpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom PolicyCVE-2026-53857Fix available8.6 High
- openclawOpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.jsonCVE-2026-53856Fix available5.7 Medium
- openclawOpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval ChecksCVE-2026-53855Fix available7.6 High
- openclawOpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat CommandsCVE-2026-53854Fix available6.0 Medium
- openclawOpenClaw < 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOSCVE-2026-53853Fix available7.6 High
- openclawOpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairingCVE-2026-53852Fix available2.3 Low
- Show moreLoading…