Filtered by vendor Openclaw
Subscribe
Total
577 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-53850 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 5.5 MEDIUM |
| OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended caller authority, potentially enabling unauthorized operations depending on gateway configuration and input trust levels. | |||||
| CVE-2026-62202 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 8.8 HIGH |
| OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in the affected cron feature. | |||||
| CVE-2026-62191 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 7.1 HIGH |
| OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable. | |||||
| CVE-2026-62215 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 8.0 HIGH |
| OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks. | |||||
| CVE-2026-62205 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 7.1 HIGH |
| OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. The issue is fixed in 2026.6.6. | |||||
| CVE-2026-62200 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 8.8 HIGH |
| OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. | |||||
| CVE-2026-62201 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 7.7 HIGH |
| OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that should have been restricted by configured policies. | |||||
| CVE-2026-62229 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 8.8 HIGH |
| OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended authorization. Attackers can craft input paths that traverse the allowlist glob patterns to execute or persist unauthorized actions when the affected feature is enabled. | |||||
| CVE-2026-62195 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 8.3 HIGH |
| OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions. | |||||
| CVE-2026-62219 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 7.1 HIGH |
| OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or policy checks. | |||||
| CVE-2026-62228 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 8.8 HIGH |
| OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node environments. Attackers can exploit mismatched environment configurations to persist or execute actions that exceed the caller's approved permissions. | |||||
| CVE-2026-62212 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 7.1 HIGH |
| OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. | |||||
| CVE-2026-62225 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 5.4 MEDIUM |
| OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform unauthorized actions when the affected feature is enabled and reachable. | |||||
| CVE-2026-62192 | 1 Openclaw | 1 Openclaw | 2026-10-23 | N/A | 8.1 HIGH |
| OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip cross-provider requester authorization and execute restricted operations. | |||||
| CVE-2026-62220 | 1 Openclaw | 1 Openclaw | 2026-10-23 | N/A | 5.3 MEDIUM |
| OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability. | |||||
| CVE-2026-62217 | 1 Openclaw | 1 Openclaw | 2026-10-23 | N/A | 8.8 HIGH |
| OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing non-allowlisted senders to perform unauthorized operations. | |||||
| CVE-2026-62206 | 1 Openclaw | 1 Openclaw | 2026-10-23 | N/A | 7.1 HIGH |
| OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path. | |||||
| CVE-2026-62186 | 1 Openclaw | 1 Openclaw | 2026-10-23 | N/A | 7.6 HIGH |
| OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization policies and execute restricted operations. | |||||
| CVE-2026-62223 | 1 Openclaw | 1 Openclaw | 2026-10-23 | N/A | 8.8 HIGH |
| OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured input paths to execute or persist unauthorized actions when the affected feature is enabled and reachable. | |||||
| CVE-2026-62199 | 1 Openclaw | 1 Openclaw | 2026-10-23 | N/A | 8.8 HIGH |
| OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions beyond the caller's intended authorization. | |||||