Total
575 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-53829 | 1 Openclaw | 1 Openclaw | 2026-07-23 | N/A | 8.0 HIGH |
| OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes to execute unauthorized operations after approval. | |||||
| CVE-2026-53825 | 1 Openclaw | 1 Openclaw | 2026-07-23 | N/A | 6.5 MEDIUM |
| OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers with operator.write access can specify arbitrary local file paths to import file content into wiki memory, bypassing access restrictions. | |||||
| CVE-2026-53824 | 1 Openclaw | 1 Openclaw | 2026-07-23 | N/A | 6.5 MEDIUM |
| OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash command behavior briefly after token revocation, potentially executing unauthorized actions depending on operator configuration. | |||||
| CVE-2026-53827 | 1 Openclaw | 1 Openclaw | 2026-07-23 | N/A | 6.5 MEDIUM |
| OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata to forward action payloads with Gateway credentials to attacker-supplied loopback URLs. Remote attackers can intercept Gateway tokens and action payloads by providing malicious loopback targets through model-controlled action metadata. | |||||
| CVE-2026-62209 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 8.1 HIGH |
| OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. | |||||
| CVE-2026-62218 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 8.8 HIGH |
| OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management checks. Attackers can perform actions requiring stronger authorization by reaching the affected feature through configured input paths. | |||||
| CVE-2026-35674 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 8.8 HIGH |
| OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited external routes to bypass operator.approvals and operator.admin scope requirements, enabling unauthorized plugin, config, MCP, allowlist, and ACP mutations. | |||||
| CVE-2026-34507 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 5.4 MEDIUM |
| OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated senders to skip DM-only and allowFrom policy checks. Attackers can route admin commands from unauthorized senders or contexts to execute restricted behavior that policy should have blocked. | |||||
| CVE-2026-35673 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 6.5 MEDIUM |
| OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers with access to these routes can bypass private-network SSRF policies by reusing blocked tabs to export or inspect content that should remain protected. | |||||
| CVE-2026-32905 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 8.3 HIGH |
| OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers with chat command access can create setup codes to enroll devices with operator/node capabilities, granting persistent credentials until manual removal. | |||||
| CVE-2026-35630 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 8.0 HIGH |
| OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization. | |||||
| CVE-2026-32906 | 1 Openclaw | 1 Openclaw | 2026-07-21 | N/A | 4.3 MEDIUM |
| OpenClaw before 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals that allows exec-authorized users to resolve plugin approvals through the exec approver gate. Attackers with limited exec approval permissions can bypass intended approval splits to approve plugin actions outside operator configuration. | |||||
| CVE-2026-53834 | 1 Openclaw | 1 Openclaw | 2026-07-20 | N/A | 7.5 HIGH |
| OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured access control policies are applied, potentially triggering command handling from blocked senders depending on operator configuration. | |||||
| CVE-2026-62208 | 1 Openclaw | 1 Openclaw | 2026-07-20 | N/A | 6.5 MEDIUM |
| OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's configuration and whether lower-trust input can reach the affected path. | |||||
| CVE-2026-62193 | 1 Openclaw | 1 Openclaw | 2026-07-15 | N/A | 4.9 MEDIUM |
| OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's configuration and whether lower-trust input can reach the affected path. The issue is fixed in 2026.6.9. | |||||
| CVE-2026-62194 | 1 Openclaw | 1 Openclaw | 2026-07-15 | N/A | 8.8 HIGH |
| OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable. | |||||
| CVE-2026-62197 | 1 Openclaw | 1 Openclaw | 2026-07-14 | N/A | 8.5 HIGH |
| OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled. | |||||
| CVE-2026-53864 | 1 Openclaw | 1 Openclaw | 2026-06-18 | N/A | 8.1 HIGH |
| OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables to influence child processes or coverage output paths. | |||||
| CVE-2026-53858 | 1 Openclaw | 1 Openclaw | 2026-06-18 | N/A | 7.1 HIGH |
| OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution. | |||||
| CVE-2026-53856 | 1 Openclaw | 1 Openclaw | 2026-06-18 | N/A | 5.5 MEDIUM |
| OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by exploiting the recovery path to access the restored config file. | |||||