[ Vendor · 89 CVEs ]
OpenClaw
CVEs affecting OpenClaw published in the last 30 days, plus any OpenClaw CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110689 | 14 Oct 2026 | CVSS 5.3 | OpenClaw ClawScanA security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file… | |
| CVE-2026-101883 | 30 Sep 2026 | CVSS 5.4 | OpenClaw Windows NodeOpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk… | |
| CVE-2026-101884 | 30 Sep 2026 | CVSS 7.5 | OpenClaw Windows NodeOpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*… | |
| CVE-2026-101881 | 30 Sep 2026 | CVSS 6.5 | OpenClaw Windows NodeOpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows… | |
| CVE-2026-101882 | 30 Sep 2026 | CVSS 8.8 | OpenClaw Windows NodeOpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable… | |
| CVE-2026-101879 | 30 Sep 2026 | CVSS 6.5 | OpenClaw Windows NodeOpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways… | |
| CVE-2026-101880 | 30 Sep 2026 | CVSS 8.8 | OpenClaw Windows NodeOpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where… | |
| CVE-2026-102806 | 29 Sep 2026 | CVSS 6.3 | OpenClawOpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem… | |
| CVE-2026-102807 | 29 Sep 2026 | CVSS 5.3 | OpenClawOpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to execute… | |
| CVE-2026-100601 | 26 Sep 2026 | CVSS 5.3 | openclaw clawhubClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching… | |
| CVE-2026-100602 | 26 Sep 2026 | CVSS 6.5 | openclaw clawhubClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke… | |
| CVE-2026-100603 | 26 Sep 2026 | CVSS 5.4 | openclaw clawhubClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can… | |
| CVE-2026-100604 | 26 Sep 2026 | CVSS 5.4 | openclaw clawhubClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains… | |
| CVE-2026-100600 | 26 Sep 2026 | CVSS 5.3 | openclaw clawhubClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous… | |
| CVE-2026-100595 | 26 Sep 2026 | CVSS 6.5 | OpenClawOpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel… | |
| CVE-2026-100596 | 26 Sep 2026 | CVSS 8.8 | OpenClawOpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset… | |
| CVE-2026-100597 | 26 Sep 2026 | CVSS 7.8 | OpenClawOpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem… | |
| CVE-2026-100598 | 26 Sep 2026 | CVSS 7.1 | OpenClawOpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a… | |
| CVE-2026-100599 | 26 Sep 2026 | CVSS 8.8 | OpenClawOpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome… | |
| CVE-2026-100589 | 26 Sep 2026 | CVSS 8.3 | OpenClawOpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node… | |
| CVE-2026-100590 | 26 Sep 2026 | CVSS 4.3 | OpenClawOpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel senders to… | |
| CVE-2026-100591 | 26 Sep 2026 | CVSS 6.3 | OpenClawOpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An… | |
| CVE-2026-100592 | 26 Sep 2026 | CVSS 6.3 | OpenClawOpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission… | |
| CVE-2026-100593 | 26 Sep 2026 | CVSS 5.4 | OpenClawOpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes… | |
| CVE-2026-100594 | 26 Sep 2026 | CVSS 6.5 | OpenClawOpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to… | |
| CVE-2026-100582 | 26 Sep 2026 | CVSS 6.5 | openclaw msteamsOpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the… | |
| CVE-2026-100583 | 26 Sep 2026 | CVSS 4.3 | openclaw discordOpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust… | |
| CVE-2026-100584 | 26 Sep 2026 | CVSS 6.7 | OpenClawOpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec… | |
| CVE-2026-100585 | 26 Sep 2026 | CVSS 8.0 | OpenClawOpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts… | |
| CVE-2026-100586 | 26 Sep 2026 | CVSS 8.8 | OpenClawOpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native conversation bindings. Non-owner channel senders… | |
| CVE-2026-100587 | 26 Sep 2026 | CVSS 8.8 | OpenClawOpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel… | |
| CVE-2026-100588 | 26 Sep 2026 | CVSS 8.3 | OpenClawOpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through… | |
| CVE-2026-100575 | 26 Sep 2026 | CVSS 8.8 | openclaw slackOpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can… | |
| CVE-2026-100576 | 26 Sep 2026 | CVSS 5.4 | OpenClawOpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF… | |
| CVE-2026-100577 | 26 Sep 2026 | CVSS 6.3 | OpenClawOpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A… | |
| CVE-2026-100578 | 26 Sep 2026 | CVSS 7.6 | OpenClawOpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In… | |
| CVE-2026-100579 | 26 Sep 2026 | CVSS 7.6 | OpenClawOpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments… | |
| CVE-2026-100580 | 26 Sep 2026 | CVSS 8.8 | OpenClawOpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can… | |
| CVE-2026-100581 | 26 Sep 2026 | CVSS 5.5 | OpenClawOpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers… | |
| CVE-2026-100569 | 26 Sep 2026 | CVSS 5.5 | OpenClawOpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block… | |
| CVE-2026-100570 | 26 Sep 2026 | CVSS 7.8 | OpenClawOpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS… | |
| CVE-2026-100571 | 26 Sep 2026 | CVSS 5.3 | OpenClawOpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature… | |
| CVE-2026-100572 | 26 Sep 2026 | CVSS 5.3 | OpenClawOpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on… | |
| CVE-2026-100573 | 26 Sep 2026 | CVSS 3.3 | OpenClawOpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent… | |
| CVE-2026-100574 | 26 Sep 2026 | CVSS 5.9 | OpenClawOpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches… | |
| CVE-2026-100562 | 26 Sep 2026 | CVSS 5.4 | OpenClawOpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to… | |
| CVE-2026-100563 | 26 Sep 2026 | CVSS 5.4 | OpenClawOpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the… | |
| CVE-2026-100564 | 26 Sep 2026 | CVSS 5.4 | OpenClawOpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports… | |
| CVE-2026-100566 | 26 Sep 2026 | CVSS 6.5 | openclaw lineOpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when… | |
| CVE-2026-100567 | 26 Sep 2026 | CVSS 8.2 | OpenClawOpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS… | |
| CVE-2026-100568 | 26 Sep 2026 | CVSS 8.3 | OpenClawOpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and… | |
| CVE-2026-100555 | 26 Sep 2026 | CVSS 7.1 | OpenClawOpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning… | |
| CVE-2026-100556 | 26 Sep 2026 | CVSS 6.3 | OpenClawOpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A… | |
| CVE-2026-100557 | 26 Sep 2026 | CVSS 8.3 | OpenClawOpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status… | |
| CVE-2026-100558 | 26 Sep 2026 | CVSS 7.5 | OpenClawOpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain… | |
| CVE-2026-100559 | 26 Sep 2026 | CVSS 8.0 | OpenClawOpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden… | |
| CVE-2026-100560 | 26 Sep 2026 | CVSS 7.5 | OpenClawOpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only… | |
| CVE-2026-100561 | 26 Sep 2026 | CVSS 8.0 | OpenClawOpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could… | |
| CVE-2026-100548 | 26 Sep 2026 | CVSS 5.3 | OpenClawOpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote… | |
| CVE-2026-100549 | 26 Sep 2026 | CVSS 5.4 | OpenClawOpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice… | |
| CVE-2026-100550 | 26 Sep 2026 | CVSS 5.4 | OpenClawOpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to… | |
| CVE-2026-100551 | 26 Sep 2026 | CVSS 8.3 | OpenClawOpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the… | |
| CVE-2026-100552 | 26 Sep 2026 | CVSS 8.8 | OpenClawOpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A… | |
| CVE-2026-100553 | 26 Sep 2026 | CVSS 4.3 | OpenClawOpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin… | |
| CVE-2026-100554 | 26 Sep 2026 | CVSS 4.2 | OpenClawOpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is… | |
| CVE-2026-100542 | 26 Sep 2026 | CVSS 3.1 | OpenClawOpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded… | |
| CVE-2026-100543 | 26 Sep 2026 | CVSS 7.5 | OpenClawOpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted… | |
| CVE-2026-100544 | 26 Sep 2026 | CVSS 8.8 | openclaw voice-callopenclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the… | |
| CVE-2026-100545 | 26 Sep 2026 | CVSS 5.3 | OpenClawOpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected… | |
| CVE-2026-100546 | 26 Sep 2026 | CVSS 6.4 | OpenClawOpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path… | |
| CVE-2026-100547 | 26 Sep 2026 | CVSS 5.5 | OpenClawOpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:`… | |
| CVE-2026-100535 | 26 Sep 2026 | CVSS 7.5 | OpenClawOpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when… | |
| CVE-2026-100536 | 26 Sep 2026 | CVSS 6.5 | OpenClawOpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host… | |
| CVE-2026-100537 | 26 Sep 2026 | CVSS 3.1 | OpenClawOpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic… | |
| CVE-2026-100538 | 26 Sep 2026 | CVSS 6.5 | OpenClawOpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling… | |
| CVE-2026-100539 | 26 Sep 2026 | CVSS 2.6 | OpenClawOpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing… | |
| CVE-2026-100540 | 26 Sep 2026 | CVSS 6.8 | openclaw feishuOpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations… | |
| CVE-2026-100541 | 26 Sep 2026 | CVSS 7.5 | openclaw matrixOpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including… | |
| CVE-2026-100528 | 26 Sep 2026 | CVSS 5.4 | OpenClawOpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a… | |
| CVE-2026-100529 | 26 Sep 2026 | CVSS 6.4 | OpenClawOpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers… | |
| CVE-2026-100530 | 26 Sep 2026 | CVSS 7.3 | OpenClawOpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in… | |
| CVE-2026-100531 | 26 Sep 2026 | CVSS 6.5 | openclaw slackThe @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share… | |
| CVE-2026-100532 | 26 Sep 2026 | CVSS 8.1 | openclaw whatsapp@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating… | |
| CVE-2026-100533 | 26 Sep 2026 | CVSS 5.3 | OpenClawOpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can… | |
| CVE-2026-100534 | 26 Sep 2026 | CVSS 3.1 | OpenClawOpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel… | |
| CVE-2026-100525 | 26 Sep 2026 | CVSS 4.3 | openclaw diagnostics-prometheusThe OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read scope on its… | |
| CVE-2026-100526 | 26 Sep 2026 | CVSS 5.3 | openclaw discordOpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped media policy in the emoji and… | |
| CVE-2026-100527 | 26 Sep 2026 | CVSS 5.3 | OpenClawOpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to… | |
| CVE-2026-62197 | 13 Jul 2026 | CVSS 8.5 | OpenClaw: Browser CDP discovery could accept blocked WebSocket URLsOpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with… | Fix |