OpenClaw
|
CVE ID |
CVSS |
Title |
CWE |
Published |
|---|---|---|---|---|
|
9.9 |
In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be… |
CWE-184 |
2026-02-27 |
|
|
9.3 |
OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing |
CWE-294 |
2026-03-29 |
|
|
9.2 |
OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution |
CWE-672 |
2026-05-06 |
|
|
9.1 |
OpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner Downgrade |
CWE-184 |
2026-05-06 |
|
|
9 |
OpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay Binding |
CWE-1188 |
2026-05-06 |
|
|
8.8 |
OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable |
CWE-78 |
2026-02-02 |
|
|
8.8 |
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl |
CWE-669 |
2026-02-01 |
|
|
8.7 |
OpenClaw affected by denial of service via unbounded webhook request body buffering |
CWE-770 |
2026-03-05 |
|
|
8.7 |
OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods |
CWE-59 |
2026-03-19 |
|
|
8.7 |
OpenClaw Media Parsing Path Traversal to Arbitrary File Read |
CWE-22 |
2026-03-26 |
|
|
8.7 |
OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request |
CWE-770 |
2026-03-29 |
|
|
8.7 |
OpenClaw < 2026.3.13 - Telegram Bot Token Exposure in Media Fetch Error Logs |
CWE-532 |
2026-03-31 |
|
|
8.7 |
OpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug Endpoints |
CWE-863 |
2026-03-29 |
|
|
8.7 |
OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope |
CWE-648 |
2026-04-10 |
|
|
8.7 |
OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim |
CWE-648 |
2026-04-10 |
|
|
8.7 |
OpenClaw 2026.2.23 < 2026.4.12 - Weakened Exec Approval Binding via busybox and toybox Applet Execution |
CWE-863 |
2026-05-05 |
|
|
8.7 |
OpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment Injection |
CWE-184 |
2026-05-05 |
|
|
8.7 |
OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority |
CWE-266 |
2026-06-11 |
|
|
8.7 |
OpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing |
CWE-290 |
2026-06-11 |
|
|
8.7 |
OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows |
CWE-426 |
2026-06-11 |
|
|
8.7 |
OpenClaw: Pairing-scoped device session could restore revoked node token authority |
CWE-613 |
2026-06-16 |
|
|
8.6 |
OpenClaw: Unsanitized CWD path injection into LLM prompts |
CWE-77 |
2026-02-19 |
|
|
8.6 |
OpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes |
CWE-522 |
2026-03-29 |
|
|
8.6 |
OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node |
CWE-862 |
2026-06-11 |
|
|
8.6 |
OpenClaw < 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFrom |
CWE-290 |
2026-06-12 |
|
|
8.6 |
OpenClaw: Discord allowFrom could bind to mutable display names |
CWE-290 |
2026-06-16 |
|
|
8.6 |
OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy |
CWE-290 |
2026-06-16 |
|
|
8.4 |
OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation |
CWE-349 |
2026-04-10 |
|
|
8.4 |
OpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory |
CWE-427 |
2026-05-11 |
|
|
8.3 |
OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification |
CWE-294 |
2026-04-09 |
|
|
8.3 |
OpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command |
CWE-862 |
2026-05-29 |
|
|
8.2 |
OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting |
CWE-639 |
2026-03-05 |
|
|
8.2 |
OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust |
CWE-306 |
2026-03-05 |
|
|
8 |
OpenClaw: QQBot native approval buttons did not enforce configured approver identity |
CWE-862 |
2026-05-29 |
|
|
7.8 |
OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand |
CWE-78 |
2026-02-04 |
|
|
7.7 |
OpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback |
CWE-636 |
2026-04-28 |
|
|
7.7 |
OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup |
CWE-829 |
2026-05-05 |
|
|
7.7 |
OpenClaw < 2026.4.15 - Authorization Bypass in Matrix Room Control Commands via DM Pairing Store |
CWE-863 |
2026-05-06 |
|
|
7.7 |
OpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec Revalidation |
CWE-367 |
2026-06-11 |
|
|
7.7 |
OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom |
CWE-863 |
2026-06-11 |
|
|
7.7 |
OpenClaw: Matrix allowFrom could bind to mutable display names |
CWE-290 |
2026-06-11 |
|
|
7.7 |
OpenClaw's marketplace runtime extension metadata could point at unscanned payloads |
CWE-829 |
2026-06-11 |
|
|
7.6 |
OpenClaw: Prevent shell injection in macOS keychain credential write |
CWE-78 |
2026-02-21 |
|
|
7.6 |
OpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection |
CWE-472 |
2026-04-23 |
|
|
7.6 |
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns |
CWE-693, CWE-863 |
2026-06-16 |
|
|
7.6 |
OpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checks |
CWE-184, CWE-863 |
2026-06-16 |
|
|
7.6 |
OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing |
CWE-862 |
2026-06-16 |
|
|
7.6 |
OpenClaw: Host environment sanitizer missed two Node.js control variables |
CWE-184 |
2026-06-16 |
|
|
7.5 |
OpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated Requests |
CWE-306 |
2026-02-19 |
|
|
7.5 |
OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.run |
CWE-78 |
2026-03-18 |
|
|
7.5 |
OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension |
CWE-22 |
2026-02-19 |
|
|
7.5 |
OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap |
CWE-306 |
2026-03-19 |
|
|
7.4 |
OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access |
CWE-306 |
2026-03-05 |
|
|
7.4 |
OpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration |
CWE-290 |
2026-06-12 |
|
|
7.3 |
OpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variable |
CWE-426 |
2026-03-19 |
|
|
7.3 |
OpenClaw: Fake package roots could influence memory-core artifact loading |
CWE-427 |
2026-06-11 |
|
|
7.2 |
OpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.request |
CWE-863 |
2026-04-10 |
|
|
7.2 |
OpenClaw: Workspace-derived service PATH could influence trash command selection |
CWE-426 |
2026-06-16 |
|
|
7.1 |
OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints |
CWE-352 |
2026-02-19 |
|
|
7.1 |
OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters |
CWE-22 |
2026-03-31 |
|
|
7.1 |
OpenClaw < 2026.3.31 - Path Traversal via Inbound Channel Attachment Path in ACP Dispatch |
CWE-22 |
2026-04-27 |
|
|
7.1 |
OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass |
CWE-312 |
2026-04-28 |
|
|
7.1 |
OpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host Execution |
CWE-668 |
2026-04-27 |
|
|
7.1 |
OpenClaw 2026.4.5 < 2026.4.10 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint |
CWE-862 |
2026-05-05 |
|
|
7.1 |
OpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write Scope |
CWE-22 |
2026-06-12 |
|
|
7.1 |
OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions |
CWE-862 |
2026-06-11 |
|
|
7 |
OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper |
CWE-807 |
2026-04-28 |
|
|
7 |
OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File |
CWE-15 |
2026-05-05 |
|
|
7 |
OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution |
CWE-426 |
2026-06-16 |
|
|
7 |
OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install |
CWE-426 |
2026-06-16 |
|
|
7 |
OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots |
CWE-426 |
2026-06-16 |
|
|
6.9 |
OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths |
CWE-22 |
2026-03-18 |
|
|
6.9 |
OpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script Generation |
CWE-78 |
2026-03-19 |
|
|
6.9 |
OpenClaw Telegram allowlist authorization accepted mutable usernames |
CWE-290 |
2026-03-05 |
|
|
6.9 |
OpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generation |
CWE-78 |
2026-03-19 |
|
|
6.9 |
OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash Commands |
CWE-863 |
2026-03-29 |
|
|
6.9 |
OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation |
CWE-307 |
2026-03-31 |
|
|
6.9 |
OpenClaw < 2026.2.22 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update |
CWE-61 |
2026-04-09 |
|
|
6.9 |
OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution |
CWE-807 |
2026-04-10 |
|
|
6.9 |
OpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke |
CWE-288 |
2026-04-10 |
|
|
6.9 |
OpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification Notices |
CWE-288 |
2026-04-10 |
|
|
6.9 |
OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization |
CWE-408 |
2026-04-28 |
|
|
6.9 |
OpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP Loopback |
CWE-862 |
2026-06-11 |
|
|
6.8 |
OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation Commands |
CWE-22 |
2026-03-05 |
|
|
6.8 |
OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding |
CWE-770 |
2026-03-05 |
|
|
6.8 |
OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command |
CWE-862 |
2026-06-16 |
|
|
6.7 |
OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR) |
CWE-770 |
2026-03-05 |
|
|
6.5 |
OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities |
CWE-284, CWE-863 |
2026-02-19 |
|
|
6.3 |
OpenClaw < 2026.2.22 - Authorization Bypass via Display Name Collision in Feishu allowFrom |
CWE-863 |
2026-03-19 |
|
|
6.3 |
OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication |
CWE-307 |
2026-03-31 |
|
|
6.3 |
OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting |
CWE-307 |
2026-04-09 |
|
|
6.3 |
OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys |
CWE-706 |
2026-04-23 |
|
|
6.3 |
OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcement |
CWE-799 |
2026-04-23 |
|
|
6.3 |
OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification |
CWE-807 |
2026-04-28 |
|
|
6.3 |
OpenClaw < 2026.4.20 - Improper Trust Labeling in Isolated Cron Awareness Events |
CWE-345 |
2026-05-11 |
|
|
6.3 |
OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint |
CWE-862 |
2026-05-11 |
|
|
6.3 |
OpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template Mapping |
CWE-863 |
2026-05-11 |
|
|
6.3 |
OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass |
CWE-862 |
2026-06-16 |
|
|
6.1 |
OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession |
CWE-648 |
2026-04-09 |
|
|
6.1 |
OpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths |
CWE-22 |
2026-04-28 |
|
|
6 |
OpenClaw < 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution in system.run |
CWE-78 |
2026-03-19 |
|
|
6 |
OpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image |
CWE-22 |
2026-04-28 |
|
|
6 |
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin |
CWE-522 |
2026-06-16 |
|
|
6 |
OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search |
CWE-862 |
2026-06-16 |
|
|
6 |
OpenClaw < 2026.5.2 - Credential Exposure via Model-Supplied Loopback URLs in message.action Forwarding |
CWE-918 |
2026-06-12 |
|
|
6 |
OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy |
CWE-639 |
2026-06-16 |
|
|
6 |
OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency |
CWE-1023, CWE-918 |
2026-06-16 |
|
|
6 |
OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state |
CWE-863 |
2026-06-16 |
|
|
5.9 |
OpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpoints |
CWE-319 |
2026-04-20 |
|
|
5.8 |
OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection |
CWE-79 |
2026-02-19 |
|
|
5.8 |
OpenClaw < 2026.2.22 - Allowlist Bypass via sort --compress-program Parameter |
CWE-78 |
2026-03-19 |
|
|
5.8 |
OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command |
CWE-863 |
2026-03-23 |
|
|
5.8 |
OpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download |
CWE-367 |
2026-03-29 |
|
|
5.8 |
OpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution Policy |
CWE-427 |
2026-04-28 |
|
|
5.7 |
OpenClaw: Config recovery could restore openclaw.json with broad file permissions |
CWE-732 |
2026-06-16 |
|
|
5.4 |
OpenClaw < 2026.3.31 - Exec Allowlist Bypass via Shell Init-File Options |
CWE-184 |
2026-04-28 |
|
|
5.3 |
OpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata |
CWE-807 |
2026-03-21 |
|
|
5.3 |
OpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commands |
CWE-862 |
2026-04-10 |
|
|
5.3 |
OpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpoint |
CWE-862 |
2026-04-20 |
|
|
5.3 |
OpenClaw < 2026.4.8 - Improper Base64 Decoding Size Validation |
CWE-770 |
2026-04-28 |
|
|
5.3 |
OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope |
CWE-266 |
2026-06-16 |
|
|
5.3 |
OpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOS |
CWE-184 |
2026-06-16 |
|
|
4.9 |
OpenClaw < 2026.4.14 - Internal Page Content Exposure via Browser Snapshot and Screenshot Routes |
CWE-862 |
2026-05-05 |
|
|
4.9 |
OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes |
CWE-862, CWE-918 |
2026-05-05 |
|
|
4.9 |
OpenClaw's browser act interactions could bypass private-network navigation checks |
CWE-918 |
2026-06-11 |
|
|
4.8 |
OpenClaw < 2026.2.21 - OS-level Sandbox Bypass via --no-sandbox Flag |
CWE-1188 |
2026-03-21 |
|
|
4.8 |
OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy |
CWE-863 |
2026-06-11 |
|
|
3.7 |
OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions |
CWE-74, CWE-94 |
2026-02-19 |
|
|
2.3 |
OpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guard |
CWE-918 |
2026-03-19 |
|
|
2.3 |
OpenClaw 2026.2.19 < 2026.3.31 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication |
CWE-668 |
2026-04-27 |
|
|
2.3 |
OpenClaw < 2026.3.31 - Discord Voice Ingress Authorization Bypass via Channel and Role Validation Gaps |
CWE-862 |
2026-04-28 |
|
|
2.3 |
OpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_get |
CWE-183 |
2026-05-06 |
|
|
2.3 |
OpenClaw < 2026.4.22 - Security Envelope Constraint Bypass in ACP Child Sessions |
CWE-266 |
2026-05-11 |
|
|
2.3 |
OpenClaw: Skill-command dispatch could skip before-tool-call hooks |
CWE-693 |
2026-06-16 |
|
|
2.3 |
OpenClaw < 2026.5.26 - Exec Allowlist Bypass via Transparent Command Wrappers |
CWE-184 |
2026-06-16 |
|
|
2.3 |
OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing |
CWE-636 |
2026-06-16 |
|
|
2.3 |
OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening |
CWE-266, CWE-345 |
2026-06-16 |
|
|
2.3 |
OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers |
CWE-807, CWE-863 |
2026-06-16 |
|
|
2.1 |
OpenClaw: Exported session HTML could keep unsafe markdown links |
CWE-83 |
2026-06-16 |
|
|
2 |
OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist |
CWE-863 |
2026-03-19 |
|
|
2 |
OpenClaw < 2026.3.11 - Credential Fallback Logic Bypass via Unavailable Local Auth SecretRefs |
CWE-636 |
2026-03-31 |