Filtered by vendor Openclaw
Subscribe
Total
577 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-62213 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 6.5 MEDIUM |
| OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary. | |||||
| CVE-2026-53834 | 1 Openclaw | 1 Openclaw | 2026-07-20 | N/A | 7.5 HIGH |
| OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured access control policies are applied, potentially triggering command handling from blocked senders depending on operator configuration. | |||||
| CVE-2026-62201 | 1 Openclaw | 1 Openclaw | 2026-07-20 | N/A | 7.7 HIGH |
| OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that should have been restricted by configured policies. | |||||
| CVE-2026-62206 | 1 Openclaw | 1 Openclaw | 2026-07-20 | N/A | 7.1 HIGH |
| OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path. | |||||
| CVE-2026-62208 | 1 Openclaw | 1 Openclaw | 2026-07-20 | N/A | 6.5 MEDIUM |
| OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's configuration and whether lower-trust input can reach the affected path. | |||||
| CVE-2026-62212 | 1 Openclaw | 1 Openclaw | 2026-07-20 | N/A | 7.1 HIGH |
| OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. | |||||
| CVE-2026-62214 | 1 Openclaw | 1 Openclaw | 2026-07-20 | N/A | 6.5 MEDIUM |
| OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured input paths to retrieve sensitive authentication data outside the trusted boundary. | |||||
| CVE-2026-62215 | 1 Openclaw | 1 Openclaw | 2026-07-20 | N/A | 8.0 HIGH |
| OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks. | |||||
| CVE-2026-62223 | 1 Openclaw | 1 Openclaw | 2026-07-20 | N/A | 8.8 HIGH |
| OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured input paths to execute or persist unauthorized actions when the affected feature is enabled and reachable. | |||||
| CVE-2026-62193 | 1 Openclaw | 1 Openclaw | 2026-07-15 | N/A | 4.9 MEDIUM |
| OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's configuration and whether lower-trust input can reach the affected path. The issue is fixed in 2026.6.9. | |||||
| CVE-2026-62199 | 1 Openclaw | 1 Openclaw | 2026-07-15 | N/A | 8.8 HIGH |
| OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions beyond the caller's intended authorization. | |||||
| CVE-2026-62190 | 1 Openclaw | 1 Openclaw | 2026-07-15 | N/A | 8.8 HIGH |
| OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled. | |||||
| CVE-2026-62187 | 1 Openclaw | 1 Openclaw\/feishu | 2026-07-15 | N/A | 8.1 HIGH |
| OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue is fixed in version 2026.6.9. Impact depends on the operator's configuration and whether lower-trust input can reach the affected feature. | |||||
| CVE-2026-62200 | 1 Openclaw | 1 Openclaw | 2026-07-15 | N/A | 8.8 HIGH |
| OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. | |||||
| CVE-2026-62195 | 1 Openclaw | 1 Openclaw | 2026-07-15 | N/A | 8.3 HIGH |
| OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions. | |||||
| CVE-2026-62194 | 1 Openclaw | 1 Openclaw | 2026-07-15 | N/A | 8.8 HIGH |
| OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable. | |||||
| CVE-2026-62189 | 1 Openclaw | 1 Openclaw | 2026-07-15 | N/A | 7.1 HIGH |
| OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable. | |||||
| CVE-2026-62188 | 1 Openclaw | 1 Openclaw\/feishu | 2026-07-15 | N/A | 8.1 HIGH |
| OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. The issue is fixed in version 2026.6.9. | |||||
| CVE-2026-62186 | 1 Openclaw | 1 Openclaw | 2026-07-14 | N/A | 7.6 HIGH |
| OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization policies and execute restricted operations. | |||||
| CVE-2026-62191 | 1 Openclaw | 1 Openclaw | 2026-07-14 | N/A | 7.1 HIGH |
| OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable. | |||||