Search for packages
| purl | pkg:npm/openclaw@2026.2.17 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-24vr-rprv-67rf
Aliases: CVE-2026-53846 |
OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install ### Summary Workspace .env npm_execpath could influence bundled runtime dependency … |
Vulnerable |
|
GHSA-hcm3-8f6r-6xwg
|
OpenClaw: Browser debug/export routes could reuse already-open blocked tabs ### Summary Browser debug/export routes could reuse already-open blocked tabs. In … |
Vulnerable |
|
GHSA-r27j-fxmq-rg2q
|
Duplicate Advisory: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-w4v6-g3wm-w36c
|
OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy ### Summary QQBot admin commands could skip DM-only and allowFrom … |
Vulnerable |
|
CVE-2026-53844
Aliases: GHSA-72fw-cqh5-f324 |
OpenClaw: memory-wiki shared search could miss session visibility checks memory-wiki shared search could miss session visibility checks. In affected versions, … |
Vulnerable |
|
GHSA-jvm4-4j77-39p6
Aliases: CVE-2026-53833 |
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom QQBot streaming command could mutate config without explicit allowFrom. In … |
Vulnerable Vulnerable |
|
GHSA-25gx-x37c-7pph
Aliases: CVE-2026-32064 |
OpenClaw's andbox browser noVNC observer lacked VNC authentication The sandbox browser entrypoint launched `x11vnc` without authentication (`-nopw`) for noVNC observer … |
Vulnerable |
|
GHSA-3xfw-4pmr-4xc5
Aliases: CVE-2026-32022 |
OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass) ### Summary OpenClaw `tools.exec.safeBins` had a stdin-only policy bypass for … |
Vulnerable |
|
GHSA-43x4-g22p-3hrq
Aliases: CVE-2026-32046 |
OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container ## Summary Sandbox browser container launched Chromium with `--no-sandbox` … |
Vulnerable |
|
GHSA-45cg-2683-gfmq
Aliases: CVE-2026-32008 |
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files ## Impact `assertBrowserNavigationAllowed()` … |
Vulnerable |
|
GHSA-5mx2-2mgw-x8rm
Aliases: CVE-2026-32896 |
OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback) ### Summary BlueBubbles webhook auth in the optional beta iMessage … |
Vulnerable |
|
GHSA-5v6x-rfc3-7qfr
Aliases: CVE-2026-22168 |
OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments ### Summary A Windows `system.run` approval-integrity mismatch in the … |
Vulnerable |
|
GHSA-62f6-mrcj-v8h5
Aliases: CVE-2026-27524 |
OpenClaw's runtime /debug override path accepted prototype-reserved keys ### Summary OpenClaw accepted prototype-reserved keys in runtime `/debug set` override object … |
Vulnerable |
|
GHSA-82g8-464f-2mv7
Aliases: CVE-2026-4039 |
OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth) ### Summary `applySkillConfigEnvOverrides` previously copied `skills.entries.*.env` values into the host … |
Vulnerable |
|
GHSA-8fmp-37rc-p5g7
Aliases: CVE-2026-22177 |
OpenClaw's config env vars allowed startup env injection into service runtime ### Summary OpenClaw allowed dangerous process-control environment variables from … |
Vulnerable |
|
GHSA-cjv3-m589-v3rx
|
OpenClaw has Canvas route hardening for mixed-trust deployments ## Summary This advisory tracks a defense-in-depth hardening for canvas routes. In … |
Vulnerable |
|
GHSA-hff7-ccv5-52f8
Aliases: CVE-2026-32045 |
OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes ### Summary When tokenless Tailscale auth is enabled, OpenClaw should only … |
Vulnerable |
|
GHSA-jjgj-cpp9-cvpv
|
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection ## Summary A malicious or compromised MCP … |
Vulnerable |
|
GHSA-jq4x-98m3-ggq6
|
ZDI-CAN-29312: OpenClaw Canvas Path Traversal Information Disclosure Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability … |
Vulnerable |
|
GHSA-w7j5-j98m-w679
|
OpenClaw has multiple E2E/test Dockerfiles that run all processes as root Three Dockerfiles in scripts/docker/ and scripts/e2e/ lack a USER … |
Vulnerable |
|
GHSA-w9cg-v44m-4qv8
|
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands ### Summary `BASH_ENV` / `ENV` startup-file injection could … |
Vulnerable |
|
GHSA-wgx8-r9vw-2w4h
|
Duplicate Advisory: OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth) ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
CVE-2026-32029
Aliases: GHSA-2rgf-hm63-5qph |
OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions OpenClaw used left-most `X-Forwarded-For` values when … |
Vulnerable Vulnerable |
|
CVE-2026-32034
Aliases: GHSA-3cvx-236h-m9fj |
OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access In affected releases, when an … |
Vulnerable Vulnerable |
|
CVE-2026-32063
Aliases: GHSA-vffc-f7r7-rx2w |
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux) A command injection vulnerability exists in … |
Vulnerable Vulnerable |
|
GHSA-25pw-4h6w-qwvm
Aliases: CVE-2026-32006 |
OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallback ### Summary In `openclaw@2026.2.25`, BlueBubbles group authorization could incorrectly … |
Vulnerable |
|
GHSA-7qf6-h84j-8fq4
|
OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model ## Impact Microsoft Teams media handling used mixed fetch … |
Vulnerable |
|
GHSA-8j2w-6fmm-m587
Aliases: CVE-2026-32031 |
OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch ### Summary Gateway auth for plugin channel endpoints can be bypassed … |
Vulnerable |
|
GHSA-f7ww-2725-qvw2
Aliases: CVE-2026-27545 |
OpenClaw: Node system.run approval bypass via parent-symlink cwd rebind ## Summary For `host=node` executions, approval context could be bypassed after … |
Vulnerable |
|
GHSA-gcj7-r3hg-m7w6
|
OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity ### Summary The voice-call Twilio webhook path accepted replay/dedupe … |
Vulnerable |
|
GHSA-gp3q-wpq4-5c5h
|
OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries ### Summary In specific LINE configurations, sender IDs approved through … |
Vulnerable |
|
GHSA-hjvp-qhm6-wrh2
Aliases: CVE-2026-32058 |
OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows ### Summary In approval-enabled `host=node` workflows, `system.run` approvals did not … |
Vulnerable |
|
GHSA-jv6r-27ww-4gw4
Aliases: CVE-2026-32027 |
OpenClaw DM pairing-store identities could satisfy group allowlist authorization ## Summary DM pairing-store identities were incorrectly eligible for group allowlist … |
Vulnerable |
|
GHSA-mgrq-9f93-wpp5
Aliases: CVE-2026-32055 |
OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf ### Summary `openclaw` had a workspace boundary bypass in workspace-only … |
Vulnerable |
|
GHSA-mwxv-35wr-4vvj
Aliases: CVE-2026-32036 |
OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths ### Summary Gateway plugin route auth … |
Vulnerable |
|
GHSA-qcc4-p59m-p54m
|
OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary ### Summary A sandbox boundary-validation gap in symlink alias handling … |
Vulnerable |
|
GHSA-r65x-2hqr-j5hf
Aliases: CVE-2026-32014 |
OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy ## Summary A paired node device could reconnect with … |
Vulnerable |
|
GHSA-v8cg-4474-49v8
Aliases: CVE-2026-32895 |
OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers ### Summary Slack `member_*` and `message` subtype … |
Vulnerable |
|
GHSA-vjp8-wprm-2jw9
Aliases: CVE-2026-32067 |
OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access ### Summary OpenClaw had account-scope gaps in pairing-store … |
Vulnerable |
|
GHSA-wm8r-w8pf-2v6w
Aliases: CVE-2026-31991 |
OpenClaw has Signal group allowlist authorization bypass via DM pairing-store leakage ### Summary In OpenClaw `2026.2.25`, Signal group authorization under … |
Vulnerable |
|
GHSA-25wv-8phj-8p7r
Aliases: CVE-2026-41913 |
OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths ## Impact Concurrent async auth … | There are no reported fixed by versions. |
|
GHSA-275c-xpvc-jgfw
Aliases: CVE-2026-53830 |
OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload ### Summary Slack and Zalo webhook secrets could remain … |
Vulnerable Vulnerable |
|
GHSA-2hh7-c75g-qj2r
Aliases: CVE-2026-44116 |
OpenClaw validates Zalo outbound photo URLs through the SSRF guard ## Summary Zalo outbound photo URLs are validated through the … |
Vulnerable |
|
GHSA-55cf-xx38-4p9p
Aliases: CVE-2026-45003 |
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts ## Summary Workspace dotenv files cannot override connector endpoint hosts. ## … |
Vulnerable |
|
GHSA-5h3g-6xhh-rg6p
Aliases: CVE-2026-44113 |
OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes ## Summary OpenShell FS bridge reads … |
Vulnerable |
|
GHSA-93rg-2xm5-2p9v
|
OpenClaw's Gateway Control UI bootstrap config required Gateway auth ## Summary Gateway Control UI bootstrap config required Gateway auth. ## … |
Vulnerable |
|
GHSA-q3jj-46pq-826r
Aliases: CVE-2026-44997 |
OpenClaw's ACP child sessions inherit subagent security envelope constraints ## Summary ACP child sessions inherit subagent security envelope constraints. ## … |
Vulnerable |
|
GHSA-r6xh-pqhr-v4xh
Aliases: CVE-2026-44118 |
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens ## Summary MCP loopback owner context is derived from … |
Vulnerable |
|
GHSA-wppj-c6mr-83jj
Aliases: CVE-2026-44112 |
OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root ## Summary OpenShell FS bridge writes stay pinned … |
Vulnerable |
|
GHSA-x3h8-jrgh-p8jx
|
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs ## Summary Exec allowlist analysis rejects shell expansion in unquoted … |
Vulnerable |
|
GHSA-2767-2q9v-9326
Aliases: CVE-2026-43526 |
OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes ## Summary QQBot reply media URL handling … |
Vulnerable |
|
GHSA-49cg-279w-m73x
Aliases: CVE-2026-43574 |
OpenClaw: Empty approver lists could grant explicit approval authorization ## Summary Empty approver lists could grant explicit approval authorization. ## … |
Vulnerable |
|
GHSA-27cr-4p5m-74rj
Aliases: CVE-2026-32033 |
OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths A workspace-only file-system guard mismatch allowed `@`-prefixed absolute paths … |
Vulnerable |
|
GHSA-33hm-cq8r-wc49
Aliases: CVE-2026-32026 |
Temporary path handling could write outside OpenClaw temp boundary ### Summary Sandbox media local-path validation accepted absolute paths under host … |
Vulnerable |
|
GHSA-534w-2vm4-89xr
|
OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch A missing group-sender authorization check in the Zalo plugin allowed … |
Vulnerable |
|
GHSA-5gj7-jf77-q2q2
Aliases: CVE-2026-32009 |
OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`) ### Summary In `openclaw<=2026.2.23`, safe-bin trust in allowlist mode … |
Vulnerable |
|
GHSA-6rcp-vxwf-3mfp
Aliases: CVE-2026-32052 |
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text ### Summary In `openclaw` up to … |
Vulnerable |
|
GHSA-9f72-qcpw-2hxc
|
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs ### Summary In sandboxed runs, native prompt image … |
Vulnerable |
|
GHSA-ccg8-46r6-9qgj
Aliases: CVE-2026-32023 |
OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode ### Summary A wrapper-depth parsing mismatch in … |
Vulnerable |
|
GHSA-fqcm-97m6-w7rm
Aliases: CVE-2026-27522 |
OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset ## Impact `sendAttachment` and `setGroupIcon` message … |
Vulnerable |
|
GHSA-h656-5vcf-cm23
|
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check ## Impact In Telegram DM mode, inbound … |
Vulnerable |
|
GHSA-m8v2-6wwh-r4gc
Aliases: CVE-2026-27523 |
OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths ### Summary In `openclaw` up to … |
Vulnerable |
|
GHSA-ww6v-v748-x7g9
Aliases: CVE-2026-32038 |
OpenClaw has a sandbox network isolation bypass via docker.network=container:<id> ### Summary In `openclaw@2026.2.23`, sandbox network hardening blocks `network=host` but still … |
Vulnerable |
|
GHSA-2858-xg23-26fp
|
OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots ### Summary OpenClaw accepted `camera.snap` / `camera.clip` node payload … |
Vulnerable Vulnerable |
|
GHSA-2ch6-x3g4-7759
|
OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From ### Summary `commands.allowFrom` is documented as a sender authorization allowlist for … |
Vulnerable |
|
GHSA-2ww6-868g-2c56
Aliases: CVE-2026-32040 |
OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation ## Summary The HTML session exporter (`src/auto-reply/reply/export-html/template.js`) … |
Vulnerable |
|
GHSA-3c6h-g97w-fg78
Aliases: CVE-2026-32059 |
OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode ### Summary In OpenClaw, `tools.exec.safeBins` validation for … |
Vulnerable |
|
GHSA-48wf-g7cp-gr3m
Aliases: CVE-2026-31992 |
OpenClaw has allowlist exec-guard bypass via env -S ### Summary In `allowlist` mode, `system.run` guardrails could be bypassed through `env … |
Vulnerable |
|
GHSA-6x2m-hqfw-hvpj
|
OpenClaw: Node exec approvals could be replayed across nodes ## Summary `exec.approval` requests for `host=node` were not explicitly bound to … |
Vulnerable |
|
GHSA-796m-2973-wc5q
|
OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation ### Summary `tools.exec` allowlist/safe-bins evaluation could diverge from runtime … |
Vulnerable |
|
GHSA-7977-c43c-xpwj
Aliases: CVE-2026-28363 |
OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode In OpenClaw before 2026.2.23, tools.exec.safeBins validation for … |
Vulnerable |
|
GHSA-gwqp-86q6-w47g
Aliases: CVE-2026-22175 |
OpenClaw's exec allow-always can be bypassed via unrecognized multiplexer shell wrappers (busybox/toybox sh -c) ### Summary OpenClaw exec approvals could … |
Vulnerable |
|
GHSA-h9xm-j4qg-fvpg
Aliases: CVE-2026-32007 |
OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default) ### Summary In some opt-in sandbox … |
Vulnerable |
|
GHSA-q6qf-4p5j-r25g
Aliases: CVE-2026-32002 |
OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images ### Summary In OpenClaw, the sandboxed `image` … |
Vulnerable |
|
GHSA-r294-2894-92j3
|
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering ## Summary The exported session HTML viewer allowed … |
Vulnerable |
|
GHSA-vqx8-9xxw-f2m7
Aliases: CVE-2026-32053 |
OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse ## Impact Twilio … |
Vulnerable |
|
CVE-2026-32898
Aliases: GHSA-7jx5-9fjg-hp4m |
OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata The OpenClaw ACP client could auto-approve tool calls based … |
Vulnerable Vulnerable |
|
GHSA-7ff8-xjh3-mgh6
|
OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt In `openclaw` versions up to and including `2026.2.22-2`, a non-default exec-approval … |
Vulnerable Vulnerable |
|
GHSA-2cwr-f5hx-gg3w
|
Duplicate Advisory: OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-2f7j-rp58-mr42
Aliases: CVE-2026-41339 |
OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients ## Summary Before OpenClaw 2026.4.2, the Gateway … |
Vulnerable |
|
GHSA-2qrv-rc5x-2g2h
Aliases: CVE-2026-41295 |
OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup ## Summary Before OpenClaw 2026.4.2, built-in channel setup and … |
Vulnerable |
|
GHSA-4p4f-fc8q-84m3
Aliases: CVE-2026-41398 |
OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch ## Summary Before OpenClaw 2026.4.2, the iOS A2UI bridge … |
Vulnerable |
|
GHSA-5cj2-3jr2-5h77
Aliases: CVE-2026-53855 |
OpenClaw: Shell positional parameters could weaken strict inline-eval checks ### Summary Shell positional parameters could weaken strict inline-eval checks. In … |
Vulnerable |
|
GHSA-5hff-46vh-rxmw
Aliases: CVE-2026-41298 |
OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill ## Summary Before OpenClaw 2026.4.2, `POST /sessions/:sessionKey/kill` did not enforce … |
Vulnerable |
|
GHSA-6477-wvjj-47v6
|
Duplicate Advisory: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-7hrg-5w46-5r2x
|
Duplicate Advisory: OpenClaw: Slack thread context could include messages from non-allowlisted senders ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-83f3-hh45-vfw9
Aliases: CVE-2026-40045 |
OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws:// ## Summary Before OpenClaw 2026.4.2, Android accepted … |
Vulnerable |
|
GHSA-846p-hgpv-vphc
|
OpenClaw: QQ Bot structured payloads could read arbitrary local files ## Summary Before OpenClaw 2026.4.2, QQ Bot structured media payloads … |
Vulnerable |
|
GHSA-98ch-45wp-ch47
|
OpenClaw: Windows-compatible env override keys could bypass system.run approval binding ## Summary Before OpenClaw 2026.4.2, system-run approval binding normalized environment … |
Vulnerable |
|
GHSA-9jpj-g8vv-j5mf
Aliases: CVE-2026-34511 |
OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter ## Summary Before OpenClaw 2026.4.2, the Gemini OAuth … |
Vulnerable |
|
GHSA-ch86-pxr9-j9h9
|
Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-f5fm-9jmp-c88r
|
Duplicate Advisory: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-fh32-73r9-rgh5
Aliases: CVE-2026-41372 |
OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections ## Summary Before OpenClaw 2026.4.2, remote CDP discovery could return … |
Vulnerable |
|
GHSA-fvx6-pj3r-5q4q
Aliases: CVE-2026-34425 |
OpenClaw's complex interpreter pipelines could skip exec script preflight validation ## Summary Before OpenClaw 2026.4.2, exec script preflight validation could … |
Vulnerable |
|
GHSA-jj6q-rrrf-h66h
Aliases: CVE-2026-41407 |
OpenClaw: Shared-secret comparison call sites leaked length information through timing ## Summary Before OpenClaw 2026.4.2, several shared-secret comparison call sites … |
Vulnerable |
|
GHSA-m34q-h93w-vg5x
Aliases: CVE-2026-41383 |
OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped ## Summary Before OpenClaw 2026.4.2, the OpenShell … |
Vulnerable |
|
GHSA-qm77-8qjp-4vcm
Aliases: CVE-2026-41358 |
OpenClaw: Slack thread context could include messages from non-allowlisted senders ## Summary Before OpenClaw 2026.4.2, Slack thread starter and thread-history … |
Vulnerable |
|
GHSA-r7p2-r9g4-4xph
|
Duplicate Advisory: OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-rf75-g96h-j3rm
|
Duplicate Advisory: OpenClaw's complex interpreter pipelines could skip exec script preflight validation ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
CVE-2026-41369
Aliases: GHSA-cg7q-fg22-4g98 |
OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables Host exec environment sanitization misses package, … |
Vulnerable Vulnerable |
|
CVE-2026-41373
Aliases: GHSA-g8xp-qx39-9jq9 |
OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides Incomplete `host-env-security-policy.json` allows untrusted model to substitute … |
Vulnerable Vulnerable |
|
CVE-2026-41374
Aliases: GHSA-hhff-fj5f-qg48 |
OpenClaw runs Discord audio preflight transcription before member authorization Discord audio preflight transcription before member authorization |
Vulnerable Vulnerable |
|
CVE-2026-41376
Aliases: GHSA-rg8m-3943-vm6q |
OpenClaw: Matrix thread root and reply context bypass sender allowlist Matrix thread root and reply context bypass sender allowlist |
Vulnerable Vulnerable |
|
CVE-2026-41377
Aliases: GHSA-cwq8-6f96-g3q4 |
OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open) Security Scan Failure Does Not Block Plugin Installation (Fail-Open) |
Vulnerable Vulnerable |
|
CVE-2026-41378
Aliases: GHSA-gjm7-hw8f-73rq |
OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch Paired node escalates to gateway RCE via unrestricted … |
Vulnerable Vulnerable |
|
CVE-2026-41381
Aliases: GHSA-cqgw-44wg-44rf |
OpenClaw: Discord voice manager bypasses channel-level member access allowlist Discord voice manager bypasses channel-level member access allowlist |
Vulnerable Vulnerable |
|
CVE-2026-41382
Aliases: GHSA-x2m8-53h4-6hch |
OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps Discord voice ingress authorization can … |
Vulnerable Vulnerable |
|
CVE-2026-41385
Aliases: GHSA-jjw7-3vjf-fg5j |
OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get |
Vulnerable Vulnerable |
|
CVE-2026-41388
Aliases: GHSA-3pm9-5j7m-59vc |
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config |
Vulnerable Vulnerable |
|
GHSA-rxmx-g7hr-8mx4
Aliases: CVE-2026-41354 |
OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders ## Summary Before OpenClaw 2026.4.2, Zalo webhook replay … |
Vulnerable |
|
CVE-2026-41391
Aliases: GHSA-7ggg-pvrf-458v |
OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic `PIP_INDEX_URL` and `UV_INDEX_URL` bypass host exec … |
Vulnerable Vulnerable |
|
CVE-2026-41393
Aliases: GHSA-q9w8-cf67-r238 |
OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration macOS Wide-Area Discovery Accepts Arbitrary Tailnet Peer as DNS Authority and Exfiltrates … |
Vulnerable Vulnerable |
|
CVE-2026-41394
Aliases: GHSA-mhgq-xpfq-6r66 |
OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes Unauthenticated plugin-auth HTTP routes receive operator runtime scopes |
Vulnerable Vulnerable |
|
CVE-2026-41396
Aliases: GHSA-qcj9-wwgw-6gm8 |
OpenClaw: Workspace `.env` can override the bundled plugin trust root Workspace `.env` can override the bundled plugin trust root |
Vulnerable Vulnerable |
|
CVE-2026-41397
Aliases: GHSA-cwf8-44x6-32c2 |
OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal OpenShell Mirror Sync: Sandbox Escape via … |
Vulnerable Vulnerable |
|
CVE-2026-41400
Aliases: GHSA-2w79-r9g8-wmcr |
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062) Incomplete fix for CVE-2026-32062: voice-call still … |
Vulnerable Vulnerable |
|
CVE-2026-41402
Aliases: GHSA-hhq4-97c2-p447 |
OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass Zalo webhook replay cache cross-target messageId scope bypass |
Vulnerable Vulnerable |
|
CVE-2026-41403
Aliases: GHSA-3xv9-89fm-7h4r |
OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled diffs viewer misclassifies proxied remote requests as … |
Vulnerable Vulnerable |
|
CVE-2026-41404
Aliases: GHSA-g374-mggx-p6xc |
OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth … |
Vulnerable Vulnerable |
|
CVE-2026-41405
Aliases: GHSA-p464-m8x6-vhv8 |
OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion MS Teams webhook parses body before JWT … |
Vulnerable Vulnerable |
|
CVE-2026-41406
Aliases: GHSA-877v-w3f5-3pcq |
OpenClaw: Feishu thread history and quoted messages bypass sender allowlist Feishu thread history and quoted messages bypass sender allowlist |
Vulnerable Vulnerable |
|
CVE-2026-41408
Aliases: GHSA-4g5x-2jfc-xm98 |
OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk Tlon media downloads can bypass core safety limits … |
Vulnerable Vulnerable |
|
GHSA-57gh-m6rq-54cf
|
OpenClaw: Self-`Whitelist`ing in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration Media Local Roots Self-`Whitelist`ing in `appendLocalMediaParentRoots` Allows Model-Initiated Arbitrary … |
Vulnerable Vulnerable |
|
GHSA-58q2-7r52-jq62
|
OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read Path traversal via inbound channel … |
Vulnerable Vulnerable |
|
GHSA-68v4-hmwv-f43h
|
OpenClaw: Media download follows cross-origin redirects with Authorization headers intact Media download follows cross-origin redirects with Authorization headers intact |
Vulnerable Vulnerable |
|
GHSA-f693-58pc-2gfr
|
OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts Telegram legacy allowFrom migration fans default-account trust into … |
Vulnerable Vulnerable |
|
GHSA-fwjq-xwfj-gv75
|
OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations |
Vulnerable Vulnerable |
|
GHSA-j9pv-rrcj-6pfx
|
OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes SSH-based sandbox backends pass unsanitized process.env to child processes |
Vulnerable Vulnerable |
|
GHSA-rm5c-4rmf-vvhw
|
OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses |
Vulnerable |
|
GHSA-w6wx-jq6j-6mcj
|
OpenClaw: pnpm dlx approvals did not bind local script operands ## Summary Before OpenClaw 2026.4.2, `pnpm dlx` approval planning did … |
Vulnerable |
|
GHSA-w85g-3h6x-4xh2
|
OpenClaw: Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS Image pixel-limit guard can fail open on … |
Vulnerable Vulnerable |
|
GHSA-2j53-2c28-g9v2
|
Duplicate Advisory: OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-36cp-mh65-x882
|
Duplicate Advisory: OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-39pp-xp36-q6mg
Aliases: CVE-2026-35650 |
OpenClaw has Inconsistent Host Exec Environment Override Sanitization ## Summary Gateway host exec env override handling did not consistently apply … |
Vulnerable |
|
GHSA-3w6x-gv34-mqpf
|
OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement ## Summary Mutating internal ACP chat commands missed the operator.admin … |
Vulnerable |
|
GHSA-48vw-m3qc-wr99
|
OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths ## Summary Trusted-proxy Control UI … |
Vulnerable |
|
GHSA-4qwc-c7g9-4xcw
Aliases: CVE-2026-35633 |
OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure ## Summary Remote media HTTP error bodies were … |
Vulnerable |
|
GHSA-65h8-27jh-q8wv
Aliases: CVE-2026-35627 |
OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement ## Summary Nostr inbound DM handling could … |
Vulnerable |
|
GHSA-74wf-h43j-vvmj
Aliases: CVE-2026-35655 |
OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting ## Summary ACP permission resolution trusted conflicting tool identity hints from rawInput … |
Vulnerable |
|
GHSA-844j-xrrq-wgh4
Aliases: CVE-2026-35656 |
OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection ## Summary When gateway.trustedProxies was configured, spoofed loopback hops in forwarding headers … |
Vulnerable |
|
GHSA-8883-9w57-vwv6
Aliases: CVE-2026-35652 |
OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions ## Summary Mattermost interactive callback dispatch could run action handlers before normal … |
Vulnerable |
|
GHSA-8h8f-7cxm-m38j
|
Duplicate Advisory: OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-cxmw-p77q-wchg
Aliases: CVE-2026-35643 |
OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface ## Summary Android Canvas WebView pages from untrusted origins could invoke the … |
Vulnerable |
|
GHSA-g8mc-c5f2-mqg7
|
Duplicate Advisory: OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-h3x4-hc5v-v2gm
Aliases: CVE-2026-34426 |
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation ## Summary Windows local-media handling accepted remote-host file … |
Vulnerable |
|
GHSA-hf68-49fm-59cq
Aliases: CVE-2026-35639 |
OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve ## Summary device.pair.approve allowed an operator.pairing approver to … |
Vulnerable |
|
GHSA-hm63-vwj4-mj2q
|
Duplicate Advisory: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-j7p2-qcwm-94v4
Aliases: CVE-2026-41387 |
OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides ## Summary Host exec env override sanitization … |
Vulnerable |
|
GHSA-mp66-rf4f-mhh8
Aliases: CVE-2026-35622 |
OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals ## Summary Google Chat app-url webhook verification accepted add-on principals … |
Vulnerable |
|
GHSA-p6j4-wvmc-vx2h
|
Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-ppwq-6v66-5m6j
|
OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status ## Summary Read-scoped gateway snapshots could expose credentials embedded … |
Vulnerable |
|
GHSA-pw7h-9g6p-c378
Aliases: CVE-2026-35649 |
OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation ## Summary Tlon settings reconciliation treated explicit empty allowlists as unset, which … |
Vulnerable |
|
GHSA-qm9x-v7cx-7rq4
Aliases: CVE-2026-35666 |
OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper ## Summary Allow-always exec approvals did not unwrap … |
Vulnerable |
|
GHSA-r3v5-2grc-429h
|
Duplicate Advisory: OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-rm59-992w-x2mv
Aliases: CVE-2026-35626 |
OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling ## Summary Voice Call webhook handling buffered … |
Vulnerable |
|
GHSA-rqp8-q22p-5j9q
Aliases: CVE-2026-35635 |
OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision ## Summary Synology Chat multi-account configuration could collapse onto … |
Vulnerable |
|
GHSA-rvqr-hrcc-j9vv
Aliases: CVE-2026-35659 |
OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution ## Summary Bonjour and DNS-SD TXT metadata could still … |
Vulnerable |
|
GHSA-vfg3-pqpq-93m4
Aliases: CVE-2026-35637 |
OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete ## Summary Tlon cite expansion happened before channel … |
Vulnerable |
|
GHSA-wj55-88gf-x564
Aliases: CVE-2026-35648 |
OpenClaw may have stale policy enforcement for queued node actions ## Summary Queued node actions were not revalidated against current … |
Vulnerable |
|
GHSA-wv46-v6xc-2qhf
Aliases: CVE-2026-35670 |
OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution. ## Summary Synology Chat reply delivery could rebind … |
Vulnerable |
|
GHSA-x2cm-hg9c-mf5w
Aliases: CVE-2026-35662 |
OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions ## Summary Leaf subagents could still use … |
Vulnerable |
|
GHSA-xhq5-45pm-2gjr
Aliases: CVE-2026-35624 |
OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens ## Summary Nextcloud Talk room authorization … |
Vulnerable |
|
CVE-2026-41386
Aliases: GHSA-gg9v-mgcp-v6m7 |
OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing Bootstrap setup codes were not bound to the intended device … |
Vulnerable Vulnerable |
|
GHSA-h5hg-h7rr-gpf3
|
OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection Node browser proxy `allowProfiles` bypass through … |
Vulnerable Vulnerable |
|
GHSA-2j8v-hwgc-x698
|
OpenClaw: Shell wrapper argv could change between approval and execution ### Summary Shell wrapper argv could change between approval and … |
Vulnerable |
|
GHSA-2mc2-g238-722j
|
OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation) ## Summary Remote iMessage attachment fetches … |
Vulnerable |
|
GHSA-4685-c5cp-vp95
Aliases: CVE-2026-31996 |
OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags ## Summary `tools.exec.safeBins` could be bypassed for filesystem access … |
Vulnerable |
|
GHSA-6c9j-x93c-rw6j
Aliases: CVE-2026-4040 |
OpenClaw safeBins file-existence oracle information disclosure An information disclosure vulnerability in OpenClaw's `tools.exec.safeBins` approval flow allowed a file-existence oracle. When … |
Vulnerable |
|
GHSA-cxpw-2g23-2vgw
Aliases: CVE-2026-27576 |
OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs ## Vulnerability The ACP … |
Vulnerable |
|
GHSA-pj5x-38rw-6fph
Aliases: CVE-2026-22176 |
OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation ### Summary A command injection … |
Vulnerable |
|
GHSA-w45g-5746-x9fp
Aliases: CVE-2026-27488 |
OpenClaw hardened cron webhook delivery against SSRF ## Affected Packages / Versions - `openclaw` npm package versions `<= 2026.2.17`. ## … |
Vulnerable |
|
GHSA-2pr2-hcv6-7gwv
Aliases: CVE-2026-34503 |
OpenClaw's device removal and token revocation do not terminate active WebSocket sessions ## Summary Removing a device or revoking its … |
Vulnerable |
|
GHSA-2x4x-cc5g-qmmg
Aliases: CVE-2026-33577 |
OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes ## Summary The node pairing approval path did … |
Vulnerable |
|
GHSA-3cw3-5vxw-g2h3
Aliases: CVE-2026-41342 |
OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials ## Summary Remote onboarding accepted discovered gateway endpoints … |
Vulnerable |
|
GHSA-3q42-xmxv-9vfr
Aliases: CVE-2026-41379 |
OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send ## Summary Gateway operator.write Can Reach Admin-Class Talk … |
Vulnerable |
|
GHSA-42mx-vp8m-j7qh
Aliases: CVE-2026-41355 |
OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host … |
Vulnerable |
|
GHSA-52q4-3xjc-6778
Aliases: CVE-2026-35617 |
OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName ## Summary Google Chat Authz Bypass via … |
Vulnerable |
|
GHSA-5h2w-qmfp-ggp6
Aliases: CVE-2026-41344 |
OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose` ## Summary The `chat.send` path let authorized write-scoped callers … |
Vulnerable |
|
GHSA-5r8f-96gm-5j6g
|
OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset` ## Summary The `chat.send` path reused command authorization to … |
Vulnerable |
|
GHSA-63mg-xp9j-jfcm
Aliases: CVE-2026-33578 |
OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade ## Summary When only a route-level group allowlist … |
Vulnerable |
|
GHSA-6pfc-6m7w-m8fx
Aliases: CVE-2026-41390 |
OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper ## Summary Allow-always persistence did not unwrap `/usr/bin/script` … |
Vulnerable |
|
GHSA-6xg4-82hv-cp6f
Aliases: CVE-2026-41299 |
OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing ## Summary ACP-only provenance fields in `chat.send` … |
Vulnerable |
|
GHSA-767m-xrhc-fxm7
Aliases: CVE-2026-41359 |
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send ## Summary Gateway operator.write Can Reach Admin-Class … |
Vulnerable |
|
GHSA-77w2-crqv-cmv3
Aliases: CVE-2026-35664 |
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing ## Summary Feishu Raw card … |
Vulnerable |
|
GHSA-8rh7-6779-cjqq
Aliases: CVE-2026-41294 |
OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover ## Summary OpenClaw loaded … |
Vulnerable |
|
GHSA-9528-x887-j2fp
Aliases: CVE-2026-33580 |
OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication ## Summary Nextcloud Talk webhook signature failures were not … |
Vulnerable |
|
GHSA-98hh-7ghg-x6rq
Aliases: CVE-2026-41303 |
OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals ## Summary Discord text approval commands … |
Vulnerable |
|
GHSA-f44p-c7w9-7xr7
Aliases: CVE-2026-41399 |
OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades ## Summary The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades … |
Vulnerable |
|
GHSA-f6pf-4gjx-c94r
|
OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read ## Summary OpenClaw <= 2026.3.24 Media Parsing Path Traversal to … |
Vulnerable |
|
GHSA-g86v-f9qv-rh6m
|
OpenClaw SSRF guard misses four IPv6 special-use ranges ## Summary The SSRF/IP classifier treated several IPv6 special-use ranges as public … |
Vulnerable |
|
GHSA-h2v7-xc88-xx8c
Aliases: CVE-2026-41375 |
OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels ## Summary `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check … |
Vulnerable |
|
GHSA-h4jx-hjr3-fhgc
Aliases: CVE-2026-35645 |
OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` ## Summary Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` ## … |
Vulnerable |
|
GHSA-hc5h-pmr3-3497
Aliases: CVE-2026-33579 |
OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation ## Summary The `/pair approve` command … |
Vulnerable |
|
GHSA-j4c9-w69r-cw33
Aliases: CVE-2026-35661 |
OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State ## Summary Telegram DM-Scoped Inline Button Callbacks … |
Vulnerable |
|
GHSA-jccr-rrw2-vc8h
|
OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure ## Summary The jq safe-bin policy blocked explicit `env` usage … |
Vulnerable |
|
GHSA-m866-6qv5-p2fg
Aliases: CVE-2026-41332 |
OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override ## Summary Host execution env sanitization did … |
Vulnerable |
|
GHSA-p4x4-2r7f-wjxg
Aliases: CVE-2026-41380 |
OpenClaw gateway exec allow-always over-trusts positional carrier executables ## Summary Allow-always persistence could trust wrapper carrier executables instead of the … |
Vulnerable |
|
GHSA-qxgf-hmcj-3xw3
Aliases: CVE-2026-34504 |
OpenClaw affected by SSRF via unguarded image download in fal provider ## Summary The fal provider used raw fetches for … |
Vulnerable |
|
GHSA-rf6h-5gpw-qrgq
Aliases: CVE-2026-35654 |
OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback ## Summary MS Teams Feedback Invoke Bypasses … |
Vulnerable |
|
GHSA-v2v2-f783-358j
Aliases: CVE-2026-33576 |
OpenClaw: Zalo channel downloads media before sender authorization ## Summary The Zalo image path fetched and stored inbound media before … |
Vulnerable |
|
GHSA-v3qc-wrwx-j3pw
|
OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch` ## Summary Agentic Consent Bypass: LLM … |
Vulnerable |
|
GHSA-2rgf-hm63-5qph
Aliases: CVE-2026-32029 |
OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions ### Summary OpenClaw used left-most `X-Forwarded-For` … |
Vulnerable |
|
GHSA-3cvx-236h-m9fj
Aliases: CVE-2026-32034 |
OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access ## Description In affected releases, … |
Vulnerable |
|
GHSA-vffc-f7r7-rx2w
Aliases: CVE-2026-32063 |
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux) ### Summary A command injection vulnerability … |
Vulnerable |
|
GHSA-2rqg-gjgv-84jm
|
OpenClaw: Gateway `agent` calls could override the workspace boundary ### Summary The public gateway `agent` RPC allowed an authenticated operator … |
Vulnerable |
|
GHSA-f8r2-vg7x-gh8m
|
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths ### Summary `matchesExecAllowlistPattern` normalized patterns and targets with lowercasing and compiled … |
Vulnerable |
|
GHSA-vmhq-cqm9-6p7q
|
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes ### Summary An authorization mismatch in the gateway let an authenticated … |
Vulnerable |
|
GHSA-wcxr-59v9-rxr8
Aliases: CVE-2026-32918 |
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state ### Summary The built-in `session_status` tool did not enforce … |
Vulnerable |
|
GHSA-2w79-r9g8-wmcr
Aliases: CVE-2026-41400 |
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062) ## Summary Incomplete fix for CVE-2026-32062: … |
Vulnerable |
|
GHSA-37v6-fxx8-xjmx
Aliases: CVE-2026-41351 |
OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding ## Summary Telnyx Webhook Replay Detection Bypass via Base64 Signature … |
Vulnerable |
|
GHSA-3pm9-5j7m-59vc
Aliases: CVE-2026-41388 |
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config ## Summary Tlon Startup Migration Rehydrates Empty-Array Revocations From File … |
Vulnerable |
|
GHSA-3qpv-xf3v-mm45
Aliases: CVE-2026-41336 |
OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code ## Summary Workspace `.env` can override … |
Vulnerable |
|
GHSA-3xv9-89fm-7h4r
Aliases: CVE-2026-41403 |
OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled ## Summary diffs viewer misclassifies proxied remote … |
Vulnerable |
|
GHSA-4g5x-2jfc-xm98
Aliases: CVE-2026-41408 |
OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk ## Summary Tlon media downloads can bypass core … |
Vulnerable |
|
GHSA-57gh-m6rq-54cf
|
OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration ## Summary Media Local Roots Self-Whitelisting in `appendLocalMediaParentRoots` Allows … |
Vulnerable |
|
GHSA-58q2-7r52-jq62
|
OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read ## Summary Path traversal via … |
Vulnerable |
|
GHSA-6336-qqw9-v6x6
Aliases: CVE-2026-41341 |
OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message ## Summary Discord Component Interaction Misclassifies Group DM as Direct … |
Vulnerable |
|
GHSA-68v4-hmwv-f43h
|
OpenClaw: Media download follows cross-origin redirects with Authorization headers intact ## Summary Media download follows cross-origin redirects with Authorization headers … |
Vulnerable |
|
GHSA-6p8r-6m93-557f
Aliases: CVE-2026-41333 |
OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting ## Summary Fake DeviceToken Bypasses Shared Auth Rate Limiting ## Current Maintainer … |
Vulnerable |
|
GHSA-7ggg-pvrf-458v
Aliases: CVE-2026-41391 |
OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic ## Summary `PIP_INDEX_URL` and `UV_INDEX_URL` bypass … |
Vulnerable |
|
GHSA-877v-w3f5-3pcq
Aliases: CVE-2026-41406 |
OpenClaw: Feishu thread history and quoted messages bypass sender allowlist ## Summary Feishu thread history and quoted messages bypass sender … |
Vulnerable |
|
GHSA-89r3-6x4j-v7wf
Aliases: CVE-2026-41337 |
OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection ## Summary Voice-call Plivo replay mutates in-process callback origin … |
Vulnerable |
|
GHSA-9f4w-67g7-mqwv
Aliases: CVE-2026-41300 |
OpenClaw: Endpoint persists after trust decline, leaking gateway credentials ## Summary Remote onboarding preserves attacker-discovered endpoint after trust decline, routing … |
Vulnerable |
|
GHSA-9gp8-hjxr-6f34
Aliases: CVE-2026-41330 |
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls ## Summary Host exec environment overrides miss … |
Vulnerable |
|
GHSA-9p3r-hh9g-5cmg
Aliases: CVE-2026-41296 |
OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile ## Summary Sandbox escape via TOCTOU race in remote … |
Vulnerable |
|
GHSA-9q7v-8mr7-g23p
Aliases: CVE-2026-41302 |
OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery ## Summary SSRF via Unguarded `fetch()` in … |
Vulnerable |
|
GHSA-cg7q-fg22-4g98
Aliases: CVE-2026-41369 |
OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables ## Summary Host exec environment sanitization … |
Vulnerable |
|
GHSA-chfm-xgc4-47rj
Aliases: CVE-2026-41365 |
OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API ## Summary MSTeams thread history bypasses sender allowlist via Graph … |
Vulnerable |
|
GHSA-cqgw-44wg-44rf
Aliases: CVE-2026-41381 |
OpenClaw: Discord voice manager bypasses channel-level member access allowlist ## Summary Discord voice manager bypasses channel-level member access allowlist ## … |
Vulnerable |
|
GHSA-cwf8-44x6-32c2
Aliases: CVE-2026-41397 |
OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal ## Summary OpenShell Mirror Sync: Sandbox … |
Vulnerable |
|
GHSA-cwq8-6f96-g3q4
Aliases: CVE-2026-41377 |
OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open) ## Summary Security Scan Failure Does Not Block Plugin Installation … |
Vulnerable |
|
GHSA-f693-58pc-2gfr
|
OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts ## Summary Telegram legacy allowFrom migration fans default-account … |
Vulnerable |
|
GHSA-fv94-qvg8-xqpw
Aliases: CVE-2026-41364 |
OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host ## Summary SSH sandbox tar upload … |
Vulnerable |
|
GHSA-fwjq-xwfj-gv75
|
OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations ## Summary `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations ## … |
Vulnerable |
|
GHSA-g374-mggx-p6xc
Aliases: CVE-2026-41404 |
OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode ## Summary Incomplete scope-clearing fix allows operator.admin escalation via … |
Vulnerable |
|
GHSA-g5cg-8x5w-7jpm
Aliases: CVE-2026-41329 |
OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation ## Summary Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation ## … |
Vulnerable |
|
GHSA-g8xp-qx39-9jq9
Aliases: CVE-2026-41373 |
OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides ## Summary Incomplete `host-env-security-policy.json` allows untrusted model … |
Vulnerable |
|
GHSA-gjm7-hw8f-73rq
Aliases: CVE-2026-41378 |
OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch ## Summary Paired node escalates to gateway RCE … |
Vulnerable |
|
GHSA-hhff-fj5f-qg48
Aliases: CVE-2026-41374 |
OpenClaw runs Discord audio preflight transcription before member authorization ## Summary Discord audio preflight transcription before member authorization ## Current … |
Vulnerable |
|
GHSA-hhq4-97c2-p447
Aliases: CVE-2026-41402 |
OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass ## Summary Zalo webhook replay cache cross-target messageId scope bypass ## … |
Vulnerable |
|
GHSA-hr8g-2q7x-3f4w
Aliases: CVE-2026-41335 |
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability ## Summary OpenClaw Gateway Control Interface Information Disclosure Vulnerability ## Current … |
Vulnerable |
|
GHSA-j9pv-rrcj-6pfx
|
OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes ## Summary SSH-based sandbox backends pass unsanitized process.env to child … |
Vulnerable |
|
GHSA-jjw7-3vjf-fg5j
Aliases: CVE-2026-41385 |
## Summary OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get ## Current Maintainer Triage - Status: … |
Vulnerable |
|
GHSA-m6fx-m8hc-572m
Aliases: CVE-2026-41331 |
OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders ## Summary Telegram audio preflight transcription enables resource consumption … |
Vulnerable |
|
GHSA-mhgq-xpfq-6r66
Aliases: CVE-2026-41394 |
OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes ## Summary Unauthenticated plugin-auth HTTP routes receive operator runtime scopes ## … |
Vulnerable |
|
GHSA-mhr7-2xmv-4c4q
Aliases: CVE-2026-41347 |
OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode ## Summary HTTP operator endpoints lack browser-origin validation in trusted-proxy … |
Vulnerable |
|
GHSA-p464-m8x6-vhv8
Aliases: CVE-2026-41405 |
OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion ## Summary MS Teams webhook parses body … |
Vulnerable |
|
GHSA-q9w8-cf67-r238
Aliases: CVE-2026-41393 |
OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration ## Summary macOS Wide-Area Discovery Accepts Arbitrary Tailnet Peer as DNS Authority … |
Vulnerable |
|
GHSA-qcc3-jqwp-5vh2
Aliases: CVE-2026-41343 |
OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification ## Summary LINE webhook handler lacks shared pre-auth … |
Vulnerable |
|
GHSA-qcj9-wwgw-6gm8
Aliases: CVE-2026-41396 |
OpenClaw: Workspace `.env` can override the bundled plugin trust root ## Summary Workspace `.env` can override the bundled plugin trust … |
Vulnerable |
|
GHSA-rfqg-qgf8-xr9x
Aliases: CVE-2026-41356 |
OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation ## Summary Gateway `device.token.rotate` does not terminate active … |
Vulnerable |
|
GHSA-rg8m-3943-vm6q
Aliases: CVE-2026-41376 |
OpenClaw: Matrix thread root and reply context bypass sender allowlist ## Summary Matrix thread root and reply context bypass sender … |
Vulnerable |
|
GHSA-rm5c-4rmf-vvhw
|
OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses ## Summary Sandbox file operations use check-then-act, bypassing fd-based TOCTOU … |
Vulnerable |
|
GHSA-rvvf-6vh3-9j43
Aliases: CVE-2026-41348 |
OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist ## Summary Discord Slash Commands Bypass Group DM Channel Allowlist ## … |
Vulnerable |
|
GHSA-vjx8-8p7h-82gr
Aliases: CVE-2026-41297 |
OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection ## Summary Marketplace Plugin Download Follows Redirects Without SSRF Protection ## … |
Vulnerable |
|
GHSA-w85g-3h6x-4xh2
|
OpenClaw: Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS ## Summary Image pixel-limit guard can fail … |
Vulnerable |
|
GHSA-x2m8-53h4-6hch
Aliases: CVE-2026-41382 |
OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps ## Summary Discord voice ingress … |
Vulnerable |
|
GHSA-xj9w-5r6q-x6v4
Aliases: CVE-2026-41352 |
OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md ## Summary Device-Paired Node Skips Node Scope Gate → Host … |
Vulnerable |
|
GHSA-2xcp-x87w-q377
Aliases: CVE-2026-45002 |
OpenClaw: Hook mapping templates could bypass hook session-key opt-in ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-57r2-h2wj-g887
Aliases: CVE-2026-44999 |
OpenClaw: Isolated cron awareness events were recorded as trusted system events ## Affected Packages / Versions - Package: `openclaw` (npm) … |
Vulnerable |
|
GHSA-72q8-jcmc-97wx
|
OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy ## Affected Packages / Versions - Package: `openclaw` (npm) - … |
Vulnerable |
|
GHSA-7jm2-g593-4qrc
|
OpenClaw: Agent gateway config mutations could change protected operator settings ## Affected Packages / Versions - Package: `openclaw` (npm) - … |
Vulnerable |
|
GHSA-9j32-3m66-mc4m
|
Duplicate Advisory: OpenClaw: Hook mapping templates could bypass hook session-key opt-in ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-9r9j-3r2w-fg3v
|
Duplicate Advisory: OpenClaw: Workspace dotenv could override runtime-control environment variables ### Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-c4qg-j8jg-42q5
Aliases: CVE-2026-44117 |
OpenClaw: QQBot direct media upload skipped URL SSRF validation ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-hxvm-xjvf-93f3
Aliases: CVE-2026-44114 |
OpenClaw: Workspace dotenv could override runtime-control environment variables ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: … |
Vulnerable |
|
GHSA-j4c5-89f5-f3pm
|
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-m5j2-r859-r5cv
|
Duplicate Advisory: OpenClaw: Isolated cron awareness events were recorded as trusted system events ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-mj59-h3q9-ghfh
Aliases: CVE-2026-44995 |
OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config ## Affected Packages / Versions - Package: … |
Vulnerable |
|
GHSA-p3m6-jr2h-hhxj
|
Duplicate Advisory: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-qgx9-6px9-7p75
|
Duplicate Advisory: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-qrp5-gfw2-gxv4
|
OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-r747-33r4-rmjw
|
Duplicate Advisory: OpenClaw: QQBot direct media upload skipped URL SSRF validation ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-v8qf-fr4g-28p2
Aliases: CVE-2026-41908 |
OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization ## Affected Packages / Versions - Package: `openclaw` (npm) - … |
Vulnerable |
|
GHSA-xrq9-jm7v-g9h7
|
OpenClaw: Paired-device pairing actions were not limited to the caller device ## Affected Packages / Versions - Package: `openclaw` (npm) … |
Vulnerable |
|
GHSA-3298-56p6-rpw2
Aliases: CVE-2026-35667 |
OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts` > Fixed in OpenClaw 2026.3.24, the … |
Vulnerable |
|
GHSA-39mp-545q-w789
Aliases: CVE-2026-35620 |
OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy > Fixed in OpenClaw 2026.3.24, the current shipping … |
Vulnerable |
|
GHSA-3gr8-2752-h46q
|
Duplicate Advisory: OpenClaw's message tool media parameter bypasses tool policy filesystem isolation ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-hr5v-j9h9-xjhg
Aliases: CVE-2026-35668 |
OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22) > Fixed in OpenClaw 2026.3.24, the … |
Vulnerable |
|
GHSA-v8wv-jg3q-qwpq
Aliases: CVE-2026-33581 |
OpenClaw's message tool media parameter bypasses tool policy filesystem isolation ## Summary The message tool accepted `mediaUrl` and `fileUrl` aliases … |
Vulnerable |
|
GHSA-vqvg-86cc-cg83
|
OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement > Fixed in OpenClaw 2026.3.24, the current shipping release. **Title** … |
Vulnerable |
|
GHSA-w6m8-cqvj-pg5v
Aliases: CVE-2026-35665 |
OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant) > Fixed in OpenClaw … |
Vulnerable |
|
GHSA-xp9r-prpg-373r
Aliases: CVE-2026-35653 |
OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface > Fixed in OpenClaw 2026.3.24, the current shipping release. # … |
Vulnerable |
|
CVE-2026-35619
Aliases: GHSA-68f8-9mhj-h2mp |
OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope The OpenAI-compatible HTTP endpoint `/v1/models` accepts bearer auth but … |
Vulnerable Vulnerable |
|
CVE-2026-35621
Aliases: GHSA-94pw-c6m8-p9p9 |
OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send The shared `/allowlist` command persists channel authorization config through … |
Vulnerable Vulnerable |
|
CVE-2026-35641
Aliases: GHSA-m3mh-3mpg-37hw |
OpenClaw has an Arbitrary Malicious Code Execution Vulnerability During the installation phase of OpenClaw local plugins/hooks, the Git executable can … |
Vulnerable Vulnerable |
|
CVE-2026-41384
Aliases: GHSA-vfw7-6rhc-6xxg |
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config Incomplete Fix for CVE-2026-4039: CLI Backend … |
Vulnerable Vulnerable |
|
GHSA-354r-7mfh-7rh2
Aliases: CVE-2026-32028 |
OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups ### Summary In OpenClaw `<= 2026.2.24`, Discord direct-message reaction … |
Vulnerable |
|
GHSA-3jx4-q2m7-r496
|
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations ### Summary In certain workspace-restricted configurations, OpenClaw could … |
Vulnerable |
|
GHSA-6g25-pc82-vfwp
|
OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state ### Summary The affected surface is the OpenClaw macOS app … |
Vulnerable |
|
GHSA-792q-qw95-f446
Aliases: CVE-2026-32050 |
OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks ### Summary In a narrow Signal … |
Vulnerable |
|
GHSA-h97f-6pqj-q452
|
OpenClaw has a IPv6 multicast SSRF classifier bypass ### Summary OpenClaw's SSRF IP classifier did not treat IPv6 multicast literals … |
Vulnerable |
|
GHSA-hwpq-rrpf-pgcq
Aliases: CVE-2026-32065 |
OpenClaw: system.run approval identity mismatch could execute a different binary than displayed ### Summary `system.run` approvals in OpenClaw used rendered … |
Vulnerable |
|
GHSA-j26j-7qc4-3mrf
|
OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption ### Summary In `openclaw` MS Teams file-consent flow, pending … |
Vulnerable |
|
GHSA-jmmg-jqc7-5qf4
Aliases: CVE-2026-32025 |
OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains This issue is a browser-origin WebSocket auth chain … |
Vulnerable |
|
GHSA-mwcg-wfq3-4gjc
Aliases: CVE-2026-32043 |
OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host ### Summary In `openclaw@2026.2.24`, approval-bound `system.run` on node … |
Vulnerable |
|
GHSA-qj22-xqjr-v83v
|
OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection A missing sender-authorization check in Telegram `message_reaction` handling allowed unauthorized users … |
Vulnerable |
|
GHSA-r9q5-c7qc-p26w
Aliases: CVE-2026-28449 |
OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing ### Summary When Nextcloud Talk webhook signing was valid, replayed … |
Vulnerable |
|
GHSA-rm2p-j3r7-4x4j
Aliases: CVE-2026-32899 |
OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress ### Summary OpenClaw Slack monitor handled `reaction_*` and `pin_*` non-message events … |
Vulnerable |
|
GHSA-vvgp-4c28-m3jm
Aliases: CVE-2026-32057 |
OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions ## Summary A trusted-proxy Control UI pairing … |
Vulnerable |
|
GHSA-x2ff-j5c2-ggpr
Aliases: CVE-2026-32005 |
OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows ## Impact In shared Slack workspace deployments … |
Vulnerable |
|
GHSA-xmv6-r34m-62p4
|
OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot ### Summary A sandbox path validation … |
Vulnerable |
|
GHSA-35c7-4r45-9gv3
|
Duplicate Advisory: OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-77pv-3w4q-vrj5
Aliases: CVE-2026-53834 |
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks QQBot pre-dispatch slash commands could skip allowFrom checks. In affected versions, … |
Vulnerable Vulnerable |
|
GHSA-35cq-wv6v-88xf
|
Duplicate Advisory: OpenClaw affected by SSRF via unguarded image download in fal provider ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-394x-274p-mqc6
|
Duplicate Advisory: OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-3h52-cx59-c456
Aliases: CVE-2026-35640 |
OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation ## Summary Feishu webhook reads and parses unauthenticated … |
Vulnerable |
|
GHSA-59xc-5v89-r7pr
|
Duplicate Advisory: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-8689-gm9g-jgr6
Aliases: CVE-2026-41395 |
OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering ## Summary Plivo V3 signature … |
Vulnerable |
|
GHSA-89hr-6x2p-8xjv
|
Duplicate Advisory: OpenClaw's device removal and token revocation do not terminate active WebSocket sessions ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-8f9r-gr6r-x63q
|
Duplicate Advisory: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-8j7f-g9gv-7jhc
|
Duplicate Advisory: OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476) ### Duplicate Advisory … |
Vulnerable |
|
GHSA-f275-5h5c-5wg5
|
Duplicate Advisory: OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-gm9m-x74r-8whg
|
Duplicate Advisory: OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-gv2f-q4wp-fvh5
|
Duplicate Advisory: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-m563-373q-885c
|
Duplicate Advisory: OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on … |
Vulnerable |
|
GHSA-mf5g-6r6f-ghhm
Aliases: CVE-2026-35646 |
OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token ## Summary Synology Chat Webhook Pre-Auth Rate-Limit … |
Vulnerable |
|
GHSA-rhfg-j8jq-7v2h
Aliases: CVE-2026-35629 |
OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476) ## Summary SSRF via Unguarded … |
Vulnerable |
|
GHSA-v3c2-39fm-jq4h
|
Duplicate Advisory: OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose` ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-wcm7-94wg-h74h
|
Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override ### Duplicate Advisory This advisory … |
Vulnerable |
|
CVE-2026-32846
Aliases: GHSA-hggm-x7r9-mm7v |
OpenClaw is vulnerable to Path Traversal through path validation bypass OpenClaw through 2026.3.23 (fixed in commit 4797bbc) contains a path … |
Vulnerable Vulnerable |
|
CVE-2026-33576
Aliases: GHSA-v2v2-f783-358j |
OpenClaw: Zalo channel downloads media before sender authorization The Zalo image path fetched and stored inbound media before the DM/pairing … |
Vulnerable Vulnerable |
|
CVE-2026-33577
Aliases: GHSA-2x4x-cc5g-qmmg |
OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes The node pairing approval path did not consistently … |
Vulnerable Vulnerable |
|
CVE-2026-33578
Aliases: GHSA-63mg-xp9j-jfcm |
OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade When only a route-level group allowlist was configured, … |
Vulnerable Vulnerable |
|
CVE-2026-33579
Aliases: GHSA-hc5h-pmr3-3497 |
OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation The `/pair approve` command path called … |
Vulnerable Vulnerable |
|
CVE-2026-33580
Aliases: GHSA-9528-x887-j2fp |
OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication Nextcloud Talk webhook signature failures were not throttled even … |
Vulnerable Vulnerable |
|
CVE-2026-34503
Aliases: GHSA-2pr2-hcv6-7gwv |
OpenClaw's device removal and token revocation do not terminate active WebSocket sessions Removing a device or revoking its token updated … |
Vulnerable Vulnerable |
|
CVE-2026-34504
Aliases: GHSA-qxgf-hmcj-3xw3 |
OpenClaw affected by SSRF via unguarded image download in fal provider The fal provider used raw fetches for both provider … |
Vulnerable Vulnerable |
|
CVE-2026-35617
Aliases: GHSA-52q4-3xjc-6778 |
OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName Google Chat Authz Bypass via Group Policy … |
Vulnerable Vulnerable |
|
CVE-2026-35645
Aliases: GHSA-h4jx-hjr3-fhgc |
OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` |
Vulnerable Vulnerable |
|
CVE-2026-35654
Aliases: GHSA-rf6h-5gpw-qrgq |
OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback MS Teams Feedback Invoke Bypasses Sender Allowlists … |
Vulnerable Vulnerable |
|
CVE-2026-35661
Aliases: GHSA-j4c9-w69r-cw33 |
OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State Telegram DM-Scoped Inline Button Callbacks Bypass DM … |
Vulnerable Vulnerable |
|
CVE-2026-35664
Aliases: GHSA-77w2-crqv-cmv3 |
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing Feishu Raw card Send Surface … |
Vulnerable Vulnerable |
|
CVE-2026-41294
Aliases: GHSA-8rh7-6779-cjqq |
OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover OpenClaw loaded the current … |
Vulnerable Vulnerable |
|
CVE-2026-41299
Aliases: GHSA-6xg4-82hv-cp6f |
OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing ACP-only provenance fields in `chat.send` were gated … |
Vulnerable |
|
CVE-2026-41303
Aliases: GHSA-98hh-7ghg-x6rq |
OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals Discord text approval commands resolved pending … |
Vulnerable Vulnerable |
|
CVE-2026-41332
Aliases: GHSA-m866-6qv5-p2fg |
OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override Host execution env sanitization did not block … |
Vulnerable Vulnerable |
|
CVE-2026-41342
Aliases: GHSA-3cw3-5vxw-g2h3 |
OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials Remote onboarding accepted discovered gateway endpoints without an … |
Vulnerable Vulnerable |
|
CVE-2026-41344
Aliases: GHSA-5h2w-qmfp-ggp6 |
OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose` The `chat.send` path let authorized write-scoped callers persist `/verbose` … |
Vulnerable Vulnerable |
|
CVE-2026-41355
Aliases: GHSA-42mx-vp8m-j7qh |
OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host … |
Vulnerable Vulnerable |
|
CVE-2026-41359
Aliases: GHSA-767m-xrhc-fxm7 |
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send Gateway operator.write Can Reach Admin-Class Telegram Config … |
Vulnerable Vulnerable |
|
CVE-2026-41375
Aliases: GHSA-h2v7-xc88-xx8c |
OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External … |
Vulnerable Vulnerable |
|
CVE-2026-41379
Aliases: GHSA-3q42-xmxv-9vfr |
OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send Gateway operator.write Can Reach Admin-Class Talk Voice Config … |
Vulnerable Vulnerable |
|
CVE-2026-41380
Aliases: GHSA-p4x4-2r7f-wjxg |
OpenClaw gateway exec allow-always over-trusts positional carrier executables Allow-always persistence could trust wrapper carrier executables instead of the actual invoked … |
Vulnerable Vulnerable |
|
CVE-2026-41390
Aliases: GHSA-6pfc-6m7w-m8fx |
OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper Allow-always persistence did not unwrap `/usr/bin/script` and similar … |
Vulnerable Vulnerable |
|
CVE-2026-41399
Aliases: GHSA-f44p-c7w9-7xr7 |
OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating … |
Vulnerable Vulnerable |
|
GHSA-5r8f-96gm-5j6g
|
OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset` The `chat.send` path reused command authorization to trigger `/reset` … |
Vulnerable Vulnerable |
|
GHSA-f6pf-4gjx-c94r
|
OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read OpenClaw <= 2026.3.24 Media Parsing Path Traversal to Arbitrary File … |
Vulnerable Vulnerable |
|
GHSA-g86v-f9qv-rh6m
|
OpenClaw SSRF guard misses four IPv6 special-use ranges The SSRF/IP classifier treated several IPv6 special-use ranges as public and allowed … |
Vulnerable Vulnerable |
|
GHSA-jccr-rrw2-vc8h
|
OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure The jq safe-bin policy blocked explicit `env` usage but still … |
Vulnerable Vulnerable |
|
GHSA-v3qc-wrwx-j3pw
|
OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch` Agentic Consent Bypass: LLM Agent Can … |
Vulnerable Vulnerable |
|
GHSA-35vf-vw9f-q3cr
|
Duplicate Advisory: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-5jgm-f9wr-9qm7
|
Duplicate Advisory: OpenClaw: Workspace dotenv files cannot override connector endpoint hosts ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-6f72-9gxx-98mj
|
Duplicate Advisory: OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-frr5-j3mh-h9ch
|
Duplicate Advisory: OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-p68j-q8j9-jwf5
|
Duplicate Advisory: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-qvmw-h675-h7qg
|
Duplicate Advisory: OpenClaw validates Zalo outbound photo URLs through the SSRF guard ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-2fgq-7j6h-9rm4
Aliases: CVE-2026-32003 |
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE) ### Summary `system.run` allowed `SHELLOPTS` + `PS4` … |
Vulnerable |
|
GHSA-w626-296m-8f85
|
Duplicate Advisory: OpenClaw's ACP child sessions inherit subagent security envelope constraints ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
CVE-2026-44112
Aliases: GHSA-wppj-c6mr-83jj |
OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root OpenShell FS bridge writes stay pinned to the … |
Vulnerable Vulnerable |
|
CVE-2026-44113
Aliases: GHSA-5h3g-6xhh-rg6p |
OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes OpenShell FS bridge reads pin and … |
Vulnerable Vulnerable |
|
CVE-2026-44116
Aliases: GHSA-2hh7-c75g-qj2r |
OpenClaw validates Zalo outbound photo URLs through the SSRF guard Zalo outbound photo URLs are validated through the SSRF guard. |
Vulnerable Vulnerable |
|
CVE-2026-44118
Aliases: GHSA-r6xh-pqhr-v4xh |
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens MCP loopback owner context is derived from server-issued bearer … |
Vulnerable Vulnerable |
|
CVE-2026-44997
Aliases: GHSA-q3jj-46pq-826r |
OpenClaw's ACP child sessions inherit subagent security envelope constraints ACP child sessions inherit subagent security envelope constraints. |
Vulnerable Vulnerable |
|
CVE-2026-45003
Aliases: GHSA-55cf-xx38-4p9p |
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts Workspace dotenv files cannot override connector endpoint hosts. |
Vulnerable Vulnerable |
|
GHSA-275c-xpvc-jgfw
Aliases: CVE-2026-53830 |
OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload Slack and Zalo webhook secrets could remain active after … |
Vulnerable |
|
GHSA-93rg-2xm5-2p9v
|
OpenClaw's Gateway Control UI bootstrap config required Gateway auth Gateway Control UI bootstrap config required Gateway auth. |
Vulnerable Vulnerable |
|
GHSA-x3h8-jrgh-p8jx
|
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs Exec allowlist analysis rejects shell expansion in unquoted heredocs |
Vulnerable |
|
GHSA-36h3-7c54-j27r
Aliases: CVE-2026-32054 |
OpenClaw has browser trace/download path symlink escape in temp output handling ### Summary Browser trace/download output path handling allowed symlink-root … |
Vulnerable |
|
GHSA-fgvx-58p6-gjwc
Aliases: CVE-2026-32013 |
OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write ## Impact The gateway `agents.files.get` and `agents.files.set` methods allowed symlink traversal … |
Vulnerable |
|
CVE-2026-28449
Aliases: GHSA-r9q5-c7qc-p26w |
OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing When Nextcloud Talk webhook signing was valid, replayed requests could … |
Vulnerable Vulnerable |
|
CVE-2026-32005
Aliases: GHSA-x2ff-j5c2-ggpr |
OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows In shared Slack workspace deployments that rely … |
Vulnerable Vulnerable |
|
CVE-2026-32025
Aliases: GHSA-jmmg-jqc7-5qf4 |
OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains This issue is a browser-origin WebSocket auth chain … |
Vulnerable Vulnerable |
|
CVE-2026-32028
Aliases: GHSA-354r-7mfh-7rh2 |
OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups In OpenClaw `<= 2026.2.24`, Discord direct-message reaction notifications did … |
Vulnerable Vulnerable |
|
CVE-2026-32043
Aliases: GHSA-mwcg-wfq3-4gjc |
OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host In `openclaw@2026.2.24`, approval-bound `system.run` on node hosts could … |
Vulnerable Vulnerable |
|
CVE-2026-32050
Aliases: GHSA-792q-qw95-f446 |
OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks In a narrow Signal reaction-notification path, … |
Vulnerable Vulnerable |
|
CVE-2026-32057
Aliases: GHSA-vvgp-4c28-m3jm |
OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions A trusted-proxy Control UI pairing bypass accepted … |
Vulnerable Vulnerable |
|
CVE-2026-32065
Aliases: GHSA-hwpq-rrpf-pgcq |
OpenClaw: system.run approval identity mismatch could execute a different binary than displayed `system.run` approvals in OpenClaw used rendered command text … |
Vulnerable Vulnerable |
|
CVE-2026-32899
Aliases: GHSA-rm2p-j3r7-4x4j |
OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress OpenClaw Slack monitor handled `reaction_*` and `pin_*` non-message events before applying … |
Vulnerable Vulnerable |
|
GHSA-3jx4-q2m7-r496
|
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations In certain workspace-restricted configurations, OpenClaw could follow hardlink … |
Vulnerable Vulnerable |
|
GHSA-6g25-pc82-vfwp
|
OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state The affected surface is the OpenClaw macOS app onboarding flow, … |
Vulnerable Vulnerable |
|
GHSA-h97f-6pqj-q452
|
OpenClaw has a IPv6 multicast SSRF classifier bypass OpenClaw's SSRF IP classifier did not treat IPv6 multicast literals (`ff00::/8`) as … |
Vulnerable Vulnerable |
|
GHSA-j26j-7qc4-3mrf
|
OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption In `openclaw` MS Teams file-consent flow, pending uploads were … |
Vulnerable Vulnerable |
|
GHSA-qj22-xqjr-v83v
|
OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection A missing sender-authorization check in Telegram `message_reaction` handling allowed unauthorized users … |
Vulnerable Vulnerable |
|
GHSA-xmv6-r34m-62p4
|
OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot A sandbox path validation bypass in … |
Vulnerable Vulnerable |
|
GHSA-392f-ggf5-fp3c
|
OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists ### Summary A paired node could supply … |
Vulnerable |
|
GHSA-7xmq-g46g-f8pv
|
OpenClaw: Sandbox media TOCTOU could read files outside sandbox root ### Summary Sandbox media handling had a time-of-check/time-of-use gap: media … |
Vulnerable |
|
GHSA-8m9v-xpgf-g99m
|
OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization ### Summary Unauthorized senders could trigger … |
Vulnerable |
|
GHSA-g99v-8hwm-g76g
Aliases: CVE-2026-31989 |
OpenClaw has web_search citation redirect SSRF via private-network-allowing policy ### Summary Gemini `web_search` citation redirect resolution used a private-network-allowing SSRF … |
Vulnerable |
|
GHSA-jr6x-2q95-fh2g
|
OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools ### Summary An authorization mismatch allowed authenticated callers with … |
Vulnerable |
|
GHSA-p7gr-f84w-hqg5
Aliases: CVE-2026-32048 |
OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns ### Summary A sandboxed session could use cross-agent `sessions_spawn` to … |
Vulnerable |
|
GHSA-q399-23r3-hfx4
Aliases: CVE-2026-31997 |
OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind ### Summary For `host=node` runs, approvals validated … |
Vulnerable |
|
GHSA-vpj2-69hf-rppw
Aliases: CVE-2026-32041 |
OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failure ### Summary When browser control started without explicit auth … |
Vulnerable |
|
GHSA-wr6m-jg37-68xh
Aliases: CVE-2026-32066 |
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS) ### Summary Unauthenticated requests to a … |
Vulnerable |
|
GHSA-x82f-27x3-q89c
|
OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries ### Summary A symlink-retarget TOCTOU race … |
Vulnerable |
|
GHSA-3fv3-6p2v-gxwj
Aliases: CVE-2026-41914 |
OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths ## Impact QQ Bot Extension: Missing SSRF Protection … |
Vulnerable |
|
GHSA-3vvq-q2qc-7rmp
Aliases: CVE-2026-42428 |
OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification ## Impact B-M3: ClawHub package downloads are not enforced … |
Vulnerable |
|
GHSA-4f8g-77mw-3rxc
Aliases: CVE-2026-42429 |
OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write` ## Impact Gateway plugin HTTP `auth: gateway` … |
Vulnerable |
|
GHSA-5fc7-f62m-8983
Aliases: CVE-2026-41911 |
OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix) ## Impact Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy … |
Vulnerable |
|
GHSA-5h3f-885m-v22w
Aliases: CVE-2026-42421 |
OpenClaw: Existing WS sessions survive shared gateway token rotation ## Impact Existing WS sessions survive shared gateway token rotation. Rotating … |
Vulnerable |
|
GHSA-5wj5-87vq-39xm
Aliases: CVE-2026-42432 |
OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement ## Impact Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope … |
Vulnerable |
|
GHSA-67mf-f936-ppxf
Aliases: CVE-2026-42426 |
## Impact OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval. The pairing approval method accepted … |
Vulnerable |
|
GHSA-68x5-xx89-w9mm
Aliases: CVE-2026-41916 |
OpenClaw: resolvedAuth closure becomes stale after config reload ## Impact resolvedAuth closure becomes stale after config reload. After a config … |
Vulnerable |
|
GHSA-7437-7hg8-frrw
Aliases: CVE-2026-42427 |
OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class) … |
Vulnerable |
|
GHSA-ccx3-fw7q-rr2r
Aliases: CVE-2026-42420 |
OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks ## Impact Multiple Code Paths Missing Base64 Pre-Allocation Size Checks. Several … |
Vulnerable |
|
GHSA-cm8v-2vh9-cxf3
Aliases: CVE-2026-41915 |
OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant) ## Impact GIT_DIR and related … |
Vulnerable |
|
GHSA-cmfr-9m2r-xwhq
Aliases: CVE-2026-42431 |
## Impact OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard. node.invoke(browser.proxy) could mutate persistent browser profiles through a path that bypassed … |
Vulnerable |
|
GHSA-pg8g-f2hf-x82m
|
Duplicate Advisory: OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-q2gc-xjqw-qp89
Aliases: CVE-2026-42423 |
OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts ## Impact strictInlineEval explicit-approval boundary bypassed … |
Vulnerable |
|
GHSA-qqq7-4hxc-x63c
Aliases: CVE-2026-42424 |
OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration ## Impact Shared … |
Vulnerable |
|
GHSA-qx8j-g322-qj6m
Aliases: CVE-2026-40037 |
OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects ## Impact `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects. A … |
Vulnerable |
|
GHSA-vc32-h5mq-453v
Aliases: CVE-2026-41910 |
OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes ## Impact /allowlist omits owner-only enforcement for cross-channel allowlist writes. An … |
Vulnerable |
|
GHSA-vr5g-mmx7-h897
Aliases: CVE-2026-41912 |
OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation ## Impact Browser SSRF Policy Bypass via Interaction-Triggered Navigation. Browser interactions … |
Vulnerable |
|
GHSA-w8g9-x8gx-crmm
Aliases: CVE-2026-42430 |
OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable ## Impact Strict browser SSRF bypass in … |
Vulnerable |
|
GHSA-w9j9-w4cp-6wgr
|
## Impact OpenClaw Host-Exec Environment Variable Injection. Host exec could inherit environment variables that influence interpreters, shells, or build tools. … |
Vulnerable |
|
GHSA-whf9-3hcx-gq54
Aliases: CVE-2026-42422 |
## Impact OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing. Device token rotation could mint or preserve … |
Vulnerable |
|
GHSA-gfmx-pph7-g46x
|
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` … |
Vulnerable Vulnerable |
|
GHSA-jf56-mccx-5f3f
|
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel Authenticated `/hooks/wake` and mapped `wake` … |
Vulnerable Vulnerable |
|
GHSA-3h2q-j2v4-6w5r
|
OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers OpenClaw's `system.run` shell-wrapper detection did not recognize PowerShell `-EncodedCommand` forms as … |
Vulnerable |
|
GHSA-6mgf-v5j7-45cr
Aliases: CVE-2026-32913 |
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects OpenClaw's `fetchWithSsrFGuard(...)` followed cross-origin redirects while preserving arbitrary caller-supplied headers except … |
Vulnerable |
|
GHSA-6rmx-gvvg-vh6j
|
OpenClaw's hooks count non-POST requests toward auth lockout OpenClaw's hooks HTTP handler counted hook authentication failures before rejecting unsupported HTTP … |
Vulnerable |
|
GHSA-9q2p-vc84-2rwm
|
OpenClaw: system.run allow-always persistence included shell-commented payload tails OpenClaw's `system.run` allowlist analysis did not honor POSIX shell comment semantics when … |
Vulnerable |
|
GHSA-9q36-67vc-rrwg
Aliases: CVE-2026-27646 |
OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions ### Summary Sandboxed requester sessions could reach host-side ACP session … |
Vulnerable |
|
GHSA-hfpr-jhpq-x4rm
|
OpenClaw: `operator.write` chat.send could reach admin-only config writes ### Summary A gateway client authenticated with `operator.write` could route `/config set` … |
Vulnerable |
|
GHSA-j425-whc4-4jgc
|
OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots ### Summary `system.run` env override sanitization allowed dangerous override-only helper-command pivots … |
Vulnerable |
|
GHSA-pjvx-rx66-r3fg
|
OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping ### Summary `/allowlist ... --store` resolved the selected channel … |
Vulnerable |
|
GHSA-r6qf-8968-wj9q
Aliases: CVE-2026-27183 |
OpenClaw: system.run wrapper-depth boundary could skip shell approval gating OpenClaw's `system.run` dispatch-wrapper handling applied different depth-boundary rules to shell-wrapper approval … |
Vulnerable |
|
GHSA-rchv-x836-w7xp
|
OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage OpenClaw's macOS Dashboard flow exposed Gateway authentication material to … |
Vulnerable |
|
GHSA-3p2x-hjxj-c7rv
|
Duplicate Advisory: OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
GHSA-866c-wwm5-4rj7
|
Duplicate Advisory: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-86jj-29wc-7q2w
|
Duplicate Advisory: OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks ## Duplicate Advisory This … | There are no reported fixed by versions. |
|
GHSA-g839-vp47-wgh8
|
Duplicate Advisory: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-mxmg-3p7m-2ghr
|
Duplicate Advisory: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
GHSA-xh9j-mpc9-2m9p
|
Duplicate Advisory: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions ## Duplicate Advisory This advisory … | There are no reported fixed by versions. |
|
GHSA-3pxq-f3cp-jmxp
Aliases: CVE-2026-22180 |
OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows ### Summary A path-confinement bypass in browser output … |
Vulnerable |
|
GHSA-474h-prjg-mmw3
|
OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization ### Summary Sandboxed `sessions_spawn(runtime="acp")` could bypass sandbox inheritance and … |
Vulnerable |
|
GHSA-77hf-7fqf-f227
|
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS) ### Summary The `tar.bz2` installer path in `src/agents/skills-install-download.ts` used … |
Vulnerable |
|
GHSA-8mvx-p2r9-r375
Aliases: CVE-2026-22181 |
OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured ### Summary `openclaw` web tools … |
Vulnerable |
|
GHSA-cfvj-7rx7-fc7c
Aliases: CVE-2026-31990 |
OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace ### Summary `stageSandboxMedia` allowed destination symlink traversal during media … |
Vulnerable |
|
GHSA-r54r-wmmq-mh84
Aliases: CVE-2026-28483 |
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind ### Summary ZIP extraction in OpenClaw could be … |
Vulnerable |
|
GHSA-v865-p3gq-hw6m
Aliases: CVE-2026-32004 |
OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification ### Summary (Updated March 2, 2026) Encoded alternate-path requests could … |
Vulnerable |
|
GHSA-wpg9-4g4v-f9rc
Aliases: CVE-2026-32035 |
OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels ### Summary In `openclaw@2026.3.1`, the Discord voice … |
Vulnerable |
|
GHSA-x4vp-4235-65hg
Aliases: CVE-2026-32011 |
OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS ## Impact OpenClaw webhook handlers for BlueBubbles and … |
Vulnerable |
|
GHSA-3r56-7hhr-vfg9
|
Duplicate Advisory: OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-f7fh-qg34-x2xh
Aliases: CVE-2026-43576 |
OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets ## Summary CDP /json/version WebSocket URL could pivot to … |
Vulnerable |
|
GHSA-3wqp-prf6-2m72
|
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement ### Summary Feishu dynamic-agent bindings could miss configWrites enforcement. In affected versions, … |
Vulnerable |
|
GHSA-68xw-r643-9p5w
Aliases: CVE-2026-53845 |
OpenClaw: Skill-command dispatch could skip before-tool-call hooks ### Summary Skill-command dispatch could skip before-tool-call hooks. In affected versions, a skill … |
Vulnerable |
|
GHSA-c226-q6fx-6j6c
Aliases: CVE-2026-53861 |
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags ### Summary macOS Swift exec allowlist missed combined POSIX inline … |
Vulnerable |
|
GHSA-cqwv-9qjx-vxw2
|
OpenClaw: Skill Workshop apply flow could override pending approval ### Summary Skill Workshop apply flow could override pending approval. In … |
Vulnerable |
|
GHSA-gp79-m99v-gjmh
Aliases: CVE-2026-53837 |
OpenClaw: Mattermost handlers could fall open when channel type was missing ### Summary Mattermost handlers could fall open when channel … |
Vulnerable Vulnerable |
|
GHSA-p73f-w79w-jqr5
|
OpenClaw: Native command authorization could skip owner-command enforcement ### Summary Native command authorization could skip owner-command enforcement. In affected versions, … |
Vulnerable |
|
GHSA-w5ww-7chg-mxcq
|
OpenClaw: Telegram interactive callbacks could skip commands.allowFrom ### Summary Telegram interactive callbacks could skip commands.allowFrom. In affected versions, a Telegram … |
Vulnerable |
|
GHSA-x629-46cc-7xgw
Aliases: CVE-2026-53847 |
OpenClaw: Active Memory write scope could mutate global config ### Summary Active Memory write scope could mutate global config. In … |
Vulnerable |
|
GHSA-3x84-qq85-fj65
Aliases: CVE-2026-62197 |
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs ### Summary Browser CDP discovery could accept blocked WebSocket URLs. In … |
Vulnerable |
|
GHSA-jw7v-5mp7-ghgm
|
Duplicate Advisory: Browser CDP discovery could accept blocked WebSocket URLs ## Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-4cqv-h74h-93j4
|
OpenClaw has a Discord `allowFrom` slug-collision authorization bypass OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching … |
Vulnerable |
|
GHSA-4gc7-qcvf-38wg
Aliases: CVE-2026-32010 |
In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program ### Summary This issue applies to a … |
Vulnerable |
|
GHSA-659f-22xc-98f2
|
OpenClaw hook transform path containment missed symlink-resolved escapes ## Vulnerability Webhook transform modules were validated with lexical path checks only. … |
Vulnerable |
|
GHSA-8mr2-f9wf-hcfq
|
Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-v3j7-34xh-6g3w
Aliases: CVE-2026-22174 |
OpenClaw Loopback CDP probe can leak Gateway token to local listener ### Summary A local process can capture the OpenClaw … |
Vulnerable |
|
GHSA-v6x2-2qvm-6gv8
Aliases: CVE-2026-32897 |
OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback ## Vulnerability OpenClaw reused `gateway.auth.token` (and `gateway.remote.token`) … |
Vulnerable |
|
GHSA-4hmj-39m8-jwc7
Aliases: CVE-2026-35651 |
OpenClaw has ACP CLI approval prompt ANSI escape sequence injection ## Summary ACP CLI approval prompt ANSI escape sequence injection … |
Vulnerable Vulnerable |
|
GHSA-4hpg-mp64-x7xq
Aliases: CVE-2026-53854 |
OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state ### Summary Internal/webchat command auth could inherit ownerAllowFrom wildcard state. In … |
Vulnerable |
|
GHSA-8mg9-j9cf-54cj
Aliases: CVE-2026-53852 |
OpenClaw: Empty-scope device re-pairing could confuse caller scope containment ### Summary Empty-scope device re-pairing could confuse caller scope containment. In … |
Vulnerable |
|
GHSA-985f-72mj-8gf7
Aliases: CVE-2026-53863 |
OpenClaw: Tool group policy callers could accept unvalidated group IDs ### Summary Tool group policy callers could accept unvalidated group … |
Vulnerable |
|
GHSA-mpc8-jxjh-qpgh
Aliases: CVE-2026-53850 |
OpenClaw: Focus command could miss controlScope enforcement ### Summary Focus command could miss controlScope enforcement. In affected versions, a caller … |
Vulnerable |
|
GHSA-p39j-x9h5-q66m
Aliases: CVE-2026-53809 |
OpenClaw: Embedded runner policy could be confused by provider aliases ### Summary Embedded runner policy could be confused by provider … |
Vulnerable |
|
GHSA-v8cx-933x-r976
Aliases: CVE-2026-53813 |
OpenClaw: Fake package roots could influence memory-core artifact loading ### Summary Fake package roots could influence memory-core artifact loading. In … |
Vulnerable |
|
GHSA-4jpw-hj22-2xmc
|
OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE ## Summary In affected versions of `openclaw`, a caller … |
Vulnerable |
|
GHSA-4w7m-58cg-cmff
|
OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries ## Summary In affected versions of `openclaw`, sandboxed leaf subagents … |
Vulnerable |
|
GHSA-5wcw-8jjv-m286
Aliases: CVE-2026-32302 |
OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode ## Summary In affected versions of `openclaw`, browser-originated … |
Vulnerable |
|
GHSA-8jhh-jcqg-mj5p
|
OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions ## Summary In affected versions of `openclaw`, channel-initiated config mutations were authorized … |
Vulnerable |
|
GHSA-9vvh-2768-c8vp
|
OpenClaw: Discord guild reaction ingress could bypass users and roles allowlists ## Summary In affected versions of `openclaw`, Discord reaction … |
Vulnerable |
|
GHSA-jf6w-m8jw-jfxc
|
OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent` ## Summary In affected versions of `openclaw`, a gateway … |
Vulnerable |
|
GHSA-mj4p-rc52-m843
|
OpenClaw: Sandbox staged writes could escape the verified parent directory before commit ## Summary In affected versions of `openclaw`, sandbox … |
Vulnerable |
|
GHSA-qc36-x95h-7j53
Aliases: CVE-2026-32978 |
OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity ## Summary In affected versions of `openclaw`, node-host `system.run` approvals did … |
Vulnerable |
|
GHSA-qvr7-g57c-mrc7
Aliases: CVE-2026-32970 |
OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode ## Summary In affected versions of … |
Vulnerable |
|
GHSA-rw39-5899-8mxp
Aliases: CVE-2026-32971 |
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv ## Summary In affected versions of `openclaw`, … |
Vulnerable |
|
GHSA-vm29-7mq3-9jrg
|
Duplicate Advisory: OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-w8rf-7qf8-65ww
|
Duplicate Advisory: OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-wmgj-hrx3-23gj
|
Duplicate Advisory: OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-xf99-j42q-5w5p
Aliases: CVE-2026-32979 |
OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity ## Summary In affected versions of `openclaw`, node-host `system.run` … |
Vulnerable |
|
GHSA-xvx8-77m6-gwg6
Aliases: CVE-2026-32977 |
OpenClaw: Sandbox `writeFile` commit could race outside the validated path ## Summary In affected versions of `openclaw`, the sandbox fs-bridge … |
Vulnerable |
|
GHSA-xxj4-96ph-g6j6
|
Duplicate Advisory: OpenClaw: Sandbox `writeFile` commit could race outside the validated path ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
CVE-2026-32918
Aliases: GHSA-wcxr-59v9-rxr8 |
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state The built-in `session_status` tool did not enforce the intended … |
Vulnerable Vulnerable |
|
GHSA-2rqg-gjgv-84jm
|
OpenClaw: Gateway `agent` calls could override the workspace boundary The public gateway `agent` RPC allowed an authenticated operator with `operator.write` … |
Vulnerable Vulnerable |
|
GHSA-f8r2-vg7x-gh8m
|
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths `matchesExecAllowlistPattern` normalized patterns and targets with lowercasing and compiled glob matching … |
Vulnerable Vulnerable |
|
GHSA-vmhq-cqm9-6p7q
|
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes An authorization mismatch in the gateway let an authenticated caller with … |
Vulnerable Vulnerable |
|
GHSA-4m3v-q747-pc6h
|
OpenClaw: Mattermost slash token revocation could lag until monitor refresh ### Summary Mattermost slash token revocation could lag until monitor … |
Vulnerable |
|
GHSA-525j-hqq2-66r4
|
OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0 ## Summary Sandbox browser CDP relay could expose DevTools … |
Vulnerable |
|
GHSA-527m-976r-jf79
Aliases: CVE-2026-43573 |
OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement ## Summary Existing-session browser interaction routes bypassed SSRF policy enforcement. ## … |
Vulnerable |
|
GHSA-536q-mj95-h29h
Aliases: CVE-2026-43580 |
OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage ## Summary Browser press/type interaction routes missed complete navigation guard … |
Vulnerable |
|
GHSA-66r7-m7xm-v49h
Aliases: CVE-2026-43533 |
OpenClaw: QQBot media tags could read arbitrary local files through reply text ## Summary QQBot media tags could read arbitrary … |
Vulnerable |
|
GHSA-7g8c-cfr3-vqqr
Aliases: CVE-2026-43534 |
OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input ## Summary Agent hook events could enqueue … |
Vulnerable |
|
GHSA-7jp6-r74r-995q
Aliases: CVE-2026-42433 |
OpenClaw: Matrix profile config persistence was reachable from operator.write message tools ## Summary Matrix profile config persistence was reachable from … |
Vulnerable |
|
GHSA-82qx-6vj7-p8m2
Aliases: CVE-2026-43571 |
OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows ## Summary Channel setup catalog lookups could include untrusted … |
Vulnerable |
|
GHSA-f3h5-h452-vp3j
|
OpenClaw: Nostr profile mutation routes allowed operator.write config persistence ## Summary Nostr profile mutation routes allowed operator.write config persistence. ## … |
Vulnerable |
|
GHSA-gj9q-8w99-mp8j
Aliases: CVE-2026-43529 |
OpenClaw: TOCTOU read in exec script preflight ## Summary OpenClaw's exec script preflight validator previously validated and then read a … |
Vulnerable |
|
GHSA-jf25-7968-h2h5
Aliases: CVE-2026-43567 |
OpenClaw: screen_record outPath bypassed workspace-only filesystem guard ## Summary screen_record outPath bypassed workspace-only filesystem guard. ## Affected Packages / Versions … |
Vulnerable |
|
GHSA-rj2p-j66c-mgqh
Aliases: CVE-2026-42439 |
OpenClaw: Browser tabs action select and close routes bypassed SSRF policy ## Summary Browser tabs action select and close routes … |
Vulnerable |
|
GHSA-vfp4-8x56-j7c5
Aliases: CVE-2026-43584 |
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables ## Summary Exec environment denylist missed high-risk interpreter startup variables. ## … |
Vulnerable |
|
GHSA-w7rc-vvgx-pj45
|
Duplicate Advisory: OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-wwwc-f646-vj2j
|
Duplicate Advisory: OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-xq94-r468-qwgj
Aliases: CVE-2026-43582 |
OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding ## Summary Browser SSRF hostname validation could be bypassed … |
Vulnerable |
|
GHSA-xrgf-r9gr-jjjf
|
Duplicate Advisory: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-53vx-pmqw-863c
Aliases: CVE-2026-43527 |
OpenClaw: Browser SSRF policy default allowed private-network navigation ## Summary Browser SSRF policy default allowed private-network navigation. ## Affected Packages … |
Vulnerable |
|
GHSA-8372-7vhw-cm6q
Aliases: CVE-2026-43528 |
OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases ## Summary config.get redaction bypass through sourceConfig and runtimeConfig aliases. ## … |
Vulnerable |
|
GHSA-c4qm-58hj-j6pj
Aliases: CVE-2026-42436 |
OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation ## Summary Browser snapshot and screenshot routes … |
Vulnerable |
|
GHSA-jwrq-8g5x-5fhm
Aliases: CVE-2026-43535 |
OpenClaw: Collect-mode queue batches could reuse the last sender authorization context ## Summary Collect-mode queue batches could reuse the last … |
Vulnerable |
|
GHSA-58wc-8wrv-xp9j
|
Duplicate Advisory: Active Memory write scope could mutate global config ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-g796-jqmx-wf9q
|
Duplicate Advisory: macOS Swift exec allowlist missed combined POSIX inline flags ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-r7vv-6763-m739
|
Duplicate Advisory: Skill-command dispatch could skip before-tool-call hooks ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-5jvj-hxmh-6h6j
Aliases: CVE-2026-35657 |
OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope ## Summary Gateway HTTP Session History Route Bypasses Operator Read … | There are no reported fixed by versions. |
|
GHSA-5m9r-p9g7-679c
Aliases: CVE-2026-34505 |
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation ### Summary The Zalo webhook handler applied request rate … |
Vulnerable |
|
GHSA-5rp4-cwgh-gvwq
|
Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes ### Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-7h7g-x2px-94hj
|
OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens ### Summary OpenClaw pairing setup codes … |
Vulnerable |
|
GHSA-8288-jpqp-95fx
Aliases: CVE-2026-34508 |
Duplicate Advisory: OpenClaw has Bypass in Webhook Rate Limiting via Pre-Authentication Secret Validation ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-99qw-6mr3-36qr
Aliases: CVE-2026-32920 |
OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories ### Summary OpenClaw automatically discovered and loaded plugins from `.openclaw/extensions/` … |
Vulnerable |
|
GHSA-cxfr-3qp8-hpmw
|
Duplicate Advisory: OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-f5mf-3r52-r83w
|
OpenClaw's Zalouser allowlist authorization matched mutable group names by default ### Summary OpenClaw's Zalouser allowlist mode accepted mutable group names … |
Vulnerable |
|
GHSA-g353-mgv3-8pcj
Aliases: CVE-2026-32974 |
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured ### Summary Feishu webhook mode allowed deployments that … |
Vulnerable |
|
GHSA-j5qh-5234-4rqp
|
Duplicate Advisory: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-m69h-jm2f-2pv8
|
OpenClaw: Feishu reaction events could bypass group authorization and mention gating ### Summary A Feishu reaction-originated synthetic event could misclassify … |
Vulnerable |
|
GHSA-r7vr-gr74-94p8
|
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces ### Summary OpenClaw documented `/config` and `/debug` as owner-only commands, … |
Vulnerable |
|
GHSA-rqpp-rjj8-7wv8
Aliases: CVE-2026-22172 |
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes ### Summary A logic flaw in the OpenClaw gateway WebSocket connect path … |
Vulnerable |
|
GHSA-rwwx-25m7-ww73
|
Duplicate Advisory: OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-vjqw-w5jr-g9w5
|
Duplicate Advisory: OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-x49q-fhhm-r9jf
|
Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes ### Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-63f5-hhc7-cx6p
|
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval ### Summary `openclaw` versions `<= 2026.3.12` … |
Vulnerable |
|
GHSA-g2f6-pwvx-r275
|
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection ### Summary `openclaw` versions `<= 2026.3.12` accepted unsanitized … |
Vulnerable |
|
GHSA-jq3f-vjww-8rq7
Aliases: CVE-2026-32980 |
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion ### Summary `openclaw` versions `<= 2026.3.12` … |
Vulnerable |
|
GHSA-xwcj-hwhf-h378
|
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs ### Summary `openclaw` versions `<= 2026.3.12` could include … |
Vulnerable |
|
GHSA-68f8-9mhj-h2mp
Aliases: CVE-2026-35619 |
OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope > Fixed in OpenClaw 2026.3.24, the current shipping release. … |
Vulnerable |
|
GHSA-94pw-c6m8-p9p9
Aliases: CVE-2026-35621 |
OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send > Fixed in OpenClaw 2026.3.24, the current shipping release. … |
Vulnerable |
|
GHSA-6c4r-g249-wv3c
|
OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts ### Summary Sandboxed session spawn could expose … |
Vulnerable |
|
GHSA-6fvr-66p3-3qj4
Aliases: CVE-2026-53814 |
OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority ### Summary OpenClaw hook ingress can start automated agent runs … |
Vulnerable |
|
GHSA-6mqc-jqh6-x8fc
Aliases: CVE-2026-35634 |
OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication ## Summary Before `v2026.3.23`, Canvas and A2UI loopback requests … |
Vulnerable |
|
GHSA-9gvx-vj57-vqqx
|
Duplicate Advisory: OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-cg6c-q2hx-69h7
Aliases: CVE-2026-35618 |
OpenClaw: Plivo V2 verified replay identity drifts on query-only variants ## Summary Before `v2026.3.23`, the Plivo V2 verification path treated … |
Vulnerable |
|
GHSA-j56c-wpqm-h24x
|
Duplicate Advisory: OpenClaw: Plivo V2 verified replay identity drifts on query-only variants ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-wq58-2pvg-5h4f
Aliases: CVE-2026-35660 |
OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers ## Summary Before `v2026.3.23`, the Gateway `agent` RPC accepted … |
Vulnerable |
|
GHSA-6q2v-vfwp-pvwh
|
Duplicate Advisory: OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path ### Duplicate Advisory … |
Vulnerable |
|
GHSA-wwrj-437c-ppq4
|
Duplicate Advisory: OpenClaw's system.run approvals did not bind mutable script operands across approval and execution ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-xg59-f45v-9r9j
|
Duplicate Advisory: OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty ### Duplicate … |
Vulnerable |
|
CVE-2026-32921
Aliases: GHSA-8g75-q649-6pv6 |
OpenClaw's system.run approvals did not bind mutable script operands across approval and execution OpenClaw's `system.run` approval flow did not bind … |
Vulnerable Vulnerable |
|
CVE-2026-33574
Aliases: GHSA-vhwf-4x96-vqx2 |
OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path OpenClaw's skills download installer validated … |
Vulnerable Vulnerable |
|
CVE-2026-34506
Aliases: GHSA-g7cr-9h7q-4qxq |
OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty OpenClaw's Microsoft Teams plugin … |
Vulnerable Vulnerable |
|
GHSA-6xcg-6q43-rj2v
|
Duplicate Advisory: Exported session HTML could keep unsafe markdown links ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-c8w7-9w9h-x69q
|
Duplicate Advisory: Slack reaction events could ignore reaction notification settings ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-72fw-cqh5-f324
Aliases: CVE-2026-53844 |
OpenClaw: memory-wiki shared search could miss session visibility checks ### Summary memory-wiki shared search could miss session visibility checks. In … |
Vulnerable |
|
GHSA-jvm4-4j77-39p6
Aliases: CVE-2026-53833 |
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom ### Summary QQBot streaming command could mutate config without explicit … |
Vulnerable Vulnerable |
|
GHSA-77pv-3w4q-vrj5
Aliases: CVE-2026-53834 |
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks ### Summary QQBot pre-dispatch slash commands could skip allowFrom checks. In … |
Vulnerable Vulnerable |
|
GHSA-77q5-rr5v-x43q
|
OpenClaw: Trusted retry endpoint checks could match hostname prefixes ### Summary Trusted retry endpoint checks could match hostname prefixes. In … |
Vulnerable |
|
CVE-2026-53811
Aliases: GHSA-7hxm-f538-3xp6 |
OpenClaw: Matrix allowFrom could bind to mutable display names Matrix allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
CVE-2026-53849
Aliases: GHSA-cw4q-gqg5-g38h |
OpenClaw: Discord allowFrom could bind to mutable display names Discord allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
CVE-2026-53860
Aliases: GHSA-8j37-5w68-wj2g |
OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers BlueBubbles sender policy could match mutable conversation identifiers. In affected versions, … |
Vulnerable |
|
GHSA-7ff8-xjh3-mgh6
|
OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt ### Summary In `openclaw` versions up to and including `2026.2.22-2`, a … |
Vulnerable |
|
GHSA-7jx5-9fjg-hp4m
Aliases: CVE-2026-32898 |
OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata ## Vulnerability Summary The OpenClaw ACP client could auto-approve … |
Vulnerable |
|
GHSA-7hxm-f538-3xp6
Aliases: CVE-2026-53811 |
OpenClaw: Matrix allowFrom could bind to mutable display names ### Summary Matrix allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-8j37-5w68-wj2g
Aliases: CVE-2026-53860 |
OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers ### Summary BlueBubbles sender policy could match mutable conversation identifiers. In … |
Vulnerable |
|
GHSA-cw4q-gqg5-g38h
Aliases: CVE-2026-53849 |
OpenClaw: Discord allowFrom could bind to mutable display names ### Summary Discord allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-7wv4-cc7p-jhxc
Aliases: CVE-2026-43531 |
OpenClaw: Workspace .env could inject OpenClaw runtime-control variables ## Summary Workspace .env could inject OpenClaw runtime-control variables. ## Affected Packages … |
Vulnerable |
|
GHSA-939r-rj45-g2rj
Aliases: CVE-2026-43569 |
OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins ## Summary Workspace provider auth choices could auto-enable untrusted provider … |
Vulnerable |
|
GHSA-qmwg-qprg-3j38
|
OpenClaw: Browser interaction routes could pivot into local CDP and regain file reads ## Summary Browser interaction routes could pivot … |
Vulnerable |
|
GHSA-7xr2-q9vf-x4r5
Aliases: CVE-2026-35632 |
OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013) ### Summary The patch for CVE-2026-32013 introduced symlink … | There are no reported fixed by versions. |
|
GHSA-pmf3-2q63-jmp6
|
Duplicate Advisory: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013) ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
GHSA-82gw-wqw6-r2cf
|
Duplicate Advisory: Command Injection via unescaped environment assignments in Windows Scheduled Task script generation ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
GHSA-ggm6-h3mx-cmmp
|
Duplicate Advisory: safeBins stdin-only bypass via sort output and recursive grep flags ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-83w9-h5wv-j9xm
Aliases: CVE-2026-53838 |
OpenClaw: Node pairing reconnection could confuse approval scope state ### Summary Node pairing reconnection could confuse approval scope state. In … |
Vulnerable Vulnerable |
|
GHSA-8wg3-5mcm-fjq8
Aliases: CVE-2026-53819 |
OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows ### Summary Workspace .env could override Homebrew executable … |
Vulnerable |
|
GHSA-c85p-9pvr-f7f5
|
Duplicate Advisory: OpenClaw: Node pairing reconnection could confuse approval scope state ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-8c59-hr4w-qg69
Aliases: CVE-2026-53857 |
OpenClaw: Zalo allowFrom could bind to mutable display names ### Summary Zalo allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-8cp7-rp8r-mg77
|
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP ## Summary OpenClaw's SSRF hostname/IP guard did not detect ISATAP … |
Vulnerable |
|
GHSA-8g75-q649-6pv6
Aliases: CVE-2026-32921 |
OpenClaw's system.run approvals did not bind mutable script operands across approval and execution OpenClaw's `system.run` approval flow did not bind … |
Vulnerable |
|
GHSA-g7cr-9h7q-4qxq
Aliases: CVE-2026-34506 |
OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty OpenClaw's Microsoft Teams plugin … |
Vulnerable |
|
GHSA-vhwf-4x96-vqx2
Aliases: CVE-2026-33574 |
OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path OpenClaw's skills download installer validated … |
Vulnerable |
|
GHSA-8hj2-w4c9-fjfq
|
Duplicate Advisory: BlueBubbles sender policy could match mutable conversation identifiers ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-p44v-rx83-vjp4
|
Duplicate Advisory: Discord allowFrom could bind to mutable display names ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-8px5-2gfr-7ph6
|
Duplicate Advisory: OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
GHSA-8wmm-344f-mpjg
|
Duplicate Advisory: Tool group policy callers could accept unvalidated group IDs ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-gw2c-6hcg-5g52
|
Duplicate Advisory: Focus command could miss controlScope enforcement ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-hc4w-hm59-9w88
|
Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-r2fx-hp6p-pgrm
|
Duplicate Advisory: Internal/webchat command auth could inherit ownerAllowFrom wildcard state ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-9c3v-684m-579c
|
OpenClaw MCP SSE redirects could forward Authorization headers ### Summary MCP SSE redirects could forward Authorization headers. In affected versions, … |
Vulnerable |
|
GHSA-9f79-7pw8-3fj8
|
Duplicate Advisory: OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-xgwg-m42c-8q62
|
Duplicate Advisory: OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers ## Duplicate Advisory This advisory … | There are no reported fixed by versions. |
|
GHSA-9hjh-fr4f-gxc4
Aliases: CVE-2026-35663 |
OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin ## Summary Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim … | There are no reported fixed by versions. |
|
GHSA-9p93-7j67-5pc2
|
OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding ## Summary Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill … | There are no reported fixed by versions. |
|
GHSA-9wqx-g2cw-vc7r
Aliases: CVE-2026-35647 |
OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers ## Summary Matrix Verification Notices Bypass … | There are no reported fixed by versions. |
|
GHSA-fqw4-mph7-2vr8
|
OpenClaw: Silent privilege escalation via gateway shared-auth reconnect ## Summary Gateway local shared-auth reconnect silently widens paired device scope from … | There are no reported fixed by versions. |
|
GHSA-j42q-r6qx-xrfp
|
Duplicate Advisory: OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName ## Duplicate Advisory This advisory … | There are no reported fixed by versions. |
|
GHSA-m5jp-p3r5-mfqp
|
Duplicate Advisory: OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-mw7w-g3mg-xqm7
|
OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events ## Summary BlueBubbles Group Reactions Bypass requireMention and … | There are no reported fixed by versions. |
|
GHSA-qm2m-28pf-hgjw
Aliases: CVE-2026-35669 |
OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers ## Summary Gateway Plugin HTTP auth: "gateway" … | There are no reported fixed by versions. |
|
GHSA-r4c2-gq3j-7rpj
|
Duplicate Advisory: OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret ## Duplicate Advisory This … | There are no reported fixed by versions. |
|
GHSA-rc8f-r29c-chr6
|
Duplicate Advisory: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-vcx4-4qxg-mfp4
Aliases: CVE-2026-35628 |
OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret ## Summary Telegram Webhook Missing Guess … | There are no reported fixed by versions. |
|
GHSA-xq8g-hgh6-87hv
Aliases: CVE-2026-35623 |
OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing ## Summary BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force … | There are no reported fixed by versions. |
|
GHSA-9v8j-9c9g-w66c
Aliases: CVE-2026-53862 |
OpenClaw: Bootstrap token replay could widen pending pairing scopes ### Summary Bootstrap token replay could widen pending pairing scopes. In … |
Vulnerable |
|
GHSA-c28g-vh7m-fm7v
Aliases: CVE-2026-44991 |
OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners ## Impact OpenClaw deployments before `2026.4.21` could treat a … |
Vulnerable |
|
GHSA-p3pv-c954-9m6f
|
Duplicate Advisory: OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-c29c-2q9c-pc86
|
OpenClaw: Slack allowFrom could bind to mutable display names ### Summary Slack allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-c447-w54g-f55j
|
Duplicate Advisory: OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion ## Duplicate Advisory This … | There are no reported fixed by versions. |
|
GHSA-ccwh-wwpp-6wg5
Aliases: CVE-2026-53864 |
OpenClaw: Host environment sanitizer missed two Node.js control variables ### Summary Host environment sanitizer missed two Node.js control variables. In … |
Vulnerable |
|
GHSA-cwpp-5962-q4f6
Aliases: CVE-2026-53848 |
OpenClaw: Exec allowlist could miss side effects from transparent command wrappers ### Summary Exec allowlist could miss side effects from … |
Vulnerable |
|
GHSA-gxg4-2rrr-jhc7
Aliases: CVE-2026-53859 |
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently ### Summary Hostname checks could treat trailing-dot hosts inconsistently. In affected versions, … |
Vulnerable |
|
GHSA-cfp9-w5v9-3q4h
Aliases: CVE-2026-35658 |
OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts ## Summary The `image` tool did not fully honor the `tools.fs.workspaceOnly` … |
Vulnerable |
|
CVE-2026-22180
Aliases: GHSA-3pxq-f3cp-jmxp |
OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows A path-confinement bypass in browser output handling allowed … |
Vulnerable Vulnerable |
|
CVE-2026-22181
Aliases: GHSA-8mvx-p2r9-r375 |
OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured `openclaw` web tools strict URL … |
Vulnerable Vulnerable |
|
CVE-2026-28483
Aliases: GHSA-r54r-wmmq-mh84 |
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind ZIP extraction in OpenClaw could be raced into … |
Vulnerable Vulnerable |
|
CVE-2026-31990
Aliases: GHSA-cfvj-7rx7-fc7c |
OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace `stageSandboxMedia` allowed destination symlink traversal during media staging, which … |
Vulnerable Vulnerable |
|
CVE-2026-32004
Aliases: GHSA-v865-p3gq-hw6m |
OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification Encoded alternate-path requests could bypass plugin route auth checks for … |
Vulnerable Vulnerable |
|
CVE-2026-32011
Aliases: GHSA-x4vp-4235-65hg |
OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS OpenClaw webhook handlers for BlueBubbles and Google Chat … |
Vulnerable Vulnerable |
|
CVE-2026-32035
Aliases: GHSA-wpg9-4g4v-f9rc |
OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels In `openclaw@2026.3.1`, the Discord voice transcript path … |
Vulnerable Vulnerable |
|
GHSA-474h-prjg-mmw3
|
OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization Sandboxed `sessions_spawn(runtime="acp")` could bypass sandbox inheritance and initialize host-side … |
Vulnerable Vulnerable |
|
GHSA-77hf-7fqf-f227
|
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS) The `tar.bz2` installer path in `src/agents/skills-install-download.ts` used shell tar … |
Vulnerable Vulnerable |
|
GHSA-chqm-wxm2-w73w
|
Duplicate Advisory: OpenClaw: Mattermost handlers could fall open when channel type was missing ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
CVE-2026-53845
Aliases: GHSA-68xw-r643-9p5w |
OpenClaw: Skill-command dispatch could skip before-tool-call hooks Skill-command dispatch could skip before-tool-call hooks. In affected versions, a skill command routed … |
Vulnerable |
|
CVE-2026-53847
Aliases: GHSA-x629-46cc-7xgw |
OpenClaw: Active Memory write scope could mutate global config Active Memory write scope could mutate global config. In affected versions, … |
Vulnerable |
|
CVE-2026-53861
Aliases: GHSA-c226-q6fx-6j6c |
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags macOS Swift exec allowlist missed combined POSIX inline flags. In … |
Vulnerable |
|
GHSA-3wqp-prf6-2m72
|
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement Feishu dynamic-agent bindings could miss configWrites enforcement. In affected versions, a Feishu … |
Vulnerable |
|
GHSA-cqwv-9qjx-vxw2
|
OpenClaw: Skill Workshop apply flow could override pending approval Skill Workshop apply flow could override pending approval. In affected versions, … |
Vulnerable |
|
GHSA-gp79-m99v-gjmh
Aliases: CVE-2026-53837 |
OpenClaw: Mattermost handlers could fall open when channel type was missing Mattermost handlers could fall open when channel type was … |
Vulnerable Vulnerable |
|
GHSA-p73f-w79w-jqr5
|
OpenClaw: Native command authorization could skip owner-command enforcement Native command authorization could skip owner-command enforcement. In affected versions, a sender … |
Vulnerable |
|
GHSA-w5ww-7chg-mxcq
|
OpenClaw: Telegram interactive callbacks could skip commands.allowFrom Telegram interactive callbacks could skip commands.allowFrom. In affected versions, a Telegram user able … |
Vulnerable |
|
GHSA-chr9-m4q2-76hw
Aliases: CVE-2026-53817 |
OpenClaw: Control UI locality spoofing could mint a durable admin device token ### Summary In affected LAN/shared-token Control UI deployments, … |
Vulnerable |
|
GHSA-cjg8-85gj-v9q2
|
Duplicate Advisory: OpenClaw: Feishu webhook and card-action validation now fail closed ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-f934-5rqf-xx47
|
OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths ## Summary The QMD backend `memory_get` read path accepted … |
Vulnerable |
|
GHSA-m8wm-r5vq-qjpg
|
Duplicate Advisory: OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-xh72-v6v9-mwhc
Aliases: CVE-2026-44109 |
OpenClaw: Feishu webhook and card-action validation now fail closed ## Summary Feishu webhook mode accepted missing `encryptKey` configuration as valid … |
Vulnerable |
|
GHSA-xmxx-7p24-h892
Aliases: CVE-2026-43585 |
OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation ## Summary Gateway HTTP and WebSocket handlers captured the resolved … |
Vulnerable |
|
GHSA-gfg9-5357-hv4c
|
OpenClaw: Webchat audio embedding could read local files without local-root containment OpenClaw deployments before `2026.4.15` could embed host-local audio files … |
Vulnerable Vulnerable |
|
GHSA-cwj3-vqpp-pmxr
|
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes ## Summary The agent-facing `gateway` tool protects `config.apply` and `config.patch` … |
Vulnerable |
|
GHSA-q8ff-7ffm-m3r9
Aliases: CVE-2026-45005 |
OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload ## Summary OpenClaw webhooks allowed route secrets to be backed by … |
Vulnerable |
|
GHSA-r39h-4c2p-3jxp
Aliases: CVE-2026-45004 |
OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution ## Summary OpenClaw's bundled plugin … |
Vulnerable |
|
GHSA-v8j2-5f9p-fmh4
|
Duplicate Advisory: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-xpr6-2hgm-4wwp
|
Duplicate Advisory: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution ### Duplicate Advisory … |
Vulnerable |
|
GHSA-f397-5vjw-v2c2
Aliases: CVE-2026-53866 |
OpenClaw: Shell inline-command parsing could miss an allowlist check ### Summary Shell inline-command parsing could miss an allowlist check. In … |
Vulnerable |
|
GHSA-fcvx-5cxc-v5p8
Aliases: CVE-2026-53851 |
OpenClaw: Slack reaction events could ignore reaction notification settings ### Summary Slack reaction events could ignore reaction notification settings. In … |
Vulnerable |
|
GHSA-j472-gf56-x589
Aliases: CVE-2026-53836 |
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks ### Summary PowerShell encoded-command aliases could miss exec allowlist checks. In … |
Vulnerable Vulnerable |
|
GHSA-vxx3-6hc9-7cc3
Aliases: CVE-2026-53806 |
OpenClaw: Combined POSIX shell options could confuse exec revalidation ### Summary Combined POSIX shell options could confuse exec revalidation. In … |
Vulnerable |
|
GHSA-w9hf-3pp7-pvxv
Aliases: CVE-2026-53841 |
OpenClaw: Exported session HTML could keep unsafe markdown links ### Summary Exported session HTML could keep unsafe markdown links. In … |
Vulnerable |
|
GHSA-ffhm-8fwq-7q27
|
Duplicate Advisory: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-p2fh-f5fc-44hr
|
OpenClaw: memory-wiki ingest could read local files with operator.write scope ### Summary memory-wiki ingest could read local files with operator.write … |
Vulnerable |
|
GHSA-qh2f-99mv-mrcf
|
OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn ### Summary Bundle MCP loopback could miss its … |
Vulnerable |
|
GHSA-rjxq-qqhf-8hwh
Aliases: CVE-2026-53840 |
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin ### Summary OpenClaw supports remote MCP Streamable … |
Vulnerable |
|
GHSA-v2ww-5rh7-2h5v
Aliases: CVE-2026-53853 |
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns ### Summary OpenClaw's exec allowlist supported optional `argPattern` entries to … |
Vulnerable |
|
GHSA-wv26-j37q-2g7p
|
OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions ### Summary Slack plugin approvals used the exec … |
Vulnerable |
|
CVE-2026-53806
Aliases: GHSA-vxx3-6hc9-7cc3 |
OpenClaw: Combined POSIX shell options could confuse exec revalidation Combined POSIX shell options could confuse exec revalidation. In affected versions, … |
Vulnerable |
|
CVE-2026-53841
Aliases: GHSA-w9hf-3pp7-pvxv |
OpenClaw: Exported session HTML could keep unsafe markdown links Exported session HTML could keep unsafe markdown links. In affected versions, … |
Vulnerable |
|
CVE-2026-53851
Aliases: GHSA-fcvx-5cxc-v5p8 |
OpenClaw: Slack reaction events could ignore reaction notification settings Slack reaction events could ignore reaction notification settings. In affected versions, … |
Vulnerable |
|
CVE-2026-53862
Aliases: GHSA-9v8j-9c9g-w66c |
OpenClaw: Bootstrap token replay could widen pending pairing scopes Bootstrap token replay could widen pending pairing scopes. In affected versions, … |
Vulnerable |
|
CVE-2026-53866
Aliases: GHSA-f397-5vjw-v2c2 |
OpenClaw: Shell inline-command parsing could miss an allowlist check Shell inline-command parsing could miss an allowlist check. In affected versions, … |
Vulnerable |
|
GHSA-j472-gf56-x589
Aliases: CVE-2026-53836 |
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks PowerShell encoded-command aliases could miss exec allowlist checks. In affected versions, … |
Vulnerable |
|
GHSA-fg3m-vhrr-8gj6
Aliases: CVE-2026-31995 |
OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path ### Summary On Windows, the Lobster extension previously … |
Vulnerable Vulnerable |
|
GHSA-fq9j-vw4w-fr6v
Aliases: CVE-2026-53842 |
OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution ### Summary Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud … |
Vulnerable |
|
GHSA-rx78-29qr-5hq8
Aliases: CVE-2026-53865 |
OpenClaw: Workspace-derived service PATH could influence trash command selection ### Summary Workspace-derived service PATH could influence trash command selection. In … |
Vulnerable |
|
GHSA-wc84-j36w-pw4x
Aliases: CVE-2026-53858 |
OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots ### Summary Workspace .env STATE_DIRECTORY could influence bundled runtime dependency … |
Vulnerable |
|
GHSA-grc3-2j34-p6gm
|
OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs message.action forwarding could send Gateway credentials to model-supplied loopback … |
Vulnerable |
|
GHSA-g75x-8qqm-2vxp
Aliases: CVE-2026-32015 |
OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks ## Summary `tools.exec.safeBins` allowlist checks could be bypassed by PATH-hijacked … |
Vulnerable |
|
CVE-2026-31995
Aliases: GHSA-fg3m-vhrr-8gj6 |
OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path On Windows, the Lobster extension previously retried certain … |
Vulnerable Vulnerable |
|
GHSA-gfg9-5357-hv4c
|
OpenClaw: Webchat audio embedding could read local files without local-root containment ## Impact OpenClaw deployments before `2026.4.15` could embed host-local … |
Vulnerable |
|
GHSA-gfmx-pph7-g46x
|
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` … |
Vulnerable |
|
GHSA-jf56-mccx-5f3f
|
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel ## Impact Authenticated `/hooks/wake` and … |
Vulnerable |
|
GHSA-gg9v-mgcp-v6m7
Aliases: CVE-2026-41386 |
OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing ## Summary Bootstrap setup codes were not bound to the … |
Vulnerable |
|
GHSA-h5hg-h7rr-gpf3
|
OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection ## Summary Node browser proxy `allowProfiles` … |
Vulnerable |
|
GHSA-grc3-2j34-p6gm
|
OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs ### Summary message.action forwarding could send Gateway credentials to … |
Vulnerable |
|
GHSA-h9h6-pwqv-j9hv
|
Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-hggm-x7r9-mm7v
Aliases: CVE-2026-32846 |
OpenClaw is vulnerable to Path Traversal through path validation bypass OpenClaw through 2026.3.23 (fixed in commit 4797bbc) contains a path … |
Vulnerable |
|
GHSA-hh43-q692-2xmq
|
Duplicate Advisory: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-jp4j-q5fc-58gv
|
OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement ## Summary Discord button and component interaction ingress did not consistently … |
Vulnerable Vulnerable |
|
GHSA-q7q8-3mgw-q67r
Aliases: CVE-2026-53815 |
OpenClaw: Message read actions could skip channel allowlist checks ### Summary Message read actions could skip channel allowlist checks. In … |
Vulnerable |
|
GHSA-q99w-vh6v-q3v7
Aliases: CVE-2026-53843 |
OpenClaw: Pairing-scoped device session could restore revoked node token authority ### Summary In affected releases, a surviving pairing-scoped session for … |
Vulnerable |
|
CVE-2026-53848
Aliases: GHSA-cwpp-5962-q4f6 |
OpenClaw: Exec allowlist could miss side effects from transparent command wrappers Exec allowlist could miss side effects from transparent command … |
Vulnerable |
|
CVE-2026-53859
Aliases: GHSA-gxg4-2rrr-jhc7 |
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently Hostname checks could treat trailing-dot hosts inconsistently. In affected versions, a request … |
Vulnerable |
|
CVE-2026-53864
Aliases: GHSA-ccwh-wwpp-6wg5 |
OpenClaw: Host environment sanitizer missed two Node.js control variables Host environment sanitizer missed two Node.js control variables. In affected versions, … |
Vulnerable |
|
GHSA-qf48-qfv4-jjm9
Aliases: CVE-2026-41363 |
OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image ## Summary Feishu upload path resolution … |
Vulnerable Vulnerable |
|
GHSA-qp56-gp47-jwj3
|
Duplicate Advisory: OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image ### Duplicate Advisory This … |
Vulnerable Vulnerable |
|
GHSA-r6h2-5gqq-v5v6
Aliases: CVE-2026-27485 |
OpenClaw: Reject symlinks in local skill packaging script ## Vulnerability `skills/skill-creator/scripts/package_skill.py` (a local helper script used when authors package skills) … |
Vulnerable |
|
GHSA-rcx4-77x4-hjx5
|
Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-rj6p-xmxr-qj4h
Aliases: CVE-2026-53818 |
OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers ### Summary MCP loopback could skip owner-only tool policy … |
Vulnerable |
|
GHSA-4m3v-q747-pc6h
|
OpenClaw: Mattermost slash token revocation could lag until monitor refresh Mattermost slash token revocation could lag until monitor refresh. In … |
Vulnerable |
|
GHSA-v383-2wgg-v483
|
Duplicate Advisory: Shell inline-command parsing could miss an allowlist check ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-vfw7-6rhc-6xxg
Aliases: CVE-2026-41384 |
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config ## Summary Incomplete Fix for CVE-2026-4039: … |
Vulnerable |
|
GHSA-vqx6-6j84-2794
|
Duplicate Advisory: Hostname checks could treat trailing-dot hosts inconsistently ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
GHSA-vr6h-vxqj-3pjx
|
Duplicate Advisory: Host environment sanitizer missed two Node.js control variables ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-wrr6-p5r6-474m
|
Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-w6f4-3v35-qjhj
|
Duplicate Advisory: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text ## Duplicate Advisory This … | There are no reported fixed by versions. |
|
GHSA-w7m7-3xcf-mp48
|
Duplicate Advisory: Zalo allowFrom could bind to mutable display names ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-wh94-p5m6-mr7j
Aliases: CVE-2026-27484 |
OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows ## Overview Discord moderation action handling (`timeout`, `kick`, `ban`) … | There are no reported fixed by versions. |
|
GHSA-xr4f-mjxj-w6w5
|
OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes ### Summary The bundled device-pair plugin exposed `/pair` on normal chat … |
Vulnerable |
|
CVE-2026-27183
Aliases: GHSA-r6qf-8968-wj9q |
OpenClaw: system.run wrapper-depth boundary could skip shell approval gating OpenClaw's `system.run` dispatch-wrapper handling applied different depth-boundary rules to shell-wrapper approval … |
Vulnerable Vulnerable |
|
CVE-2026-27646
Aliases: GHSA-9q36-67vc-rrwg |
OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions Sandboxed requester sessions could reach host-side ACP session initialization through … |
Vulnerable Vulnerable |
|
CVE-2026-32913
Aliases: GHSA-6mgf-v5j7-45cr |
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects OpenClaw's `fetchWithSsrFGuard(...)` followed cross-origin redirects while preserving arbitrary caller-supplied headers except … |
Vulnerable Vulnerable |
|
GHSA-3h2q-j2v4-6w5r
|
OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers OpenClaw's `system.run` shell-wrapper detection did not recognize PowerShell `-EncodedCommand` forms as … |
Vulnerable Vulnerable |
|
GHSA-6rmx-gvvg-vh6j
|
OpenClaw's hooks count non-POST requests toward auth lockout OpenClaw's hooks HTTP handler counted hook authentication failures before rejecting unsupported HTTP … |
Vulnerable Vulnerable |
|
GHSA-9q2p-vc84-2rwm
|
OpenClaw: system.run allow-always persistence included shell-commented payload tails OpenClaw's `system.run` allowlist analysis did not honor POSIX shell comment semantics when … |
Vulnerable Vulnerable |
|
GHSA-hfpr-jhpq-x4rm
|
OpenClaw: `operator.write` chat.send could reach admin-only config writes A gateway client authenticated with `operator.write` could route `/config set` or `/config … |
Vulnerable Vulnerable |
|
GHSA-j425-whc4-4jgc
|
OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots `system.run` env override sanitization allowed dangerous override-only helper-command pivots to reach … |
Vulnerable Vulnerable |
|
GHSA-pjvx-rx66-r3fg
|
OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping `/allowlist ... --store` resolved the selected channel `accountId` for … |
Vulnerable Vulnerable |
|
GHSA-rchv-x836-w7xp
|
OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage OpenClaw's macOS Dashboard flow exposed Gateway authentication material to … |
Vulnerable Vulnerable |
|
CVE-2026-32980
Aliases: GHSA-jq3f-vjww-8rq7 |
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion `openclaw` versions `<= 2026.3.12` read and … |
Vulnerable Vulnerable |
|
GHSA-63f5-hhc7-cx6p
|
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval `openclaw` versions `<= 2026.3.12` allowed bootstrap … |
Vulnerable Vulnerable |
|
GHSA-g2f6-pwvx-r275
|
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection `openclaw` versions `<= 2026.3.12` accepted unsanitized iMessage remote … |
Vulnerable Vulnerable |
|
GHSA-xwcj-hwhf-h378
|
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs `openclaw` versions `<= 2026.3.12` could include raw Telegram … |
Vulnerable Vulnerable |
|
CVE-2026-35651
Aliases: GHSA-4hmj-39m8-jwc7 |
OpenClaw has ACP CLI approval prompt ANSI escape sequence injection ACP CLI approval prompt ANSI escape sequence injection |
Vulnerable Vulnerable |
|
CVE-2026-41363
Aliases: GHSA-qf48-qfv4-jjm9 |
OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image Feishu upload path resolution could read … |
Vulnerable Vulnerable |
|
CVE-2026-53809
Aliases: GHSA-p39j-x9h5-q66m |
OpenClaw: Embedded runner policy could be confused by provider aliases Embedded runner policy could be confused by provider aliases. In … |
Vulnerable |
|
CVE-2026-53813
Aliases: GHSA-v8cx-933x-r976 |
OpenClaw: Fake package roots could influence memory-core artifact loading Fake package roots could influence memory-core artifact loading. In affected versions, … |
Vulnerable |
|
CVE-2026-53850
Aliases: GHSA-mpc8-jxjh-qpgh |
OpenClaw: Focus command could miss controlScope enforcement Focus command could miss controlScope enforcement. In affected versions, a caller able to … |
Vulnerable |
|
CVE-2026-53852
Aliases: GHSA-8mg9-j9cf-54cj |
OpenClaw: Empty-scope device re-pairing could confuse caller scope containment Empty-scope device re-pairing could confuse caller scope containment. In affected versions, … |
Vulnerable |
|
CVE-2026-53854
Aliases: GHSA-4hpg-mp64-x7xq |
OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state Internal/webchat command auth could inherit ownerAllowFrom wildcard state. In affected versions, … |
Vulnerable |
|
CVE-2026-53863
Aliases: GHSA-985f-72mj-8gf7 |
OpenClaw: Tool group policy callers could accept unvalidated group IDs Tool group policy callers could accept unvalidated group IDs. In … |
Vulnerable |
|
CVE-2026-53857
Aliases: GHSA-8c59-hr4w-qg69 |
OpenClaw: Zalo allowFrom could bind to mutable display names Zalo allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
GHSA-c29c-2q9c-pc86
|
OpenClaw: Slack allowFrom could bind to mutable display names Slack allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
GHSA-2858-xg23-26fp
|
OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots OpenClaw accepted `camera.snap` / `camera.clip` node payload `url` fields … |
Vulnerable Vulnerable |
|
GHSA-3846-mfvc-xwpf
|
Duplicate Advisory: Exec allowlist wrapper analysis did not unwrap env/shell dispatch chains ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-3r78-rqg8-95gg
|
Duplicate Advisory: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse ## … | There are no reported fixed by versions. |
|
GHSA-5326-6f73-m96w
|
Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
GHSA-cjq8-m7wj-xmq9
|
Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-cxcw-jm67-3wwp
|
Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-ffr4-mrhv-vfr2
|
Duplicate Advisory: OpenClaw has browser trace/download path symlink escape in temp output handling ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-pfv5-rpcw-x34x
|
Duplicate Advisory: OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
GHSA-q94v-v6m9-jhq9
|
Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
GHSA-qwmf-95r9-gx9x
|
Duplicate Advisory: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-r849-826x-wgqm
|
Duplicate Advisory: Signal group allowlist authorization bypass via DM pairing-store leakage ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-rj39-33v7-9xrq
|
Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class) ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-vh4c-j2xv-9pv9
|
Duplicate Advisory: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback) ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-x742-88jj-7hv9
|
Duplicate Advisory: allowlist exec-guard bypass via env -S ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-xq3g-m3j8-2vmm
|
Duplicate Advisory: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels ## Duplicate Advisory This … | There are no reported fixed by versions. |
|
GHSA-xrgv-34cc-q765
|
Duplicate Advisory: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-44c9-4rg5-qjgq
|
Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
GHSA-q86m-697p-h7fh
|
Duplicate Advisory: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind ## Duplicate Advisory This advisory … | There are no reported fixed by versions. |
|
GHSA-wr92-6w3g-2hwc
|
Duplicate Advisory: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-6c4r-g249-wv3c
|
OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts Sandboxed session spawn could expose the real … |
Vulnerable |
|
GHSA-jp4j-q5fc-58gv
|
OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement Discord button and component interaction ingress did not consistently reapply the … |
Vulnerable Vulnerable |
|
GHSA-4rqq-w8v4-7p47
Aliases: CVE-2026-32019 |
OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard ### Summary `isPrivateIpv4()` in bundled SSRF guard code missed … |
Vulnerable |
|
GHSA-5847-rm3g-23mw
|
OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants ## Vulnerability The hook authentication throttle keyed … |
Vulnerable |
|
GHSA-5f9p-f3w2-fwch
Aliases: CVE-2026-31993 |
OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains ### Summary In the macOS companion app (**currently … |
Vulnerable |
|
GHSA-5ghc-98wh-gwwf
Aliases: CVE-2026-32020 |
OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read ### Summary The Control UI static file … |
Vulnerable |
|
GHSA-5h2c-8v84-qpvr
|
OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths ### Summary OpenClaw shell-env fallback trusted startup environment … |
Vulnerable |
|
GHSA-6j27-pc5c-m8w8
Aliases: CVE-2026-29607 |
OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution ### Summary In `openclaw` npm releases up to … |
Vulnerable |
|
GHSA-7f4q-9rqh-x36p
Aliases: CVE-2026-32016 |
OpenClaw: macOS optional allowlist basename matching could bypass path-based policy ### Summary On macOS node-host, optional exec-approval allowlist mode previously … |
Vulnerable |
|
GHSA-8mf7-vv8w-hjr2
|
OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode ### Summary When `tools.exec.safeBins` contained a binary without … |
Vulnerable |
|
GHSA-9868-vxmx-w862
Aliases: CVE-2026-28460 |
OpenClaw's system.run allowlist bypass via shell line-continuation command substitution ### Summary In OpenClaw `system.run` allowlist mode, shell-wrapper analysis could be … |
Vulnerable |
|
GHSA-9mph-4f7v-fmvh
|
OpenClaw has agent avatar symlink traversal in gateway session metadata ## Summary A crafted local avatar path could follow a … |
Vulnerable |
|
GHSA-9p38-94jf-hgjj
Aliases: CVE-2026-22179 |
OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution ### Summary In OpenClaw's macOS node-host path, `system.run` allowlist parsing … |
Vulnerable |
|
GHSA-f6h3-846h-2r8w
|
OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization ### Summary In certain elevated-mode configurations, `tools.elevated.allowFrom` accepted … |
Vulnerable |
|
GHSA-f8mp-vj46-cq8v
Aliases: CVE-2026-32032 |
OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment The shell environment fallback path could invoke an attacker-controlled … |
Vulnerable |
|
GHSA-j4xf-96qf-rx69
Aliases: CVE-2026-32021 |
OpenClaw has a Feishu allowFrom authorization bypass via display-name collision ### Summary Feishu allowlist authorization could be bypassed by display-name … |
Vulnerable |
|
GHSA-jj82-76v6-933r
Aliases: CVE-2026-27566 |
OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains ### Summary `system.run` exec allowlist analysis treated wrapper binaries … |
Vulnerable |
|
GHSA-jwf4-8wf4-jf2m
Aliases: CVE-2026-22170 |
OpenClaw: BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty ### Summary BlueBubbles is an optional OpenClaw channel plugin. A … |
Vulnerable |
|
GHSA-jxrq-8fm4-9p58
|
OpenClaw: Zip extraction symlink traversal could write outside destination ### Summary A path confinement bypass in OpenClaw ZIP extraction allowed … |
Vulnerable |
|
GHSA-mfg5-7q5g-f37j
Aliases: CVE-2026-32062 |
OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure ### Summary … |
Vulnerable |
|
GHSA-qhrr-grqp-6x2g
|
OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode ### Summary In `openclaw` allowlist mode, `tools.exec.safeBins` trusted PATH-derived … |
Vulnerable |
|
GHSA-rv2q-f2h5-6xmg
Aliases: CVE-2026-32001 |
OpenClaw's Node role device-identity bypass allows unauthorized node.event injection ### Summary A client authenticated with a shared gateway token could … |
Vulnerable |
|
GHSA-rx3g-mvc3-qfjf
Aliases: CVE-2026-32024 |
OpenClaw's avatar symlink traversal can expose out-of-workspace local files ### Summary OpenClaw avatar handling allowed a symlink traversal path that … |
Vulnerable |
|
GHSA-rxxp-482v-7mrh
Aliases: CVE-2026-32049 |
OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels ## Summary OpenClaw did not consistently … |
Vulnerable |
|
GHSA-vmqr-rc7x-3446
Aliases: CVE-2026-22169 |
OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints When `sort` is explicitly added to `tools.exec.safeBins` (non-default), the … |
Vulnerable |
|
GHSA-w76h-8m22-hpgh
Aliases: CVE-2026-32037 |
OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists ## Summary In OpenClaw MSTeams media download flows, redirect … |
Vulnerable |
|
GHSA-wpph-cjgr-7c39
Aliases: CVE-2026-32039 |
OpenClaw's typed sender-key matching for toolsBySender prevents identity-collision policy bypass ### Summary `channels.*.groups.*.toolsBySender` could match a privileged sender policy using … |
Vulnerable |
|
GHSA-xgf2-vxv2-rrmg
Aliases: CVE-2026-32056 |
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class) ### Summary `system.run` environment sanitization allowed shell-startup env overrides … |
Vulnerable |
|
CVE-2026-22174
Aliases: GHSA-v3j7-34xh-6g3w |
OpenClaw Loopback CDP probe can leak Gateway token to local listener A local process can capture the OpenClaw Gateway auth … |
Vulnerable Vulnerable |
|
CVE-2026-32010
Aliases: GHSA-4gc7-qcvf-38wg |
In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program This issue applies to a **non-default configuration** … |
Vulnerable Vulnerable |
|
CVE-2026-32897
Aliases: GHSA-v6x2-2qvm-6gv8 |
OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback - Auth-secret dual-use across security domains (gateway … |
Vulnerable Vulnerable |
|
GHSA-4cqv-h74h-93j4
|
OpenClaw has a Discord `allowFrom` slug-collision authorization bypass OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching … |
Vulnerable Vulnerable |
|
GHSA-659f-22xc-98f2
|
OpenClaw hook transform path containment missed symlink-resolved escapes When an attacker can cause a transform module path to reference a … |
Vulnerable Vulnerable |
|
GHSA-8mr2-f9wf-hcfq
|
Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback ### Duplicate Advisory This advisory … |
Vulnerable Vulnerable |
|
GHSA-2hfg-4fh4-qp7f
Aliases: CVE-2026-53812 |
OpenClaw's browser act interactions could bypass private-network navigation checks ### Summary OpenClaw's browser control SSRF checks blocked direct navigation to … |
Vulnerable |
|
GHSA-3c6j-hq33-3jv4
Aliases: CVE-2026-53816 |
OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance ### Summary OpenClaw nodes send lifecycle events back to … |
Vulnerable |
|
GHSA-3qg8-hq7j-jj33
|
Duplicate Advisory: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-gwcq-453v-2frr
|
Duplicate Advisory: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-hw9r-h9mr-4jff
|
OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates ### Summary Some internal command handlers require `operator.approvals` or … |
Vulnerable |
|
GHSA-hx4v-668p-g2qr
|
Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-mgq6-vr84-7m2j
Aliases: CVE-2026-35630 |
OpenClaw: QQBot native approval buttons did not enforce configured approver identity ### Summary OpenClaw's QQBot channel can deliver native approval … |
Vulnerable Vulnerable |
|
GHSA-mhq8-78pj-5j79
Aliases: CVE-2026-53831 |
OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion ### Summary On POSIX nodes, OpenClaw's `system.run` safe-bin … |
Vulnerable Vulnerable |
|
GHSA-qjpc-qf9m-xwmr
|
OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing ### Summary In trusted-proxy Control UI mode, OpenClaw accepted a … |
Vulnerable |
|
GHSA-rggc-m335-3wvj
Aliases: CVE-2026-53832 |
OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers ### Summary Same-host trusted-proxy deployments could accept local forged identity … |
Vulnerable Vulnerable |
|
GHSA-v6r2-jh58-xx6w
Aliases: CVE-2026-53810 |
OpenClaw's marketplace runtime extension metadata could point at unscanned payloads ### Summary Marketplace runtime extension metadata could point at unscanned … |
Vulnerable |
|
GHSA-xww8-gqvh-92x9
|
OpenClaw: Exec approval display truncation could hide the command being approved ### Summary OpenClaw exec approvals could show a shortened … |
Vulnerable |
|
GHSA-2j8v-hwgc-x698
|
OpenClaw: Shell wrapper argv could change between approval and execution Shell wrapper argv could change between approval and execution. In … |
Vulnerable |
|
GHSA-2hm8-rqrm-xfjq
|
OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows ## Summary In authenticated non-owner DM sessions, … |
Vulnerable |
|
GHSA-3x3x-h76w-hp98
Aliases: CVE-2026-32017 |
OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write ### Summary OpenClaw `exec` allowlist/safeBins policy could be bypassed … |
Vulnerable |
|
GHSA-5gqg-mqh5-2v39
|
Duplicate Advisory: OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling ## Duplicate Advisory … |
Vulnerable |
|
GHSA-7fcc-cw49-xm78
Aliases: CVE-2026-32000 |
OpenClaw has command injection via Windows shell fallback in Lobster tool execution ## Summary The Lobster extension tool execution path … |
Vulnerable |
|
GHSA-c6hr-w26q-c636
Aliases: CVE-2026-22178 |
OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction ## Summary `extensions/feishu/src/bot.ts` constructed `new RegExp()` … |
Vulnerable |
|
GHSA-ff98-w8hj-qrxf
|
OpenClaw plugin runtime command execution is part of trusted plugin boundary ### Summary OpenClaw plugins/extensions run in-process and are treated … |
Vulnerable |
|
GHSA-gq83-8q7q-9hfx
Aliases: CVE-2026-32018 |
OpenClaw's serialize sandbox registry writes to prevent races and delete-rollback corruption ## Impact Concurrent `updateRegistry`/`removeRegistryEntry` operations for sandbox containers and … |
Vulnerable |
|
GHSA-mqr9-vqhq-3jxw
Aliases: CVE-2026-31994 |
OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling ### Summary OpenClaw Windows Scheduled … |
Vulnerable |
|
GHSA-pfv7-rr5m-qmv6
|
OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint ### Summary When the optional Chrome extension relay is … |
Vulnerable |
|
GHSA-vj3g-5px3-gr46
Aliases: CVE-2026-22171 |
OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir() ## Summary OpenClaw’s Feishu media download … |
Vulnerable |
|
GHSA-vvjh-f6p9-5vcf
|
ZDI-CAN-29311: OpenClaw Canvas Authentication Bypass Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the … |
Vulnerable |
|
GHSA-x9cf-3w63-rpq9
Aliases: CVE-2026-32030 |
OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia ### Summary When iMessage remote attachment fetching is enabled (`channels.imessage.remoteHost`), `stageSandboxMedia` accepted … |
Vulnerable |
|
GHSA-xjj9-2w6f-jg55
|
Duplicate Advisory: OpenClaw safeBins file-existence oracle information disclosure ### Duplicate Advisory This advisory has been withdrawn because it is a … |
Vulnerable |
|
CVE-2026-22176
Aliases: GHSA-pj5x-38rw-6fph |
OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation A command injection vulnerability existed … |
Vulnerable Vulnerable |
|
CVE-2026-27485
Aliases: GHSA-r6h2-5gqq-v5v6 |
OpenClaw: Reject symlinks in local skill packaging script - Potential unintentional disclosure of local files from the packaging machine into … |
Vulnerable Vulnerable |
|
CVE-2026-27488
Aliases: GHSA-w45g-5746-x9fp |
OpenClaw hardened cron webhook delivery against SSRF ## Affected Packages / Versions - `openclaw` npm package versions `<= 2026.2.17`. ## … |
Vulnerable Vulnerable |
|
CVE-2026-27576
Aliases: GHSA-cxpw-2g23-2vgw |
OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs - Local ACP sessions … |
Vulnerable Vulnerable |
|
CVE-2026-31996
Aliases: GHSA-4685-c5cp-vp95 |
OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags `tools.exec.safeBins` could be bypassed for filesystem access when `sort` … |
Vulnerable Vulnerable |
|
CVE-2026-4040
Aliases: GHSA-6c9j-x93c-rw6j |
OpenClaw safeBins file-existence oracle information disclosure An information disclosure vulnerability in OpenClaw's `tools.exec.safeBins` approval flow allowed a file-existence oracle. When … |
Vulnerable Vulnerable |
|
GHSA-2mc2-g238-722j
|
OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation) Remote iMessage attachment fetches used SCP … |
Vulnerable Vulnerable |
|
GHSA-2hv5-4h3g-4hjv
|
Duplicate Advisory: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-2xp4-qhr4-xqm2
|
Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-5799-3xg7-rfrv
|
Duplicate Advisory: OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-5mh4-3rv3-fpcf
|
Duplicate Advisory: OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-7vq9-42cc-33j4
|
Duplicate Advisory: OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-8pf2-vj79-4wxg
|
Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-cw28-63x4-37c3
|
Duplicate Advisory: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-fjm8-mgc9-mf65
|
Duplicate Advisory: OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-jx3c-247h-cxwp
|
Duplicate Advisory: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-m958-864j-xq5w
|
Duplicate Advisory: OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-pr66-whqj-rq5p
|
Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-qgp3-3rj7-qqq4
|
Duplicate Advisory: OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-w9f5-8q83-qwpx
|
Duplicate Advisory: OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting ### Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-wpc6-37g7-8q4w
Aliases: CVE-2026-41392 |
OpenClaw: Shell init-file options could satisfy exec allowlist script matching ## Summary Before OpenClaw 2026.3.31, exec allowlist matching could treat … |
Vulnerable |
|
GHSA-wwc3-c577-533m
|
Duplicate Advisory: OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation ### Duplicate Advisory This advisory has … |
Vulnerable |
|
CVE-2026-41296
Aliases: GHSA-9p3r-hh9g-5cmg |
OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile Sandbox escape via TOCTOU race in remote FS bridge … |
Vulnerable Vulnerable |
|
CVE-2026-41297
Aliases: GHSA-vjx8-8p7h-82gr |
OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection Marketplace Plugin Download Follows Redirects Without SSRF Protection |
Vulnerable Vulnerable |
|
CVE-2026-41300
Aliases: GHSA-9f4w-67g7-mqwv |
OpenClaw: Endpoint persists after trust decline, leaking gateway credentials Remote onboarding preserves attacker-discovered endpoint after trust decline, routing gateway credentials … |
Vulnerable Vulnerable |
|
CVE-2026-41302
Aliases: GHSA-9q7v-8mr7-g23p |
OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery SSRF via Unguarded `fetch()` in Marketplace Plugin … |
Vulnerable Vulnerable |
|
CVE-2026-41329
Aliases: GHSA-g5cg-8x5w-7jpm |
OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation |
Vulnerable Vulnerable |
|
CVE-2026-41330
Aliases: GHSA-9gp8-hjxr-6f34 |
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls Host exec environment overrides miss proxy, TLS, … |
Vulnerable Vulnerable |
|
CVE-2026-41331
Aliases: GHSA-m6fx-m8hc-572m |
OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders Telegram audio preflight transcription enables resource consumption by unauthorized … |
Vulnerable Vulnerable |
|
CVE-2026-41333
Aliases: GHSA-6p8r-6m93-557f |
OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting Fake DeviceToken Bypasses Shared Auth Rate Limiting |
Vulnerable Vulnerable |
|
CVE-2026-41335
Aliases: GHSA-hr8g-2q7x-3f4w |
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability OpenClaw Gateway Control Interface Information Disclosure Vulnerability |
Vulnerable Vulnerable |
|
CVE-2026-41336
Aliases: GHSA-3qpv-xf3v-mm45 |
OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code Workspace `.env` can override the bundled … |
Vulnerable Vulnerable |
|
CVE-2026-41337
Aliases: GHSA-89r3-6x4j-v7wf |
OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection Voice-call Plivo replay mutates in-process callback origin before replay … |
Vulnerable Vulnerable |
|
CVE-2026-41341
Aliases: GHSA-6336-qqw9-v6x6 |
OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message Discord Component Interaction Misclassifies Group DM as Direct Message |
Vulnerable Vulnerable |
|
CVE-2026-41343
Aliases: GHSA-qcc3-jqwp-5vh2 |
OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification LINE webhook handler lacks shared pre-auth concurrency budget … |
Vulnerable Vulnerable |
|
CVE-2026-41347
Aliases: GHSA-mhr7-2xmv-4c4q |
OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode HTTP operator endpoints lack browser-origin validation in trusted-proxy mode |
Vulnerable Vulnerable |
|
CVE-2026-41348
Aliases: GHSA-rvvf-6vh3-9j43 |
OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist Discord Slash Commands Bypass Group DM Channel Allowlist |
Vulnerable Vulnerable |
|
CVE-2026-41351
Aliases: GHSA-37v6-fxx8-xjmx |
OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding |
Vulnerable Vulnerable |
|
CVE-2026-41352
Aliases: GHSA-xj9w-5r6q-x6v4 |
OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md Device-Paired Node Skips Node Scope Gate → Host RCE.md |
Vulnerable Vulnerable |
|
CVE-2026-41356
Aliases: GHSA-rfqg-qgf8-xr9x |
OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation Gateway `device.token.rotate` does not terminate active WebSocket sessions … |
Vulnerable Vulnerable |
|
CVE-2026-41364
Aliases: GHSA-fv94-qvg8-xqpw |
OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host SSH sandbox tar upload follows symlinks, … |
Vulnerable Vulnerable |
|
CVE-2026-41365
Aliases: GHSA-chfm-xgc4-47rj |
OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API MSTeams thread history bypasses sender allowlist via Graph API |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-9q8j-chc7-wpgp
|
Duplicate Advisory: OpenClaw session transcript files were created without forced user-only permissions ### Duplicate Advisory This advisory has been withdrawn … | |
|
GHSA-56pc-6hvp-4gv4
|
OpenClaw vulnerable to arbitrary file read via $include directive ## Vulnerability Path traversal in config `$include` resolution allowed arbitrary local … |
CVE-2026-32061
|
|
GHSA-vr7j-g7jv-h5mp
|
OpenClaw session transcript files were created without forced user-only permissions `openclaw` created new session transcript JSONL files with overly broad … |
CVE-2026-33572
|
|
GHSA-vr7j-g7jv-h5mp
|
OpenClaw session transcript files were created without forced user-only permissions `openclaw` created new session transcript JSONL files with overly broad … | |
|
GHSA-56pc-6hvp-4gv4
|
OpenClaw vulnerable to arbitrary file read via $include directive A successful exploit can expose local secrets and credentials readable by … |