Search for packages
| purl | pkg:npm/openclaw@2026.3.13 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-xmxx-7p24-h892
Aliases: CVE-2026-43585 |
OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation ## Summary Gateway HTTP and WebSocket handlers captured the resolved … |
Vulnerable |
|
GHSA-cw28-63x4-37c3
|
Duplicate Advisory: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-m34q-h93w-vg5x
Aliases: CVE-2026-41383 |
OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped ## Summary Before OpenClaw 2026.4.2, the OpenShell … |
Vulnerable |
|
GHSA-f3h5-h452-vp3j
|
OpenClaw: Nostr profile mutation routes allowed operator.write config persistence ## Summary Nostr profile mutation routes allowed operator.write config persistence. ## … |
Vulnerable |
|
GHSA-j4c5-89f5-f3pm
|
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-394x-274p-mqc6
|
Duplicate Advisory: OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-rxmx-g7hr-8mx4
Aliases: CVE-2026-41354 |
OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders ## Summary Before OpenClaw 2026.4.2, Zalo webhook replay … |
Vulnerable |
|
GHSA-w8g9-x8gx-crmm
Aliases: CVE-2026-42430 |
OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable ## Impact Strict browser SSRF bypass in … |
Vulnerable |
|
GHSA-wwfp-w96m-c6x8
Aliases: CVE-2026-41346 |
OpenClaw: Pairing pending-request caps were enforced per channel instead of per account ## Summary Before OpenClaw 2026.3.31, pending pairing-request caps … |
Vulnerable |
|
GHSA-7g8c-cfr3-vqqr
Aliases: CVE-2026-43534 |
OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input ## Summary Agent hook events could enqueue … |
Vulnerable |
|
GHSA-68v4-hmwv-f43h
|
OpenClaw: Media download follows cross-origin redirects with Authorization headers intact ## Summary Media download follows cross-origin redirects with Authorization headers … |
Vulnerable |
|
GHSA-jf25-7968-h2h5
Aliases: CVE-2026-43567 |
OpenClaw: screen_record outPath bypassed workspace-only filesystem guard ## Summary screen_record outPath bypassed workspace-only filesystem guard. ## Affected Packages / Versions … |
Vulnerable |
|
GHSA-f6pf-4gjx-c94r
|
OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read ## Summary OpenClaw <= 2026.3.24 Media Parsing Path Traversal to … |
Vulnerable |
|
GHSA-82qx-6vj7-p8m2
Aliases: CVE-2026-43571 |
OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows ## Summary Channel setup catalog lookups could include untrusted … |
Vulnerable |
|
GHSA-f693-58pc-2gfr
|
OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts ## Summary Telegram legacy allowFrom migration fans default-account … |
Vulnerable |
|
GHSA-v3qc-wrwx-j3pw
|
OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch` ## Summary Agentic Consent Bypass: LLM … |
Vulnerable |
|
GHSA-qrp5-gfw2-gxv4
|
OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-mhr7-2xmv-4c4q
Aliases: CVE-2026-41347 |
OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode ## Summary HTTP operator endpoints lack browser-origin validation in trusted-proxy … |
Vulnerable |
|
GHSA-527m-976r-jf79
Aliases: CVE-2026-43573 |
OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement ## Summary Existing-session browser interaction routes bypassed SSRF policy enforcement. ## … |
Vulnerable |
|
GHSA-939r-rj45-g2rj
Aliases: CVE-2026-43569 |
OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins ## Summary Workspace provider auth choices could auto-enable untrusted provider … |
Vulnerable |
|
GHSA-9p3r-hh9g-5cmg
Aliases: CVE-2026-41296 |
OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile ## Summary Sandbox escape via TOCTOU race in remote … |
Vulnerable |
|
GHSA-rm5c-4rmf-vvhw
|
OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses ## Summary Sandbox file operations use check-then-act, bypassing fd-based TOCTOU … |
Vulnerable |
|
GHSA-5mh4-3rv3-fpcf
|
Duplicate Advisory: OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-5wj5-87vq-39xm
Aliases: CVE-2026-42432 |
OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement ## Impact Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope … |
Vulnerable |
|
GHSA-h2v7-xc88-xx8c
Aliases: CVE-2026-41375 |
OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels ## Summary `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check … |
Vulnerable |
|
GHSA-q2gc-xjqw-qp89
Aliases: CVE-2026-42423 |
OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts ## Impact strictInlineEval explicit-approval boundary bypassed … |
Vulnerable |
|
GHSA-m563-373q-885c
|
Duplicate Advisory: OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on … |
Vulnerable |
|
GHSA-3vvq-q2qc-7rmp
Aliases: CVE-2026-42428 |
OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification ## Impact B-M3: ClawHub package downloads are not enforced … |
Vulnerable |
|
GHSA-pr66-whqj-rq5p
|
Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-536q-mj95-h29h
Aliases: CVE-2026-43580 |
OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage ## Summary Browser press/type interaction routes missed complete navigation guard … |
Vulnerable |
|
GHSA-j56c-wpqm-h24x
|
Duplicate Advisory: OpenClaw: Plivo V2 verified replay identity drifts on query-only variants ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-7wv4-cc7p-jhxc
Aliases: CVE-2026-43531 |
OpenClaw: Workspace .env could inject OpenClaw runtime-control variables ## Summary Workspace .env could inject OpenClaw runtime-control variables. ## Affected Packages … |
Vulnerable |
|
GHSA-7vq9-42cc-33j4
|
Duplicate Advisory: OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-3fv3-6p2v-gxwj
Aliases: CVE-2026-41914 |
OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths ## Impact QQ Bot Extension: Missing SSRF Protection … |
Vulnerable |
|
GHSA-xrq9-jm7v-g9h7
|
OpenClaw: Paired-device pairing actions were not limited to the caller device ## Affected Packages / Versions - Package: `openclaw` (npm) … |
Vulnerable |
|
GHSA-8j7f-g9gv-7jhc
|
Duplicate Advisory: OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476) ### Duplicate Advisory … |
Vulnerable |
|
GHSA-cwq8-6f96-g3q4
Aliases: CVE-2026-41377 |
OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open) ## Summary Security Scan Failure Does Not Block Plugin Installation … |
Vulnerable |
|
GHSA-8pf2-vj79-4wxg
|
Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-cm8v-2vh9-cxf3
Aliases: CVE-2026-41915 |
OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant) ## Impact GIT_DIR and related … |
Vulnerable |
|
GHSA-8h8f-7cxm-m38j
|
Duplicate Advisory: OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-mf69-r24q-ghhr
|
Duplicate Advisory: OpenClaw: Pairing pending-request caps were enforced per channel instead of per account ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-qgx9-6px9-7p75
|
Duplicate Advisory: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-vjx8-8p7h-82gr
Aliases: CVE-2026-41297 |
OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection ## Summary Marketplace Plugin Download Follows Redirects Without SSRF Protection ## … |
Vulnerable |
|
GHSA-g8mc-c5f2-mqg7
|
Duplicate Advisory: OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-89r3-6x4j-v7wf
Aliases: CVE-2026-41337 |
OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection ## Summary Voice-call Plivo replay mutates in-process callback origin … |
Vulnerable |
|
GHSA-x2m8-53h4-6hch
Aliases: CVE-2026-41382 |
OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps ## Summary Discord voice ingress … |
Vulnerable |
|
GHSA-6p8r-6m93-557f
Aliases: CVE-2026-41333 |
OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting ## Summary Fake DeviceToken Bypasses Shared Auth Rate Limiting ## Current Maintainer … |
Vulnerable |
|
GHSA-w9j9-w4cp-6wgr
|
## Impact OpenClaw Host-Exec Environment Variable Injection. Host exec could inherit environment variables that influence interpreters, shells, or build tools. … |
Vulnerable |
|
GHSA-4g5x-2jfc-xm98
Aliases: CVE-2026-41408 |
OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk ## Summary Tlon media downloads can bypass core … |
Vulnerable |
|
GHSA-8f9r-gr6r-x63q
|
Duplicate Advisory: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-9q7v-8mr7-g23p
Aliases: CVE-2026-41302 |
OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery ## Summary SSRF via Unguarded `fetch()` in … |
Vulnerable |
|
GHSA-jf56-mccx-5f3f
|
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel ## Impact Authenticated `/hooks/wake` and … |
Vulnerable |
|
GHSA-jj6q-rrrf-h66h
Aliases: CVE-2026-41407 |
OpenClaw: Shared-secret comparison call sites leaked length information through timing ## Summary Before OpenClaw 2026.4.2, several shared-secret comparison call sites … |
Vulnerable |
|
GHSA-3xv9-89fm-7h4r
Aliases: CVE-2026-41403 |
OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled ## Summary diffs viewer misclassifies proxied remote … |
Vulnerable |
|
GHSA-hm63-vwj4-mj2q
|
Duplicate Advisory: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-2w79-r9g8-wmcr
Aliases: CVE-2026-41400 |
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062) ## Summary Incomplete fix for CVE-2026-32062: … |
Vulnerable |
|
GHSA-rfqg-qgf8-xr9x
Aliases: CVE-2026-41356 |
OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation ## Summary Gateway `device.token.rotate` does not terminate active … |
Vulnerable |
|
GHSA-4f8g-77mw-3rxc
Aliases: CVE-2026-42429 |
OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write` ## Impact Gateway plugin HTTP `auth: gateway` … |
Vulnerable |
|
GHSA-j42q-r6qx-xrfp
|
Duplicate Advisory: OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName ## Duplicate Advisory This advisory … | There are no reported fixed by versions. |
|
GHSA-wpc6-37g7-8q4w
Aliases: CVE-2026-41392 |
OpenClaw: Shell init-file options could satisfy exec allowlist script matching ## Summary Before OpenClaw 2026.3.31, exec allowlist matching could treat … |
Vulnerable |
|
GHSA-2f7j-rp58-mr42
Aliases: CVE-2026-41339 |
OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients ## Summary Before OpenClaw 2026.4.2, the Gateway … |
Vulnerable |
|
GHSA-2767-2q9v-9326
Aliases: CVE-2026-43526 |
OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes ## Summary QQBot reply media URL handling … |
Vulnerable |
|
GHSA-cmfr-9m2r-xwhq
Aliases: CVE-2026-42431 |
## Impact OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard. node.invoke(browser.proxy) could mutate persistent browser profiles through a path that bypassed … |
Vulnerable |
|
GHSA-cwf8-44x6-32c2
Aliases: CVE-2026-41397 |
OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal ## Summary OpenShell Mirror Sync: Sandbox … |
Vulnerable |
|
GHSA-7jp6-r74r-995q
Aliases: CVE-2026-42433 |
OpenClaw: Matrix profile config persistence was reachable from operator.write message tools ## Summary Matrix profile config persistence was reachable from … |
Vulnerable |
|
GHSA-whf9-3hcx-gq54
Aliases: CVE-2026-42422 |
## Impact OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing. Device token rotation could mint or preserve … |
Vulnerable |
|
GHSA-fvx6-pj3r-5q4q
Aliases: CVE-2026-34425 |
OpenClaw's complex interpreter pipelines could skip exec script preflight validation ## Summary Before OpenClaw 2026.4.2, exec script preflight validation could … |
Vulnerable |
|
GHSA-qmwg-qprg-3j38
|
OpenClaw: Browser interaction routes could pivot into local CDP and regain file reads ## Summary Browser interaction routes could pivot … |
Vulnerable |
|
GHSA-chfm-xgc4-47rj
Aliases: CVE-2026-41365 |
OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API ## Summary MSTeams thread history bypasses sender allowlist via Graph … |
Vulnerable |
|
GHSA-6477-wvjj-47v6
|
Duplicate Advisory: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-7437-7hg8-frrw
Aliases: CVE-2026-42427 |
OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class) … |
Vulnerable |
|
GHSA-f934-5rqf-xx47
|
OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths ## Summary The QMD backend `memory_get` read path accepted … |
Vulnerable |
|
GHSA-xh72-v6v9-mwhc
Aliases: CVE-2026-44109 |
OpenClaw: Feishu webhook and card-action validation now fail closed ## Summary Feishu webhook mode accepted missing `encryptKey` configuration as valid … |
Vulnerable |
|
GHSA-53vx-pmqw-863c
Aliases: CVE-2026-43527 |
OpenClaw: Browser SSRF policy default allowed private-network navigation ## Summary Browser SSRF policy default allowed private-network navigation. ## Affected Packages … |
Vulnerable |
|
GHSA-p464-m8x6-vhv8
Aliases: CVE-2026-41405 |
OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion ## Summary MS Teams webhook parses body … |
Vulnerable |
|
GHSA-vfp4-8x56-j7c5
Aliases: CVE-2026-43584 |
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables ## Summary Exec environment denylist missed high-risk interpreter startup variables. ## … |
Vulnerable |
|
GHSA-r4c2-gq3j-7rpj
|
Duplicate Advisory: OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret ## Duplicate Advisory This … | There are no reported fixed by versions. |
|
GHSA-mhgq-xpfq-6r66
Aliases: CVE-2026-41394 |
OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes ## Summary Unauthenticated plugin-auth HTTP routes receive operator runtime scopes ## … |
Vulnerable |
|
GHSA-5fc7-f62m-8983
Aliases: CVE-2026-41911 |
OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix) ## Impact Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy … |
Vulnerable |
|
GHSA-j9pv-rrcj-6pfx
|
OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes ## Summary SSH-based sandbox backends pass unsanitized process.env to child … |
Vulnerable |
|
GHSA-fqrj-m88p-qf3v
|
OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets ## Summary Before OpenClaw 2026.3.31, the Zalo webhook … |
Vulnerable |
|
GHSA-qcj9-wwgw-6gm8
Aliases: CVE-2026-41396 |
OpenClaw: Workspace `.env` can override the bundled plugin trust root ## Summary Workspace `.env` can override the bundled plugin trust … |
Vulnerable |
|
GHSA-f5fm-9jmp-c88r
|
Duplicate Advisory: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-525j-hqq2-66r4
|
OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0 ## Summary Sandbox browser CDP relay could expose DevTools … |
Vulnerable |
|
GHSA-c4qg-j8jg-42q5
Aliases: CVE-2026-44117 |
OpenClaw: QQBot direct media upload skipped URL SSRF validation ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-wcm7-94wg-h74h
|
Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-846p-hgpv-vphc
|
OpenClaw: QQ Bot structured payloads could read arbitrary local files ## Summary Before OpenClaw 2026.4.2, QQ Bot structured media payloads … |
Vulnerable |
|
GHSA-hhq4-97c2-p447
Aliases: CVE-2026-41402 |
OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass ## Summary Zalo webhook replay cache cross-target messageId scope bypass ## … |
Vulnerable |
|
GHSA-rf75-g96h-j3rm
|
Duplicate Advisory: OpenClaw's complex interpreter pipelines could skip exec script preflight validation ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-vr5g-mmx7-h897
Aliases: CVE-2026-41912 |
OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation ## Impact Browser SSRF Policy Bypass via Interaction-Triggered Navigation. Browser interactions … |
Vulnerable |
|
GHSA-hr8g-2q7x-3f4w
Aliases: CVE-2026-41335 |
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability ## Summary OpenClaw Gateway Control Interface Information Disclosure Vulnerability ## Current … |
Vulnerable |
|
GHSA-2xp4-qhr4-xqm2
|
Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-42mx-vp8m-j7qh
Aliases: CVE-2026-41355 |
OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host … |
Vulnerable |
|
GHSA-67mf-f936-ppxf
Aliases: CVE-2026-42426 |
## Impact OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval. The pairing approval method accepted … |
Vulnerable |
|
GHSA-gfg9-5357-hv4c
|
OpenClaw: Webchat audio embedding could read local files without local-root containment ## Impact OpenClaw deployments before `2026.4.15` could embed host-local … |
Vulnerable |
|
GHSA-xq94-r468-qwgj
Aliases: CVE-2026-43582 |
OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding ## Summary Browser SSRF hostname validation could be bypassed … |
Vulnerable |
|
GHSA-gjm7-hw8f-73rq
Aliases: CVE-2026-41378 |
OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch ## Summary Paired node escalates to gateway RCE … |
Vulnerable |
|
GHSA-jjw7-3vjf-fg5j
Aliases: CVE-2026-41385 |
## Summary OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get ## Current Maintainer Triage - Status: … |
Vulnerable |
|
GHSA-qgp3-3rj7-qqq4
|
Duplicate Advisory: OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-p6j4-wvmc-vx2h
|
Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-66r7-m7xm-v49h
Aliases: CVE-2026-43533 |
OpenClaw: QQBot media tags could read arbitrary local files through reply text ## Summary QQBot media tags could read arbitrary … |
Vulnerable |
|
GHSA-w9f5-8q83-qwpx
|
Duplicate Advisory: OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting ### Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-g8xp-qx39-9jq9
Aliases: CVE-2026-41373 |
OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides ## Summary Incomplete `host-env-security-policy.json` allows untrusted model … |
Vulnerable |
|
GHSA-ch86-pxr9-j9h9
|
Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-j6c7-3h5x-99g9
Aliases: CVE-2026-42435 |
OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms ## Summary Shell-wrapper detection missed env-argv assignment injection forms. ## Affected Packages … |
Vulnerable |
|
GHSA-qqq7-4hxc-x63c
Aliases: CVE-2026-42424 |
OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration ## Impact Shared … |
Vulnerable |
|
GHSA-fjm8-mgc9-mf65
|
Duplicate Advisory: OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-68x5-xx89-w9mm
Aliases: CVE-2026-41916 |
OpenClaw: resolvedAuth closure becomes stale after config reload ## Impact resolvedAuth closure becomes stale after config reload. After a config … |
Vulnerable |
|
GHSA-gfmx-pph7-g46x
|
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` … |
Vulnerable |
|
GHSA-36cp-mh65-x882
|
Duplicate Advisory: OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-cqgw-44wg-44rf
Aliases: CVE-2026-41381 |
OpenClaw: Discord voice manager bypasses channel-level member access allowlist ## Summary Discord voice manager bypasses channel-level member access allowlist ## … |
Vulnerable |
|
GHSA-72q8-jcmc-97wx
|
OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy ## Affected Packages / Versions - Package: `openclaw` (npm) - … |
Vulnerable |
|
GHSA-9gvx-vj57-vqqx
|
Duplicate Advisory: OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-vc32-h5mq-453v
Aliases: CVE-2026-41910 |
OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes ## Impact /allowlist omits owner-only enforcement for cross-channel allowlist writes. An … |
Vulnerable |
|
GHSA-v3c2-39fm-jq4h
|
Duplicate Advisory: OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose` ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-m5jp-p3r5-mfqp
|
Duplicate Advisory: OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-63mg-xp9j-jfcm
Aliases: CVE-2026-33578 |
OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade ## Summary When only a route-level group allowlist … |
Vulnerable |
|
GHSA-fh32-73r9-rgh5
Aliases: CVE-2026-41372 |
OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections ## Summary Before OpenClaw 2026.4.2, remote CDP discovery could return … |
Vulnerable |
|
GHSA-xj9w-5r6q-x6v4
Aliases: CVE-2026-41352 |
OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md ## Summary Device-Paired Node Skips Node Scope Gate → Host … |
Vulnerable |
|
GHSA-3q42-xmxv-9vfr
Aliases: CVE-2026-41379 |
OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send ## Summary Gateway operator.write Can Reach Admin-Class Talk … |
Vulnerable |
|
GHSA-92jp-89mq-4374
|
OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials ## Summary Sandbox noVNC helper route exposed interactive browser session … |
Vulnerable |
|
GHSA-7hrg-5w46-5r2x
|
Duplicate Advisory: OpenClaw: Slack thread context could include messages from non-allowlisted senders ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-q9w8-cf67-r238
Aliases: CVE-2026-41393 |
OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration ## Summary macOS Wide-Area Discovery Accepts Arbitrary Tailnet Peer as DNS Authority … |
Vulnerable |
|
GHSA-c28g-vh7m-fm7v
Aliases: CVE-2026-44991 |
OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners ## Impact OpenClaw deployments before `2026.4.21` could treat a … |
Vulnerable |
|
GHSA-gv2f-q4wp-fvh5
|
Duplicate Advisory: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-p4x4-2r7f-wjxg
Aliases: CVE-2026-41380 |
OpenClaw gateway exec allow-always over-trusts positional carrier executables ## Summary Allow-always persistence could trust wrapper carrier executables instead of the … |
Vulnerable |
|
GHSA-5hff-46vh-rxmw
Aliases: CVE-2026-41298 |
OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill ## Summary Before OpenClaw 2026.4.2, `POST /sessions/:sessionKey/kill` did not enforce … |
Vulnerable |
|
GHSA-v8qf-fr4g-28p2
Aliases: CVE-2026-41908 |
OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization ## Affected Packages / Versions - Package: `openclaw` (npm) - … |
Vulnerable |
|
GHSA-767m-xrhc-fxm7
Aliases: CVE-2026-41359 |
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send ## Summary Gateway operator.write Can Reach Admin-Class … |
Vulnerable |
|
GHSA-2j53-2c28-g9v2
|
Duplicate Advisory: OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-2x4x-cc5g-qmmg
Aliases: CVE-2026-33577 |
OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes ## Summary The node pairing approval path did … |
Vulnerable |
|
GHSA-4p4f-fc8q-84m3
Aliases: CVE-2026-41398 |
OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch ## Summary Before OpenClaw 2026.4.2, the iOS A2UI bridge … |
Vulnerable |
|
GHSA-49cg-279w-m73x
Aliases: CVE-2026-43574 |
OpenClaw: Empty approver lists could grant explicit approval authorization ## Summary Empty approver lists could grant explicit approval authorization. ## … |
Vulnerable |
|
GHSA-6336-qqw9-v6x6
Aliases: CVE-2026-41341 |
OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message ## Summary Discord Component Interaction Misclassifies Group DM as Direct … |
Vulnerable |
|
GHSA-8372-7vhw-cm6q
Aliases: CVE-2026-43528 |
OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases ## Summary config.get redaction bypass through sourceConfig and runtimeConfig aliases. ## … |
Vulnerable |
|
GHSA-gj9q-8w99-mp8j
Aliases: CVE-2026-43529 |
OpenClaw: TOCTOU read in exec script preflight ## Summary OpenClaw's exec script preflight validator previously validated and then read a … |
Vulnerable |
|
GHSA-qcc3-jqwp-5vh2
Aliases: CVE-2026-41343 |
OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification ## Summary LINE webhook handler lacks shared pre-auth … |
Vulnerable |
|
GHSA-rvvf-6vh3-9j43
Aliases: CVE-2026-41348 |
OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist ## Summary Discord Slash Commands Bypass Group DM Channel Allowlist ## … |
Vulnerable |
|
GHSA-2xcp-x87w-q377
Aliases: CVE-2026-45002 |
OpenClaw: Hook mapping templates could bypass hook session-key opt-in ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-fv94-qvg8-xqpw
Aliases: CVE-2026-41364 |
OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host ## Summary SSH sandbox tar upload … |
Vulnerable |
|
GHSA-g5cg-8x5w-7jpm
Aliases: CVE-2026-41329 |
OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation ## Summary Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation ## … |
Vulnerable |
|
GHSA-57gh-m6rq-54cf
|
OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration ## Summary Media Local Roots Self-Whitelisting in `appendLocalMediaParentRoots` Allows … |
Vulnerable |
|
GHSA-r7p2-r9g4-4xph
|
Duplicate Advisory: OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-m958-864j-xq5w
|
Duplicate Advisory: OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-r3v5-2grc-429h
|
Duplicate Advisory: OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-25wv-8phj-8p7r
Aliases: CVE-2026-41913 |
OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths ## Impact Concurrent async auth … | There are no reported fixed by versions. |
|
GHSA-2hv5-4h3g-4hjv
|
Duplicate Advisory: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-9gp8-hjxr-6f34
Aliases: CVE-2026-41330 |
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls ## Summary Host exec environment overrides miss … |
Vulnerable |
|
GHSA-98ch-45wp-ch47
|
OpenClaw: Windows-compatible env override keys could bypass system.run approval binding ## Summary Before OpenClaw 2026.4.2, system-run approval binding normalized environment … |
Vulnerable |
|
GHSA-hhff-fj5f-qg48
Aliases: CVE-2026-41374 |
OpenClaw runs Discord audio preflight transcription before member authorization ## Summary Discord audio preflight transcription before member authorization ## Current … |
Vulnerable |
|
GHSA-jwrq-8g5x-5fhm
Aliases: CVE-2026-43535 |
OpenClaw: Collect-mode queue batches could reuse the last sender authorization context ## Summary Collect-mode queue batches could reuse the last … |
Vulnerable |
|
GHSA-cg7q-fg22-4g98
Aliases: CVE-2026-41369 |
OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables ## Summary Host exec environment sanitization … |
Vulnerable |
|
GHSA-58q2-7r52-jq62
|
OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read ## Summary Path traversal via … |
Vulnerable |
|
GHSA-57r2-h2wj-g887
Aliases: CVE-2026-44999 |
OpenClaw: Isolated cron awareness events were recorded as trusted system events ## Affected Packages / Versions - Package: `openclaw` (npm) … |
Vulnerable |
|
GHSA-7ggg-pvrf-458v
Aliases: CVE-2026-41391 |
OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic ## Summary `PIP_INDEX_URL` and `UV_INDEX_URL` bypass … |
Vulnerable |
|
GHSA-g374-mggx-p6xc
Aliases: CVE-2026-41404 |
OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode ## Summary Incomplete scope-clearing fix allows operator.admin escalation via … |
Vulnerable |
|
GHSA-5h3f-885m-v22w
Aliases: CVE-2026-42421 |
OpenClaw: Existing WS sessions survive shared gateway token rotation ## Impact Existing WS sessions survive shared gateway token rotation. Rotating … |
Vulnerable |
|
GHSA-877v-w3f5-3pcq
Aliases: CVE-2026-41406 |
OpenClaw: Feishu thread history and quoted messages bypass sender allowlist ## Summary Feishu thread history and quoted messages bypass sender … |
Vulnerable |
|
GHSA-5799-3xg7-rfrv
|
Duplicate Advisory: OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-m6fx-m8hc-572m
Aliases: CVE-2026-41331 |
OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders ## Summary Telegram audio preflight transcription enables resource consumption … |
Vulnerable |
|
GHSA-7jm2-g593-4qrc
|
OpenClaw: Agent gateway config mutations could change protected operator settings ## Affected Packages / Versions - Package: `openclaw` (npm) - … |
Vulnerable |
|
GHSA-f7fh-qg34-x2xh
Aliases: CVE-2026-43576 |
OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets ## Summary CDP /json/version WebSocket URL could pivot to … |
Vulnerable |
|
GHSA-rg8m-3943-vm6q
Aliases: CVE-2026-41376 |
OpenClaw: Matrix thread root and reply context bypass sender allowlist ## Summary Matrix thread root and reply context bypass sender … |
Vulnerable |
|
GHSA-37v6-fxx8-xjmx
Aliases: CVE-2026-41351 |
OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding ## Summary Telnyx Webhook Replay Detection Bypass via Base64 Signature … |
Vulnerable |
|
GHSA-9f4w-67g7-mqwv
Aliases: CVE-2026-41300 |
OpenClaw: Endpoint persists after trust decline, leaking gateway credentials ## Summary Remote onboarding preserves attacker-discovered endpoint after trust decline, routing … |
Vulnerable |
|
GHSA-mj59-h3q9-ghfh
Aliases: CVE-2026-44995 |
OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config ## Affected Packages / Versions - Package: … |
Vulnerable |
|
GHSA-ccx3-fw7q-rr2r
Aliases: CVE-2026-42420 |
OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks ## Impact Multiple Code Paths Missing Base64 Pre-Allocation Size Checks. Several … |
Vulnerable |
|
GHSA-wwc3-c577-533m
|
Duplicate Advisory: OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-w6wx-jq6j-6mcj
|
OpenClaw: pnpm dlx approvals did not bind local script operands ## Summary Before OpenClaw 2026.4.2, `pnpm dlx` approval planning did … |
Vulnerable |
|
GHSA-w85g-3h6x-4xh2
|
OpenClaw: Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS ## Summary Image pixel-limit guard can fail … |
Vulnerable |
|
GHSA-9jpj-g8vv-j5mf
Aliases: CVE-2026-34511 |
OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter ## Summary Before OpenClaw 2026.4.2, the Gemini OAuth … |
Vulnerable |
|
GHSA-rc8f-r29c-chr6
|
Duplicate Advisory: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-5r8f-96gm-5j6g
|
OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset` ## Summary The `chat.send` path reused command authorization to … |
Vulnerable |
|
GHSA-3qpv-xf3v-mm45
Aliases: CVE-2026-41336 |
OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code ## Summary Workspace `.env` can override … |
Vulnerable |
|
GHSA-83f3-hh45-vfw9
Aliases: CVE-2026-40045 |
OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws:// ## Summary Before OpenClaw 2026.4.2, Android accepted … |
Vulnerable |
|
GHSA-3pm9-5j7m-59vc
Aliases: CVE-2026-41388 |
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config ## Summary Tlon Startup Migration Rehydrates Empty-Array Revocations From File … |
Vulnerable |
|
GHSA-jx3c-247h-cxwp
|
Duplicate Advisory: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-vfw7-6rhc-6xxg
Aliases: CVE-2026-41384 |
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config ## Summary Incomplete Fix for CVE-2026-4039: … |
Vulnerable |
|
GHSA-pg8g-f2hf-x82m
|
Duplicate Advisory: OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-2cq5-mf3v-mx44
Aliases: CVE-2026-43530 |
OpenClaw: busybox and toybox applet execution weakened exec approval binding ## Summary busybox and toybox applet execution weakened exec approval … |
Vulnerable |
|
GHSA-2qrv-rc5x-2g2h
Aliases: CVE-2026-41295 |
OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup ## Summary Before OpenClaw 2026.4.2, built-in channel setup and … |
Vulnerable |
|
GHSA-qxgf-hmcj-3xw3
Aliases: CVE-2026-34504 |
OpenClaw affected by SSRF via unguarded image download in fal provider ## Summary The fal provider used raw fetches for … |
Vulnerable |
|
GHSA-59xc-5v89-r7pr
|
Duplicate Advisory: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-c4qm-58hj-j6pj
Aliases: CVE-2026-42436 |
OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation ## Summary Browser snapshot and screenshot routes … |
Vulnerable |
|
GHSA-fwjq-xwfj-gv75
|
OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations ## Summary `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations ## … |
Vulnerable |
|
GHSA-hxvm-xjvf-93f3
Aliases: CVE-2026-44114 |
OpenClaw: Workspace dotenv could override runtime-control environment variables ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: … |
Vulnerable |
|
GHSA-8rh7-6779-cjqq
Aliases: CVE-2026-41294 |
OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover ## Summary OpenClaw loaded … |
Vulnerable |
|
GHSA-rj2p-j66c-mgqh
Aliases: CVE-2026-42439 |
OpenClaw: Browser tabs action select and close routes bypassed SSRF policy ## Summary Browser tabs action select and close routes … |
Vulnerable |
|
GHSA-qx8j-g322-qj6m
Aliases: CVE-2026-40037 |
OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects ## Impact `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects. A … |
Vulnerable |
|
GHSA-rjxq-qqhf-8hwh
Aliases: CVE-2026-53840 |
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin ### Summary OpenClaw supports remote MCP Streamable … |
Vulnerable |
|
GHSA-v8j2-5f9p-fmh4
|
Duplicate Advisory: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-2hh7-c75g-qj2r
Aliases: CVE-2026-44116 |
OpenClaw validates Zalo outbound photo URLs through the SSRF guard ## Summary Zalo outbound photo URLs are validated through the … |
Vulnerable |
|
GHSA-cjg8-85gj-v9q2
|
Duplicate Advisory: OpenClaw: Feishu webhook and card-action validation now fail closed ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-wppj-c6mr-83jj
Aliases: CVE-2026-44112 |
OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root ## Summary OpenShell FS bridge writes stay pinned … |
Vulnerable |
|
GHSA-w7rc-vvgx-pj45
|
Duplicate Advisory: OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-m5j2-r859-r5cv
|
Duplicate Advisory: OpenClaw: Isolated cron awareness events were recorded as trusted system events ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-p3m6-jr2h-hhxj
|
Duplicate Advisory: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-35vf-vw9f-q3cr
|
Duplicate Advisory: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-9j32-3m66-mc4m
|
Duplicate Advisory: OpenClaw: Hook mapping templates could bypass hook session-key opt-in ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-5h3g-6xhh-rg6p
Aliases: CVE-2026-44113 |
OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes ## Summary OpenShell FS bridge reads … |
Vulnerable |
|
GHSA-p3pv-c954-9m6f
|
Duplicate Advisory: OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-xpr6-2hgm-4wwp
|
Duplicate Advisory: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution ### Duplicate Advisory … |
Vulnerable |
|
GHSA-q8ff-7ffm-m3r9
Aliases: CVE-2026-45005 |
OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload ## Summary OpenClaw webhooks allowed route secrets to be backed by … |
Vulnerable |
|
GHSA-93rg-2xm5-2p9v
|
OpenClaw's Gateway Control UI bootstrap config required Gateway auth ## Summary Gateway Control UI bootstrap config required Gateway auth. ## … |
Vulnerable |
|
GHSA-m8wm-r5vq-qjpg
|
Duplicate Advisory: OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-w626-296m-8f85
|
Duplicate Advisory: OpenClaw's ACP child sessions inherit subagent security envelope constraints ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-5jgm-f9wr-9qm7
|
Duplicate Advisory: OpenClaw: Workspace dotenv files cannot override connector endpoint hosts ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-55cf-xx38-4p9p
Aliases: CVE-2026-45003 |
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts ## Summary Workspace dotenv files cannot override connector endpoint hosts. ## … |
Vulnerable |
|
GHSA-frr5-j3mh-h9ch
|
Duplicate Advisory: OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-xrgf-r9gr-jjjf
|
Duplicate Advisory: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-q3jj-46pq-826r
Aliases: CVE-2026-44997 |
OpenClaw's ACP child sessions inherit subagent security envelope constraints ## Summary ACP child sessions inherit subagent security envelope constraints. ## … |
Vulnerable |
|
GHSA-qm77-8qjp-4vcm
Aliases: CVE-2026-41358 |
OpenClaw: Slack thread context could include messages from non-allowlisted senders ## Summary Before OpenClaw 2026.4.2, Slack thread starter and thread-history … |
Vulnerable |
|
GHSA-wwwc-f646-vj2j
|
Duplicate Advisory: OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-r39h-4c2p-3jxp
Aliases: CVE-2026-45004 |
OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution ## Summary OpenClaw's bundled plugin … |
Vulnerable |
|
GHSA-3r56-7hhr-vfg9
|
Duplicate Advisory: OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-r747-33r4-rmjw
|
Duplicate Advisory: OpenClaw: QQBot direct media upload skipped URL SSRF validation ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-6f72-9gxx-98mj
|
Duplicate Advisory: OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-cwj3-vqpp-pmxr
|
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes ## Summary The agent-facing `gateway` tool protects `config.apply` and `config.patch` … |
Vulnerable |
|
GHSA-r6xh-pqhr-v4xh
Aliases: CVE-2026-44118 |
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens ## Summary MCP loopback owner context is derived from … |
Vulnerable |
|
GHSA-x3h8-jrgh-p8jx
|
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs ## Summary Exec allowlist analysis rejects shell expansion in unquoted … |
Vulnerable |
|
GHSA-9r9j-3r2w-fg3v
|
Duplicate Advisory: OpenClaw: Workspace dotenv could override runtime-control environment variables ### Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-qvmw-h675-h7qg
|
Duplicate Advisory: OpenClaw validates Zalo outbound photo URLs through the SSRF guard ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-jccr-rrw2-vc8h
|
OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure ## Summary The jq safe-bin policy blocked explicit `env` usage … |
Vulnerable |
|
GHSA-wq58-2pvg-5h4f
Aliases: CVE-2026-35660 |
OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers ## Summary Before `v2026.3.23`, the Gateway `agent` RPC accepted … |
Vulnerable |
|
GHSA-gm9m-x74r-8whg
|
Duplicate Advisory: OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-pw7h-9g6p-c378
Aliases: CVE-2026-35649 |
OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation ## Summary Tlon settings reconciliation treated explicit empty allowlists as unset, which … |
Vulnerable |
|
GHSA-rf6h-5gpw-qrgq
Aliases: CVE-2026-35654 |
OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback ## Summary MS Teams Feedback Invoke Bypasses … |
Vulnerable |
|
GHSA-xq8g-hgh6-87hv
Aliases: CVE-2026-35623 |
OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing ## Summary BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force … | There are no reported fixed by versions. |
|
GHSA-6xg4-82hv-cp6f
Aliases: CVE-2026-41299 |
OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing ## Summary ACP-only provenance fields in `chat.send` … |
Vulnerable |
|
GHSA-9hjh-fr4f-gxc4
Aliases: CVE-2026-35663 |
OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin ## Summary Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim … | There are no reported fixed by versions. |
|
GHSA-844j-xrrq-wgh4
Aliases: CVE-2026-35656 |
OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection ## Summary When gateway.trustedProxies was configured, spoofed loopback hops in forwarding headers … |
Vulnerable |
|
GHSA-wv46-v6xc-2qhf
Aliases: CVE-2026-35670 |
OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution. ## Summary Synology Chat reply delivery could rebind … |
Vulnerable |
|
GHSA-94pw-c6m8-p9p9
Aliases: CVE-2026-35621 |
OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send > Fixed in OpenClaw 2026.3.24, the current shipping release. … |
Vulnerable |
|
GHSA-h3x4-hc5v-v2gm
Aliases: CVE-2026-34426 |
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation ## Summary Windows local-media handling accepted remote-host file … |
Vulnerable |
|
GHSA-v8wv-jg3q-qwpq
Aliases: CVE-2026-33581 |
OpenClaw's message tool media parameter bypasses tool policy filesystem isolation ## Summary The message tool accepted `mediaUrl` and `fileUrl` aliases … |
Vulnerable |
|
GHSA-ppwq-6v66-5m6j
|
OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status ## Summary Read-scoped gateway snapshots could expose credentials embedded … |
Vulnerable |
|
GHSA-rqp8-q22p-5j9q
Aliases: CVE-2026-35635 |
OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision ## Summary Synology Chat multi-account configuration could collapse onto … |
Vulnerable |
|
GHSA-fqw4-mph7-2vr8
|
OpenClaw: Silent privilege escalation via gateway shared-auth reconnect ## Summary Gateway local shared-auth reconnect silently widens paired device scope from … | There are no reported fixed by versions. |
|
GHSA-8883-9w57-vwv6
Aliases: CVE-2026-35652 |
OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions ## Summary Mattermost interactive callback dispatch could run action handlers before normal … |
Vulnerable |
|
GHSA-mf5g-6r6f-ghhm
Aliases: CVE-2026-35646 |
OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token ## Summary Synology Chat Webhook Pre-Auth Rate-Limit … |
Vulnerable |
|
GHSA-hggm-x7r9-mm7v
Aliases: CVE-2026-32846 |
OpenClaw is vulnerable to Path Traversal through path validation bypass OpenClaw through 2026.3.23 (fixed in commit 4797bbc) contains a path … |
Vulnerable |
|
GHSA-9wqx-g2cw-vc7r
Aliases: CVE-2026-35647 |
OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers ## Summary Matrix Verification Notices Bypass … | There are no reported fixed by versions. |
|
GHSA-g86v-f9qv-rh6m
|
OpenClaw SSRF guard misses four IPv6 special-use ranges ## Summary The SSRF/IP classifier treated several IPv6 special-use ranges as public … |
Vulnerable |
|
GHSA-4qwc-c7g9-4xcw
Aliases: CVE-2026-35633 |
OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure ## Summary Remote media HTTP error bodies were … |
Vulnerable |
|
GHSA-rhfg-j8jq-7v2h
Aliases: CVE-2026-35629 |
OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476) ## Summary SSRF via Unguarded … |
Vulnerable |
|
GHSA-x2cm-hg9c-mf5w
Aliases: CVE-2026-35662 |
OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions ## Summary Leaf subagents could still use … |
Vulnerable |
|
GHSA-89hr-6x2p-8xjv
|
Duplicate Advisory: OpenClaw's device removal and token revocation do not terminate active WebSocket sessions ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-9528-x887-j2fp
Aliases: CVE-2026-33580 |
OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication ## Summary Nextcloud Talk webhook signature failures were not … |
Vulnerable |
|
GHSA-48vw-m3qc-wr99
|
OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths ## Summary Trusted-proxy Control UI … |
Vulnerable |
|
GHSA-39mp-545q-w789
Aliases: CVE-2026-35620 |
OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy > Fixed in OpenClaw 2026.3.24, the current shipping … |
Vulnerable |
|
GHSA-5h2w-qmfp-ggp6
Aliases: CVE-2026-41344 |
OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose` ## Summary The `chat.send` path let authorized write-scoped callers … |
Vulnerable |
|
GHSA-vcx4-4qxg-mfp4
Aliases: CVE-2026-35628 |
OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret ## Summary Telegram Webhook Missing Guess … | There are no reported fixed by versions. |
|
GHSA-qm9x-v7cx-7rq4
Aliases: CVE-2026-35666 |
OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper ## Summary Allow-always exec approvals did not unwrap … |
Vulnerable |
|
GHSA-j7p2-qcwm-94v4
Aliases: CVE-2026-41387 |
OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides ## Summary Host exec env override sanitization … |
Vulnerable |
|
GHSA-65h8-27jh-q8wv
Aliases: CVE-2026-35627 |
OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement ## Summary Nostr inbound DM handling could … |
Vulnerable |
|
GHSA-3cw3-5vxw-g2h3
Aliases: CVE-2026-41342 |
OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials ## Summary Remote onboarding accepted discovered gateway endpoints … |
Vulnerable |
|
GHSA-68f8-9mhj-h2mp
Aliases: CVE-2026-35619 |
OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope > Fixed in OpenClaw 2026.3.24, the current shipping release. … |
Vulnerable |
|
GHSA-hf68-49fm-59cq
Aliases: CVE-2026-35639 |
OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve ## Summary device.pair.approve allowed an operator.pairing approver to … |
Vulnerable |
|
GHSA-qm2m-28pf-hgjw
Aliases: CVE-2026-35669 |
OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers ## Summary Gateway Plugin HTTP auth: "gateway" … | There are no reported fixed by versions. |
|
GHSA-cxmw-p77q-wchg
Aliases: CVE-2026-35643 |
OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface ## Summary Android Canvas WebView pages from untrusted origins could invoke the … |
Vulnerable |
|
GHSA-35cq-wv6v-88xf
|
Duplicate Advisory: OpenClaw affected by SSRF via unguarded image download in fal provider ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-3w6x-gv34-mqpf
|
OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement ## Summary Mutating internal ACP chat commands missed the operator.admin … |
Vulnerable |
|
GHSA-m866-6qv5-p2fg
Aliases: CVE-2026-41332 |
OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override ## Summary Host execution env sanitization did … |
Vulnerable |
|
GHSA-mw7w-g3mg-xqm7
|
OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events ## Summary BlueBubbles Group Reactions Bypass requireMention and … | There are no reported fixed by versions. |
|
GHSA-98hh-7ghg-x6rq
Aliases: CVE-2026-41303 |
OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals ## Summary Discord text approval commands … |
Vulnerable |
|
GHSA-52q4-3xjc-6778
Aliases: CVE-2026-35617 |
OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName ## Summary Google Chat Authz Bypass via … |
Vulnerable |
|
GHSA-f44p-c7w9-7xr7
Aliases: CVE-2026-41399 |
OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades ## Summary The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades … |
Vulnerable |
|
GHSA-vqvg-86cc-cg83
|
OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement > Fixed in OpenClaw 2026.3.24, the current shipping release. **Title** … |
Vulnerable |
|
GHSA-3gr8-2752-h46q
|
Duplicate Advisory: OpenClaw's message tool media parameter bypasses tool policy filesystem isolation ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-2pr2-hcv6-7gwv
Aliases: CVE-2026-34503 |
OpenClaw's device removal and token revocation do not terminate active WebSocket sessions ## Summary Removing a device or revoking its … |
Vulnerable |
|
GHSA-h4jx-hjr3-fhgc
Aliases: CVE-2026-35645 |
OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` ## Summary Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` ## … |
Vulnerable |
|
GHSA-j4c9-w69r-cw33
Aliases: CVE-2026-35661 |
OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State ## Summary Telegram DM-Scoped Inline Button Callbacks … |
Vulnerable |
|
GHSA-3h52-cx59-c456
Aliases: CVE-2026-35640 |
OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation ## Summary Feishu webhook reads and parses unauthenticated … |
Vulnerable |
|
GHSA-39pp-xp36-q6mg
Aliases: CVE-2026-35650 |
OpenClaw has Inconsistent Host Exec Environment Override Sanitization ## Summary Gateway host exec env override handling did not consistently apply … |
Vulnerable |
|
GHSA-w6m8-cqvj-pg5v
Aliases: CVE-2026-35665 |
OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant) > Fixed in OpenClaw … |
Vulnerable |
|
GHSA-wj55-88gf-x564
Aliases: CVE-2026-35648 |
OpenClaw may have stale policy enforcement for queued node actions ## Summary Queued node actions were not revalidated against current … |
Vulnerable |
|
GHSA-rvqr-hrcc-j9vv
Aliases: CVE-2026-35659 |
OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution ## Summary Bonjour and DNS-SD TXT metadata could still … |
Vulnerable |
|
GHSA-f275-5h5c-5wg5
|
Duplicate Advisory: OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-77w2-crqv-cmv3
Aliases: CVE-2026-35664 |
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing ## Summary Feishu Raw card … |
Vulnerable |
|
GHSA-rm59-992w-x2mv
Aliases: CVE-2026-35626 |
OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling ## Summary Voice Call webhook handling buffered … |
Vulnerable |
|
GHSA-hc5h-pmr3-3497
Aliases: CVE-2026-33579 |
OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation ## Summary The `/pair approve` command … |
Vulnerable |
|
GHSA-v2v2-f783-358j
Aliases: CVE-2026-33576 |
OpenClaw: Zalo channel downloads media before sender authorization ## Summary The Zalo image path fetched and stored inbound media before … |
Vulnerable |
|
GHSA-8689-gm9g-jgr6
Aliases: CVE-2026-41395 |
OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering ## Summary Plivo V3 signature … |
Vulnerable |
|
GHSA-cg6c-q2hx-69h7
Aliases: CVE-2026-35618 |
OpenClaw: Plivo V2 verified replay identity drifts on query-only variants ## Summary Before `v2026.3.23`, the Plivo V2 verification path treated … |
Vulnerable |
|
GHSA-74wf-h43j-vvmj
Aliases: CVE-2026-35655 |
OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting ## Summary ACP permission resolution trusted conflicting tool identity hints from rawInput … |
Vulnerable |
|
GHSA-6pfc-6m7w-m8fx
Aliases: CVE-2026-41390 |
OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper ## Summary Allow-always persistence did not unwrap `/usr/bin/script` … |
Vulnerable |
|
GHSA-3298-56p6-rpw2
Aliases: CVE-2026-35667 |
OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts` > Fixed in OpenClaw 2026.3.24, the … |
Vulnerable |
|
GHSA-xp9r-prpg-373r
Aliases: CVE-2026-35653 |
OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface > Fixed in OpenClaw 2026.3.24, the current shipping release. # … |
Vulnerable |
|
GHSA-9p93-7j67-5pc2
|
OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding ## Summary Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill … | There are no reported fixed by versions. |
|
GHSA-5jvj-hxmh-6h6j
Aliases: CVE-2026-35657 |
OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope ## Summary Gateway HTTP Session History Route Bypasses Operator Read … | There are no reported fixed by versions. |
|
GHSA-hr5v-j9h9-xjhg
Aliases: CVE-2026-35668 |
OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22) > Fixed in OpenClaw 2026.3.24, the … |
Vulnerable |
|
GHSA-6mqc-jqh6-x8fc
Aliases: CVE-2026-35634 |
OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication ## Summary Before `v2026.3.23`, Canvas and A2UI loopback requests … |
Vulnerable |
|
GHSA-xhq5-45pm-2gjr
Aliases: CVE-2026-35624 |
OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens ## Summary Nextcloud Talk room authorization … |
Vulnerable |
|
GHSA-vfg3-pqpq-93m4
Aliases: CVE-2026-35637 |
OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete ## Summary Tlon cite expansion happened before channel … |
Vulnerable |
|
GHSA-mp66-rf4f-mhh8
Aliases: CVE-2026-35622 |
OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals ## Summary Google Chat app-url webhook verification accepted add-on principals … |
Vulnerable |
|
GHSA-q86m-697p-h7fh
|
Duplicate Advisory: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind ## Duplicate Advisory This advisory … | There are no reported fixed by versions. |
|
GHSA-44c9-4rg5-qjgq
|
Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
CVE-2026-41299
Aliases: GHSA-6xg4-82hv-cp6f |
OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing ACP-only provenance fields in `chat.send` were gated … |
Vulnerable |
|
GHSA-wr92-6w3g-2hwc
|
Duplicate Advisory: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-rm5c-4rmf-vvhw
|
OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses |
Vulnerable |
|
GHSA-x3h8-jrgh-p8jx
|
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs Exec allowlist analysis rejects shell expansion in unquoted heredocs |
Vulnerable |
|
GHSA-q2qc-744p-66r2
|
OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility `session_status` sessionId resolution bypasses sandboxed session-tree visibility |
Vulnerable |
|
GHSA-72fw-cqh5-f324
Aliases: CVE-2026-53844 |
OpenClaw: memory-wiki shared search could miss session visibility checks ### Summary memory-wiki shared search could miss session visibility checks. In … |
Vulnerable |
|
GHSA-24vr-rprv-67rf
Aliases: CVE-2026-53846 |
OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install ### Summary Workspace .env npm_execpath could influence bundled runtime dependency … |
Vulnerable |
|
GHSA-c8w7-9w9h-x69q
|
Duplicate Advisory: Slack reaction events could ignore reaction notification settings ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-fcvx-5cxc-v5p8
Aliases: CVE-2026-53851 |
OpenClaw: Slack reaction events could ignore reaction notification settings ### Summary Slack reaction events could ignore reaction notification settings. In … |
Vulnerable |
|
GHSA-58wc-8wrv-xp9j
|
Duplicate Advisory: Active Memory write scope could mutate global config ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-wc84-j36w-pw4x
Aliases: CVE-2026-53858 |
OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots ### Summary Workspace .env STATE_DIRECTORY could influence bundled runtime dependency … |
Vulnerable |
|
GHSA-c226-q6fx-6j6c
Aliases: CVE-2026-53861 |
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags ### Summary macOS Swift exec allowlist missed combined POSIX inline … |
Vulnerable |
|
GHSA-vqx6-6j84-2794
|
Duplicate Advisory: Hostname checks could treat trailing-dot hosts inconsistently ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
GHSA-gxg4-2rrr-jhc7
Aliases: CVE-2026-53859 |
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently ### Summary Hostname checks could treat trailing-dot hosts inconsistently. In affected versions, … |
Vulnerable |
|
GHSA-5cj2-3jr2-5h77
Aliases: CVE-2026-53855 |
OpenClaw: Shell positional parameters could weaken strict inline-eval checks ### Summary Shell positional parameters could weaken strict inline-eval checks. In … |
Vulnerable |
|
GHSA-w9hf-3pp7-pvxv
Aliases: CVE-2026-53841 |
OpenClaw: Exported session HTML could keep unsafe markdown links ### Summary Exported session HTML could keep unsafe markdown links. In … |
Vulnerable |
|
GHSA-wrr6-p5r6-474m
|
Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-g796-jqmx-wf9q
|
Duplicate Advisory: macOS Swift exec allowlist missed combined POSIX inline flags ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-p44v-rx83-vjp4
|
Duplicate Advisory: Discord allowFrom could bind to mutable display names ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-ccwh-wwpp-6wg5
Aliases: CVE-2026-53864 |
OpenClaw: Host environment sanitizer missed two Node.js control variables ### Summary Host environment sanitizer missed two Node.js control variables. In … |
Vulnerable |
|
GHSA-8wmm-344f-mpjg
|
Duplicate Advisory: Tool group policy callers could accept unvalidated group IDs ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-cwpp-5962-q4f6
Aliases: CVE-2026-53848 |
OpenClaw: Exec allowlist could miss side effects from transparent command wrappers ### Summary Exec allowlist could miss side effects from … |
Vulnerable |
|
GHSA-hc4w-hm59-9w88
|
Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-9v8j-9c9g-w66c
Aliases: CVE-2026-53862 |
OpenClaw: Bootstrap token replay could widen pending pairing scopes ### Summary Bootstrap token replay could widen pending pairing scopes. In … |
Vulnerable |
|
GHSA-4hpg-mp64-x7xq
Aliases: CVE-2026-53854 |
OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state ### Summary Internal/webchat command auth could inherit ownerAllowFrom wildcard state. In … |
Vulnerable |
|
GHSA-v383-2wgg-v483
|
Duplicate Advisory: Shell inline-command parsing could miss an allowlist check ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-x629-46cc-7xgw
Aliases: CVE-2026-53847 |
OpenClaw: Active Memory write scope could mutate global config ### Summary Active Memory write scope could mutate global config. In … |
Vulnerable |
|
GHSA-985f-72mj-8gf7
Aliases: CVE-2026-53863 |
OpenClaw: Tool group policy callers could accept unvalidated group IDs ### Summary Tool group policy callers could accept unvalidated group … |
Vulnerable |
|
GHSA-68xw-r643-9p5w
Aliases: CVE-2026-53845 |
OpenClaw: Skill-command dispatch could skip before-tool-call hooks ### Summary Skill-command dispatch could skip before-tool-call hooks. In affected versions, a skill … |
Vulnerable |
|
GHSA-8mg9-j9cf-54cj
Aliases: CVE-2026-53852 |
OpenClaw: Empty-scope device re-pairing could confuse caller scope containment ### Summary Empty-scope device re-pairing could confuse caller scope containment. In … |
Vulnerable |
|
GHSA-gw2c-6hcg-5g52
|
Duplicate Advisory: Focus command could miss controlScope enforcement ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-cw4q-gqg5-g38h
Aliases: CVE-2026-53849 |
OpenClaw: Discord allowFrom could bind to mutable display names ### Summary Discord allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-h9h6-pwqv-j9hv
|
Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-8j37-5w68-wj2g
Aliases: CVE-2026-53860 |
OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers ### Summary BlueBubbles sender policy could match mutable conversation identifiers. In … |
Vulnerable |
|
GHSA-6xcg-6q43-rj2v
|
Duplicate Advisory: Exported session HTML could keep unsafe markdown links ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-mpc8-jxjh-qpgh
Aliases: CVE-2026-53850 |
OpenClaw: Focus command could miss controlScope enforcement ### Summary Focus command could miss controlScope enforcement. In affected versions, a caller … |
Vulnerable |
|
GHSA-r7vv-6763-m739
|
Duplicate Advisory: Skill-command dispatch could skip before-tool-call hooks ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-rx78-29qr-5hq8
Aliases: CVE-2026-53865 |
OpenClaw: Workspace-derived service PATH could influence trash command selection ### Summary Workspace-derived service PATH could influence trash command selection. In … |
Vulnerable |
|
GHSA-q99w-vh6v-q3v7
Aliases: CVE-2026-53843 |
OpenClaw: Pairing-scoped device session could restore revoked node token authority ### Summary In affected releases, a surviving pairing-scoped session for … |
Vulnerable |
|
GHSA-f397-5vjw-v2c2
Aliases: CVE-2026-53866 |
OpenClaw: Shell inline-command parsing could miss an allowlist check ### Summary Shell inline-command parsing could miss an allowlist check. In … |
Vulnerable |
|
GHSA-fq9j-vw4w-fr6v
Aliases: CVE-2026-53842 |
OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution ### Summary Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud … |
Vulnerable |
|
GHSA-vr6h-vxqj-3pjx
|
Duplicate Advisory: Host environment sanitizer missed two Node.js control variables ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-8c59-hr4w-qg69
Aliases: CVE-2026-53857 |
OpenClaw: Zalo allowFrom could bind to mutable display names ### Summary Zalo allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-r2fx-hp6p-pgrm
|
Duplicate Advisory: Internal/webchat command auth could inherit ownerAllowFrom wildcard state ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-8hj2-w4c9-fjfq
|
Duplicate Advisory: BlueBubbles sender policy could match mutable conversation identifiers ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-w7m7-3xcf-mp48
|
Duplicate Advisory: Zalo allowFrom could bind to mutable display names ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-v2ww-5rh7-2h5v
Aliases: CVE-2026-53853 |
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns ### Summary OpenClaw's exec allowlist supported optional `argPattern` entries to … |
Vulnerable |
|
GHSA-9c3v-684m-579c
|
OpenClaw MCP SSE redirects could forward Authorization headers ### Summary MCP SSE redirects could forward Authorization headers. In affected versions, … |
Vulnerable |
|
GHSA-v6r2-jh58-xx6w
Aliases: CVE-2026-53810 |
OpenClaw's marketplace runtime extension metadata could point at unscanned payloads ### Summary Marketplace runtime extension metadata could point at unscanned … |
Vulnerable |
|
GHSA-2hfg-4fh4-qp7f
Aliases: CVE-2026-53812 |
OpenClaw's browser act interactions could bypass private-network navigation checks ### Summary OpenClaw's browser control SSRF checks blocked direct navigation to … |
Vulnerable |
|
GHSA-2j8v-hwgc-x698
|
OpenClaw: Shell wrapper argv could change between approval and execution ### Summary Shell wrapper argv could change between approval and … |
Vulnerable |
|
GHSA-p2fh-f5fc-44hr
|
OpenClaw: memory-wiki ingest could read local files with operator.write scope ### Summary memory-wiki ingest could read local files with operator.write … |
Vulnerable |
|
GHSA-hw9r-h9mr-4jff
|
OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates ### Summary Some internal command handlers require `operator.approvals` or … |
Vulnerable |
|
GHSA-chr9-m4q2-76hw
Aliases: CVE-2026-53817 |
OpenClaw: Control UI locality spoofing could mint a durable admin device token ### Summary In affected LAN/shared-token Control UI deployments, … |
Vulnerable |
|
GHSA-qh2f-99mv-mrcf
|
OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn ### Summary Bundle MCP loopback could miss its … |
Vulnerable |
|
GHSA-q7q8-3mgw-q67r
Aliases: CVE-2026-53815 |
OpenClaw: Message read actions could skip channel allowlist checks ### Summary Message read actions could skip channel allowlist checks. In … |
Vulnerable |
|
GHSA-wv26-j37q-2g7p
|
OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions ### Summary Slack plugin approvals used the exec … |
Vulnerable |
|
GHSA-6fvr-66p3-3qj4
Aliases: CVE-2026-53814 |
OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority ### Summary OpenClaw hook ingress can start automated agent runs … |
Vulnerable |
|
GHSA-xww8-gqvh-92x9
|
OpenClaw: Exec approval display truncation could hide the command being approved ### Summary OpenClaw exec approvals could show a shortened … |
Vulnerable |
|
GHSA-hx4v-668p-g2qr
|
Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-c29c-2q9c-pc86
|
OpenClaw: Slack allowFrom could bind to mutable display names ### Summary Slack allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-grc3-2j34-p6gm
|
OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs ### Summary message.action forwarding could send Gateway credentials to … |
Vulnerable |
|
GHSA-p39j-x9h5-q66m
Aliases: CVE-2026-53809 |
OpenClaw: Embedded runner policy could be confused by provider aliases ### Summary Embedded runner policy could be confused by provider … |
Vulnerable |
|
GHSA-mgq6-vr84-7m2j
Aliases: CVE-2026-35630 |
OpenClaw: QQBot native approval buttons did not enforce configured approver identity ### Summary OpenClaw's QQBot channel can deliver native approval … |
Vulnerable Vulnerable |
|
GHSA-w4v6-g3wm-w36c
|
OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy ### Summary QQBot admin commands could skip DM-only and allowFrom … |
Vulnerable |
|
GHSA-3c6j-hq33-3jv4
Aliases: CVE-2026-53816 |
OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance ### Summary OpenClaw nodes send lifecycle events back to … |
Vulnerable |
|
GHSA-cqwv-9qjx-vxw2
|
OpenClaw: Skill Workshop apply flow could override pending approval ### Summary Skill Workshop apply flow could override pending approval. In … |
Vulnerable |
|
GHSA-w5ww-7chg-mxcq
|
OpenClaw: Telegram interactive callbacks could skip commands.allowFrom ### Summary Telegram interactive callbacks could skip commands.allowFrom. In affected versions, a Telegram … |
Vulnerable |
|
GHSA-77q5-rr5v-x43q
|
OpenClaw: Trusted retry endpoint checks could match hostname prefixes ### Summary Trusted retry endpoint checks could match hostname prefixes. In … |
Vulnerable |
|
GHSA-hcm3-8f6r-6xwg
|
OpenClaw: Browser debug/export routes could reuse already-open blocked tabs ### Summary Browser debug/export routes could reuse already-open blocked tabs. In … |
Vulnerable |
|
GHSA-6c4r-g249-wv3c
|
OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts ### Summary Sandboxed session spawn could expose … |
Vulnerable |
|
GHSA-8wg3-5mcm-fjq8
Aliases: CVE-2026-53819 |
OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows ### Summary Workspace .env could override Homebrew executable … |
Vulnerable |
|
GHSA-v8cx-933x-r976
Aliases: CVE-2026-53813 |
OpenClaw: Fake package roots could influence memory-core artifact loading ### Summary Fake package roots could influence memory-core artifact loading. In … |
Vulnerable |
|
GHSA-7hxm-f538-3xp6
Aliases: CVE-2026-53811 |
OpenClaw: Matrix allowFrom could bind to mutable display names ### Summary Matrix allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-rj6p-xmxr-qj4h
Aliases: CVE-2026-53818 |
OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers ### Summary MCP loopback could skip owner-only tool policy … |
Vulnerable |
|
GHSA-xr4f-mjxj-w6w5
|
OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes ### Summary The bundled device-pair plugin exposed `/pair` on normal chat … |
Vulnerable |
|
GHSA-vxx3-6hc9-7cc3
Aliases: CVE-2026-53806 |
OpenClaw: Combined POSIX shell options could confuse exec revalidation ### Summary Combined POSIX shell options could confuse exec revalidation. In … |
Vulnerable |
|
GHSA-p73f-w79w-jqr5
|
OpenClaw: Native command authorization could skip owner-command enforcement ### Summary Native command authorization could skip owner-command enforcement. In affected versions, … |
Vulnerable |
|
GHSA-3wqp-prf6-2m72
|
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement ### Summary Feishu dynamic-agent bindings could miss configWrites enforcement. In affected versions, … |
Vulnerable |
|
GHSA-4m3v-q747-pc6h
|
OpenClaw: Mattermost slash token revocation could lag until monitor refresh ### Summary Mattermost slash token revocation could lag until monitor … |
Vulnerable |
|
GHSA-qjpc-qf9m-xwmr
|
OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing ### Summary In trusted-proxy Control UI mode, OpenClaw accepted a … |
Vulnerable |
|
CVE-2026-41388
Aliases: GHSA-3pm9-5j7m-59vc |
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config |
Vulnerable Vulnerable |
|
GHSA-cxcw-jm67-3wwp
|
Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-jp4j-q5fc-58gv
|
OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement Discord button and component interaction ingress did not consistently reapply the … |
Vulnerable Vulnerable |
|
CVE-2026-53854
Aliases: GHSA-4hpg-mp64-x7xq |
OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state Internal/webchat command auth could inherit ownerAllowFrom wildcard state. In affected versions, … |
Vulnerable |
|
CVE-2026-41335
Aliases: GHSA-hr8g-2q7x-3f4w |
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability OpenClaw Gateway Control Interface Information Disclosure Vulnerability |
Vulnerable Vulnerable |
|
CVE-2026-35641
Aliases: GHSA-m3mh-3mpg-37hw |
OpenClaw has an Arbitrary Malicious Code Execution Vulnerability During the installation phase of OpenClaw local plugins/hooks, the Git executable can … |
Vulnerable Vulnerable |
|
CVE-2026-41386
Aliases: GHSA-gg9v-mgcp-v6m7 |
OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing Bootstrap setup codes were not bound to the intended device … |
Vulnerable Vulnerable |
|
CVE-2026-41391
Aliases: GHSA-7ggg-pvrf-458v |
OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic `PIP_INDEX_URL` and `UV_INDEX_URL` bypass host exec … |
Vulnerable Vulnerable |
|
CVE-2026-53844
Aliases: GHSA-72fw-cqh5-f324 |
OpenClaw: memory-wiki shared search could miss session visibility checks memory-wiki shared search could miss session visibility checks. In affected versions, … |
Vulnerable |
|
GHSA-fwjq-xwfj-gv75
|
OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations |
Vulnerable Vulnerable |
|
CVE-2026-41369
Aliases: GHSA-cg7q-fg22-4g98 |
OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables Host exec environment sanitization misses package, … |
Vulnerable Vulnerable |
|
CVE-2026-41377
Aliases: GHSA-cwq8-6f96-g3q4 |
OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open) Security Scan Failure Does Not Block Plugin Installation (Fail-Open) |
Vulnerable Vulnerable |
|
CVE-2026-45003
Aliases: GHSA-55cf-xx38-4p9p |
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts Workspace dotenv files cannot override connector endpoint hosts. |
Vulnerable Vulnerable |
|
CVE-2026-41364
Aliases: GHSA-fv94-qvg8-xqpw |
OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host SSH sandbox tar upload follows symlinks, … |
Vulnerable Vulnerable |
|
CVE-2026-53863
Aliases: GHSA-985f-72mj-8gf7 |
OpenClaw: Tool group policy callers could accept unvalidated group IDs Tool group policy callers could accept unvalidated group IDs. In … |
Vulnerable |
|
CVE-2026-41384
Aliases: GHSA-vfw7-6rhc-6xxg |
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config Incomplete Fix for CVE-2026-4039: CLI Backend … |
Vulnerable Vulnerable |
|
GHSA-r849-826x-wgqm
|
Duplicate Advisory: Signal group allowlist authorization bypass via DM pairing-store leakage ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
CVE-2026-41342
Aliases: GHSA-3cw3-5vxw-g2h3 |
OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials Remote onboarding accepted discovered gateway endpoints without an … |
Vulnerable Vulnerable |
|
CVE-2026-53848
Aliases: GHSA-cwpp-5962-q4f6 |
OpenClaw: Exec allowlist could miss side effects from transparent command wrappers Exec allowlist could miss side effects from transparent command … |
Vulnerable |
|
CVE-2026-53866
Aliases: GHSA-f397-5vjw-v2c2 |
OpenClaw: Shell inline-command parsing could miss an allowlist check Shell inline-command parsing could miss an allowlist check. In affected versions, … |
Vulnerable |
|
CVE-2026-41347
Aliases: GHSA-mhr7-2xmv-4c4q |
OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode HTTP operator endpoints lack browser-origin validation in trusted-proxy mode |
Vulnerable Vulnerable |
|
CVE-2026-34504
Aliases: GHSA-qxgf-hmcj-3xw3 |
OpenClaw affected by SSRF via unguarded image download in fal provider The fal provider used raw fetches for both provider … |
Vulnerable Vulnerable |
|
CVE-2026-41355
Aliases: GHSA-42mx-vp8m-j7qh |
OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host … |
Vulnerable Vulnerable |
|
CVE-2026-41296
Aliases: GHSA-9p3r-hh9g-5cmg |
OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile Sandbox escape via TOCTOU race in remote FS bridge … |
Vulnerable Vulnerable |
|
CVE-2026-41403
Aliases: GHSA-3xv9-89fm-7h4r |
OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled diffs viewer misclassifies proxied remote requests as … |
Vulnerable Vulnerable |
|
GHSA-3r78-rqg8-95gg
|
Duplicate Advisory: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse ## … | There are no reported fixed by versions. |
|
CVE-2026-41405
Aliases: GHSA-p464-m8x6-vhv8 |
OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion MS Teams webhook parses body before JWT … |
Vulnerable Vulnerable |
|
CVE-2026-35654
Aliases: GHSA-rf6h-5gpw-qrgq |
OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback MS Teams Feedback Invoke Bypasses Sender Allowlists … |
Vulnerable Vulnerable |
|
CVE-2026-41294
Aliases: GHSA-8rh7-6779-cjqq |
OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover OpenClaw loaded the current … |
Vulnerable Vulnerable |
|
CVE-2026-41380
Aliases: GHSA-p4x4-2r7f-wjxg |
OpenClaw gateway exec allow-always over-trusts positional carrier executables Allow-always persistence could trust wrapper carrier executables instead of the actual invoked … |
Vulnerable Vulnerable |
|
CVE-2026-34503
Aliases: GHSA-2pr2-hcv6-7gwv |
OpenClaw's device removal and token revocation do not terminate active WebSocket sessions Removing a device or revoking its token updated … |
Vulnerable Vulnerable |
|
CVE-2026-41374
Aliases: GHSA-hhff-fj5f-qg48 |
OpenClaw runs Discord audio preflight transcription before member authorization Discord audio preflight transcription before member authorization |
Vulnerable Vulnerable |
|
GHSA-cjq8-m7wj-xmq9
|
Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-xq3g-m3j8-2vmm
|
Duplicate Advisory: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels ## Duplicate Advisory This … | There are no reported fixed by versions. |
|
CVE-2026-53861
Aliases: GHSA-c226-q6fx-6j6c |
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags macOS Swift exec allowlist missed combined POSIX inline flags. In … |
Vulnerable |
|
CVE-2026-44997
Aliases: GHSA-q3jj-46pq-826r |
OpenClaw's ACP child sessions inherit subagent security envelope constraints ACP child sessions inherit subagent security envelope constraints. |
Vulnerable Vulnerable |
|
CVE-2026-33580
Aliases: GHSA-9528-x887-j2fp |
OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication Nextcloud Talk webhook signature failures were not throttled even … |
Vulnerable Vulnerable |
|
CVE-2026-41381
Aliases: GHSA-cqgw-44wg-44rf |
OpenClaw: Discord voice manager bypasses channel-level member access allowlist Discord voice manager bypasses channel-level member access allowlist |
Vulnerable Vulnerable |
|
GHSA-f6pf-4gjx-c94r
|
OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read OpenClaw <= 2026.3.24 Media Parsing Path Traversal to Arbitrary File … |
Vulnerable Vulnerable |
|
GHSA-pfv5-rpcw-x34x
|
Duplicate Advisory: OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
CVE-2026-41379
Aliases: GHSA-3q42-xmxv-9vfr |
OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send Gateway operator.write Can Reach Admin-Class Talk Voice Config … |
Vulnerable Vulnerable |
|
CVE-2026-41378
Aliases: GHSA-gjm7-hw8f-73rq |
OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch Paired node escalates to gateway RCE via unrestricted … |
Vulnerable Vulnerable |
|
GHSA-vh4c-j2xv-9pv9
|
Duplicate Advisory: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback) ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
CVE-2026-35661
Aliases: GHSA-j4c9-w69r-cw33 |
OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State Telegram DM-Scoped Inline Button Callbacks Bypass DM … |
Vulnerable Vulnerable |
|
CVE-2026-33578
Aliases: GHSA-63mg-xp9j-jfcm |
OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade When only a route-level group allowlist was configured, … |
Vulnerable Vulnerable |
|
CVE-2026-53850
Aliases: GHSA-mpc8-jxjh-qpgh |
OpenClaw: Focus command could miss controlScope enforcement Focus command could miss controlScope enforcement. In affected versions, a caller able to … |
Vulnerable |
|
GHSA-rj39-33v7-9xrq
|
Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class) ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-57gh-m6rq-54cf
|
OpenClaw: Self-`Whitelist`ing in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration Media Local Roots Self-`Whitelist`ing in `appendLocalMediaParentRoots` Allows Model-Initiated Arbitrary … |
Vulnerable Vulnerable |
|
GHSA-qwmf-95r9-gx9x
|
Duplicate Advisory: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
CVE-2026-53852
Aliases: GHSA-8mg9-j9cf-54cj |
OpenClaw: Empty-scope device re-pairing could confuse caller scope containment Empty-scope device re-pairing could confuse caller scope containment. In affected versions, … |
Vulnerable |
|
CVE-2026-53857
Aliases: GHSA-8c59-hr4w-qg69 |
OpenClaw: Zalo allowFrom could bind to mutable display names Zalo allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
GHSA-5326-6f73-m96w
|
Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
CVE-2026-41408
Aliases: GHSA-4g5x-2jfc-xm98 |
OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk Tlon media downloads can bypass core safety limits … |
Vulnerable Vulnerable |
|
CVE-2026-41373
Aliases: GHSA-g8xp-qx39-9jq9 |
OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides Incomplete `host-env-security-policy.json` allows untrusted model to substitute … |
Vulnerable Vulnerable |
|
CVE-2026-53847
Aliases: GHSA-x629-46cc-7xgw |
OpenClaw: Active Memory write scope could mutate global config Active Memory write scope could mutate global config. In affected versions, … |
Vulnerable |
|
CVE-2026-53841
Aliases: GHSA-w9hf-3pp7-pvxv |
OpenClaw: Exported session HTML could keep unsafe markdown links Exported session HTML could keep unsafe markdown links. In affected versions, … |
Vulnerable |
|
CVE-2026-41385
Aliases: GHSA-jjw7-3vjf-fg5j |
OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get |
Vulnerable Vulnerable |
|
CVE-2026-35619
Aliases: GHSA-68f8-9mhj-h2mp |
OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope The OpenAI-compatible HTTP endpoint `/v1/models` accepts bearer auth but … |
Vulnerable Vulnerable |
|
CVE-2026-41396
Aliases: GHSA-qcj9-wwgw-6gm8 |
OpenClaw: Workspace `.env` can override the bundled plugin trust root Workspace `.env` can override the bundled plugin trust root |
Vulnerable Vulnerable |
|
CVE-2026-41351
Aliases: GHSA-37v6-fxx8-xjmx |
OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding |
Vulnerable Vulnerable |
|
CVE-2026-41337
Aliases: GHSA-89r3-6x4j-v7wf |
OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection Voice-call Plivo replay mutates in-process callback origin before replay … |
Vulnerable Vulnerable |
|
CVE-2026-41302
Aliases: GHSA-9q7v-8mr7-g23p |
OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery SSRF via Unguarded `fetch()` in Marketplace Plugin … |
Vulnerable Vulnerable |
|
CVE-2026-35645
Aliases: GHSA-h4jx-hjr3-fhgc |
OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin` |
Vulnerable Vulnerable |
|
CVE-2026-41303
Aliases: GHSA-98hh-7ghg-x6rq |
OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals Discord text approval commands resolved pending … |
Vulnerable Vulnerable |
|
CVE-2026-41352
Aliases: GHSA-xj9w-5r6q-x6v4 |
OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md Device-Paired Node Skips Node Scope Gate → Host RCE.md |
Vulnerable Vulnerable |
|
CVE-2026-41336
Aliases: GHSA-3qpv-xf3v-mm45 |
OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code Workspace `.env` can override the bundled … |
Vulnerable Vulnerable |
|
CVE-2026-35617
Aliases: GHSA-52q4-3xjc-6778 |
OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName Google Chat Authz Bypass via Group Policy … |
Vulnerable Vulnerable |
|
CVE-2026-53862
Aliases: GHSA-9v8j-9c9g-w66c |
OpenClaw: Bootstrap token replay could widen pending pairing scopes Bootstrap token replay could widen pending pairing scopes. In affected versions, … |
Vulnerable |
|
CVE-2026-41365
Aliases: GHSA-chfm-xgc4-47rj |
OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API MSTeams thread history bypasses sender allowlist via Graph API |
Vulnerable Vulnerable |
|
GHSA-gfg9-5357-hv4c
|
OpenClaw: Webchat audio embedding could read local files without local-root containment OpenClaw deployments before `2026.4.15` could embed host-local audio files … |
Vulnerable Vulnerable |
|
CVE-2026-41406
Aliases: GHSA-877v-w3f5-3pcq |
OpenClaw: Feishu thread history and quoted messages bypass sender allowlist Feishu thread history and quoted messages bypass sender allowlist |
Vulnerable Vulnerable |
|
CVE-2026-41382
Aliases: GHSA-x2m8-53h4-6hch |
OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps Discord voice ingress authorization can … |
Vulnerable Vulnerable |
|
CVE-2026-33577
Aliases: GHSA-2x4x-cc5g-qmmg |
OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes The node pairing approval path did not consistently … |
Vulnerable Vulnerable |
|
GHSA-j9pv-rrcj-6pfx
|
OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes SSH-based sandbox backends pass unsanitized process.env to child processes |
Vulnerable Vulnerable |
|
GHSA-gfmx-pph7-g46x
|
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` … |
Vulnerable Vulnerable |
|
CVE-2026-44112
Aliases: GHSA-wppj-c6mr-83jj |
OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root OpenShell FS bridge writes stay pinned to the … |
Vulnerable Vulnerable |
|
CVE-2026-41399
Aliases: GHSA-f44p-c7w9-7xr7 |
OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating … |
Vulnerable Vulnerable |
|
CVE-2026-41402
Aliases: GHSA-hhq4-97c2-p447 |
OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass Zalo webhook replay cache cross-target messageId scope bypass |
Vulnerable Vulnerable |
|
CVE-2026-41341
Aliases: GHSA-6336-qqw9-v6x6 |
OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message Discord Component Interaction Misclassifies Group DM as Direct Message |
Vulnerable Vulnerable |
|
CVE-2026-41348
Aliases: GHSA-rvvf-6vh3-9j43 |
OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist Discord Slash Commands Bypass Group DM Channel Allowlist |
Vulnerable Vulnerable |
|
GHSA-93rg-2xm5-2p9v
|
OpenClaw's Gateway Control UI bootstrap config required Gateway auth Gateway Control UI bootstrap config required Gateway auth. |
Vulnerable Vulnerable |
|
GHSA-68v4-hmwv-f43h
|
OpenClaw: Media download follows cross-origin redirects with Authorization headers intact Media download follows cross-origin redirects with Authorization headers intact |
Vulnerable Vulnerable |
|
CVE-2026-41344
Aliases: GHSA-5h2w-qmfp-ggp6 |
OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose` The `chat.send` path let authorized write-scoped callers persist `/verbose` … |
Vulnerable Vulnerable |
|
CVE-2026-41359
Aliases: GHSA-767m-xrhc-fxm7 |
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send Gateway operator.write Can Reach Admin-Class Telegram Config … |
Vulnerable Vulnerable |
|
CVE-2026-41332
Aliases: GHSA-m866-6qv5-p2fg |
OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override Host execution env sanitization did not block … |
Vulnerable Vulnerable |
|
CVE-2026-44116
Aliases: GHSA-2hh7-c75g-qj2r |
OpenClaw validates Zalo outbound photo URLs through the SSRF guard Zalo outbound photo URLs are validated through the SSRF guard. |
Vulnerable Vulnerable |
|
GHSA-v3qc-wrwx-j3pw
|
OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch` Agentic Consent Bypass: LLM Agent Can … |
Vulnerable Vulnerable |
|
CVE-2026-53849
Aliases: GHSA-cw4q-gqg5-g38h |
OpenClaw: Discord allowFrom could bind to mutable display names Discord allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
CVE-2026-41376
Aliases: GHSA-rg8m-3943-vm6q |
OpenClaw: Matrix thread root and reply context bypass sender allowlist Matrix thread root and reply context bypass sender allowlist |
Vulnerable Vulnerable |
|
GHSA-xrgv-34cc-q765
|
Duplicate Advisory: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
CVE-2026-35664
Aliases: GHSA-77w2-crqv-cmv3 |
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing Feishu Raw card Send Surface … |
Vulnerable Vulnerable |
|
CVE-2026-41404
Aliases: GHSA-g374-mggx-p6xc |
OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth … |
Vulnerable Vulnerable |
|
GHSA-ffr4-mrhv-vfr2
|
Duplicate Advisory: OpenClaw has browser trace/download path symlink escape in temp output handling ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-3846-mfvc-xwpf
|
Duplicate Advisory: Exec allowlist wrapper analysis did not unwrap env/shell dispatch chains ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
CVE-2026-53851
Aliases: GHSA-fcvx-5cxc-v5p8 |
OpenClaw: Slack reaction events could ignore reaction notification settings Slack reaction events could ignore reaction notification settings. In affected versions, … |
Vulnerable |
|
GHSA-jf56-mccx-5f3f
|
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel Authenticated `/hooks/wake` and mapped `wake` … |
Vulnerable Vulnerable |
|
GHSA-w85g-3h6x-4xh2
|
OpenClaw: Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS Image pixel-limit guard can fail open on … |
Vulnerable Vulnerable |
|
CVE-2026-41300
Aliases: GHSA-9f4w-67g7-mqwv |
OpenClaw: Endpoint persists after trust decline, leaking gateway credentials Remote onboarding preserves attacker-discovered endpoint after trust decline, routing gateway credentials … |
Vulnerable Vulnerable |
|
CVE-2026-41330
Aliases: GHSA-9gp8-hjxr-6f34 |
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls Host exec environment overrides miss proxy, TLS, … |
Vulnerable Vulnerable |
|
GHSA-q94v-v6m9-jhq9
|
Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
CVE-2026-41331
Aliases: GHSA-m6fx-m8hc-572m |
OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders Telegram audio preflight transcription enables resource consumption by unauthorized … |
Vulnerable Vulnerable |
|
CVE-2026-41390
Aliases: GHSA-6pfc-6m7w-m8fx |
OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper Allow-always persistence did not unwrap `/usr/bin/script` and similar … |
Vulnerable Vulnerable |
|
CVE-2026-41393
Aliases: GHSA-q9w8-cf67-r238 |
OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration macOS Wide-Area Discovery Accepts Arbitrary Tailnet Peer as DNS Authority and Exfiltrates … |
Vulnerable Vulnerable |
|
CVE-2026-53859
Aliases: GHSA-gxg4-2rrr-jhc7 |
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently Hostname checks could treat trailing-dot hosts inconsistently. In affected versions, a request … |
Vulnerable |
|
CVE-2026-35651
Aliases: GHSA-4hmj-39m8-jwc7 |
OpenClaw has ACP CLI approval prompt ANSI escape sequence injection ACP CLI approval prompt ANSI escape sequence injection |
Vulnerable Vulnerable |
|
GHSA-x742-88jj-7hv9
|
Duplicate Advisory: allowlist exec-guard bypass via env -S ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-g86v-f9qv-rh6m
|
OpenClaw SSRF guard misses four IPv6 special-use ranges The SSRF/IP classifier treated several IPv6 special-use ranges as public and allowed … |
Vulnerable Vulnerable |
|
CVE-2026-41333
Aliases: GHSA-6p8r-6m93-557f |
OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting Fake DeviceToken Bypasses Shared Auth Rate Limiting |
Vulnerable Vulnerable |
|
CVE-2026-41363
Aliases: GHSA-qf48-qfv4-jjm9 |
OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image Feishu upload path resolution could read … |
Vulnerable Vulnerable |
|
CVE-2026-41356
Aliases: GHSA-rfqg-qgf8-xr9x |
OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation Gateway `device.token.rotate` does not terminate active WebSocket sessions … |
Vulnerable Vulnerable |
|
GHSA-f693-58pc-2gfr
|
OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts Telegram legacy allowFrom migration fans default-account trust into … |
Vulnerable Vulnerable |
|
GHSA-jccr-rrw2-vc8h
|
OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure The jq safe-bin policy blocked explicit `env` usage but still … |
Vulnerable Vulnerable |
|
CVE-2026-33576
Aliases: GHSA-v2v2-f783-358j |
OpenClaw: Zalo channel downloads media before sender authorization The Zalo image path fetched and stored inbound media before the DM/pairing … |
Vulnerable Vulnerable |
|
CVE-2026-41375
Aliases: GHSA-h2v7-xc88-xx8c |
OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External … |
Vulnerable Vulnerable |
|
CVE-2026-33579
Aliases: GHSA-hc5h-pmr3-3497 |
OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation The `/pair approve` command path called … |
Vulnerable Vulnerable |
|
CVE-2026-41343
Aliases: GHSA-qcc3-jqwp-5vh2 |
OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification LINE webhook handler lacks shared pre-auth concurrency budget … |
Vulnerable Vulnerable |
|
CVE-2026-41400
Aliases: GHSA-2w79-r9g8-wmcr |
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062) Incomplete fix for CVE-2026-32062: voice-call still … |
Vulnerable Vulnerable |
|
CVE-2026-44113
Aliases: GHSA-5h3g-6xhh-rg6p |
OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes OpenShell FS bridge reads pin and … |
Vulnerable Vulnerable |
|
CVE-2026-44118
Aliases: GHSA-r6xh-pqhr-v4xh |
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens MCP loopback owner context is derived from server-issued bearer … |
Vulnerable Vulnerable |
|
CVE-2026-35621
Aliases: GHSA-94pw-c6m8-p9p9 |
OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send The shared `/allowlist` command persists channel authorization config through … |
Vulnerable Vulnerable |
|
CVE-2026-41329
Aliases: GHSA-g5cg-8x5w-7jpm |
OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation |
Vulnerable Vulnerable |
|
CVE-2026-41397
Aliases: GHSA-cwf8-44x6-32c2 |
OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal OpenShell Mirror Sync: Sandbox Escape via … |
Vulnerable Vulnerable |
|
CVE-2026-53864
Aliases: GHSA-ccwh-wwpp-6wg5 |
OpenClaw: Host environment sanitizer missed two Node.js control variables Host environment sanitizer missed two Node.js control variables. In affected versions, … |
Vulnerable |
|
GHSA-5r8f-96gm-5j6g
|
OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset` The `chat.send` path reused command authorization to trigger `/reset` … |
Vulnerable Vulnerable |
|
CVE-2026-32846
Aliases: GHSA-hggm-x7r9-mm7v |
OpenClaw is vulnerable to Path Traversal through path validation bypass OpenClaw through 2026.3.23 (fixed in commit 4797bbc) contains a path … |
Vulnerable Vulnerable |
|
CVE-2026-41394
Aliases: GHSA-mhgq-xpfq-6r66 |
OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes Unauthenticated plugin-auth HTTP routes receive operator runtime scopes |
Vulnerable Vulnerable |
|
CVE-2026-53860
Aliases: GHSA-8j37-5w68-wj2g |
OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers BlueBubbles sender policy could match mutable conversation identifiers. In affected versions, … |
Vulnerable |
|
CVE-2026-41297
Aliases: GHSA-vjx8-8p7h-82gr |
OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection Marketplace Plugin Download Follows Redirects Without SSRF Protection |
Vulnerable Vulnerable |
|
CVE-2026-53845
Aliases: GHSA-68xw-r643-9p5w |
OpenClaw: Skill-command dispatch could skip before-tool-call hooks Skill-command dispatch could skip before-tool-call hooks. In affected versions, a skill command routed … |
Vulnerable |
|
GHSA-58q2-7r52-jq62
|
OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read Path traversal via inbound channel … |
Vulnerable Vulnerable |
|
GHSA-h5hg-h7rr-gpf3
|
OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection Node browser proxy `allowProfiles` bypass through … |
Vulnerable Vulnerable |
|
GHSA-2j8v-hwgc-x698
|
OpenClaw: Shell wrapper argv could change between approval and execution Shell wrapper argv could change between approval and execution. In … |
Vulnerable |
|
GHSA-c29c-2q9c-pc86
|
OpenClaw: Slack allowFrom could bind to mutable display names Slack allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
GHSA-p73f-w79w-jqr5
|
OpenClaw: Native command authorization could skip owner-command enforcement Native command authorization could skip owner-command enforcement. In affected versions, a sender … |
Vulnerable |
|
GHSA-w5ww-7chg-mxcq
|
OpenClaw: Telegram interactive callbacks could skip commands.allowFrom Telegram interactive callbacks could skip commands.allowFrom. In affected versions, a Telegram user able … |
Vulnerable |
|
GHSA-grc3-2j34-p6gm
|
OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs message.action forwarding could send Gateway credentials to model-supplied loopback … |
Vulnerable |
|
GHSA-3wqp-prf6-2m72
|
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement Feishu dynamic-agent bindings could miss configWrites enforcement. In affected versions, a Feishu … |
Vulnerable |
|
GHSA-cqwv-9qjx-vxw2
|
OpenClaw: Skill Workshop apply flow could override pending approval Skill Workshop apply flow could override pending approval. In affected versions, … |
Vulnerable |
|
CVE-2026-53806
Aliases: GHSA-vxx3-6hc9-7cc3 |
OpenClaw: Combined POSIX shell options could confuse exec revalidation Combined POSIX shell options could confuse exec revalidation. In affected versions, … |
Vulnerable |
|
CVE-2026-53809
Aliases: GHSA-p39j-x9h5-q66m |
OpenClaw: Embedded runner policy could be confused by provider aliases Embedded runner policy could be confused by provider aliases. In … |
Vulnerable |
|
CVE-2026-53811
Aliases: GHSA-7hxm-f538-3xp6 |
OpenClaw: Matrix allowFrom could bind to mutable display names Matrix allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
CVE-2026-53813
Aliases: GHSA-v8cx-933x-r976 |
OpenClaw: Fake package roots could influence memory-core artifact loading Fake package roots could influence memory-core artifact loading. In affected versions, … |
Vulnerable |
|
GHSA-6c4r-g249-wv3c
|
OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts Sandboxed session spawn could expose the real … |
Vulnerable |
|
GHSA-4m3v-q747-pc6h
|
OpenClaw: Mattermost slash token revocation could lag until monitor refresh Mattermost slash token revocation could lag until monitor refresh. In … |
Vulnerable |
|
GHSA-275c-xpvc-jgfw
Aliases: CVE-2026-53830 |
OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload Slack and Zalo webhook secrets could remain active after … |
Vulnerable |
|
GHSA-j472-gf56-x589
Aliases: CVE-2026-53836 |
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks PowerShell encoded-command aliases could miss exec allowlist checks. In affected versions, … |
Vulnerable |
|
GHSA-jvm4-4j77-39p6
Aliases: CVE-2026-53833 |
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom QQBot streaming command could mutate config without explicit allowFrom. In … |
Vulnerable Vulnerable |
|
GHSA-r27j-fxmq-rg2q
|
Duplicate Advisory: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-ffhm-8fwq-7q27
|
Duplicate Advisory: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-35c7-4r45-9gv3
|
Duplicate Advisory: OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-gwcq-453v-2frr
|
Duplicate Advisory: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-chqm-wxm2-w73w
|
Duplicate Advisory: OpenClaw: Mattermost handlers could fall open when channel type was missing ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-3qg8-hq7j-jj33
|
Duplicate Advisory: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-c85p-9pvr-f7f5
|
Duplicate Advisory: OpenClaw: Node pairing reconnection could confuse approval scope state ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-p68j-q8j9-jwf5
|
Duplicate Advisory: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-jvm4-4j77-39p6
Aliases: CVE-2026-53833 |
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom ### Summary QQBot streaming command could mutate config without explicit … |
Vulnerable Vulnerable |
|
GHSA-mhq8-78pj-5j79
Aliases: CVE-2026-53831 |
OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion ### Summary On POSIX nodes, OpenClaw's `system.run` safe-bin … |
Vulnerable Vulnerable |
|
GHSA-j472-gf56-x589
Aliases: CVE-2026-53836 |
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks ### Summary PowerShell encoded-command aliases could miss exec allowlist checks. In … |
Vulnerable Vulnerable |
|
GHSA-gp79-m99v-gjmh
Aliases: CVE-2026-53837 |
OpenClaw: Mattermost handlers could fall open when channel type was missing ### Summary Mattermost handlers could fall open when channel … |
Vulnerable Vulnerable |
|
GHSA-rggc-m335-3wvj
Aliases: CVE-2026-53832 |
OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers ### Summary Same-host trusted-proxy deployments could accept local forged identity … |
Vulnerable Vulnerable |
|
GHSA-83w9-h5wv-j9xm
Aliases: CVE-2026-53838 |
OpenClaw: Node pairing reconnection could confuse approval scope state ### Summary Node pairing reconnection could confuse approval scope state. In … |
Vulnerable Vulnerable |
|
GHSA-77pv-3w4q-vrj5
Aliases: CVE-2026-53834 |
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks ### Summary QQBot pre-dispatch slash commands could skip allowFrom checks. In … |
Vulnerable Vulnerable |
|
GHSA-275c-xpvc-jgfw
Aliases: CVE-2026-53830 |
OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload ### Summary Slack and Zalo webhook secrets could remain … |
Vulnerable Vulnerable |
|
GHSA-77pv-3w4q-vrj5
Aliases: CVE-2026-53834 |
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks QQBot pre-dispatch slash commands could skip allowFrom checks. In affected versions, … |
Vulnerable Vulnerable |
|
GHSA-gp79-m99v-gjmh
Aliases: CVE-2026-53837 |
OpenClaw: Mattermost handlers could fall open when channel type was missing Mattermost handlers could fall open when channel type was … |
Vulnerable Vulnerable |
|
GHSA-qp56-gp47-jwj3
|
Duplicate Advisory: OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image ### Duplicate Advisory This … |
Vulnerable Vulnerable |
|
GHSA-qf48-qfv4-jjm9
Aliases: CVE-2026-41363 |
OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image ## Summary Feishu upload path resolution … |
Vulnerable Vulnerable |
|
GHSA-h36m-2vh5-x699
|
Duplicate Advisory: ACPX Windows wrapper shell fallback allowed cwd injection in specific paths ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-jp4j-q5fc-58gv
|
OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement ## Summary Discord button and component interaction ingress did not consistently … |
Vulnerable Vulnerable |
|
GHSA-4hmj-39m8-jwc7
Aliases: CVE-2026-35651 |
OpenClaw has ACP CLI approval prompt ANSI escape sequence injection ## Summary ACP CLI approval prompt ANSI escape sequence injection … |
Vulnerable Vulnerable |
|
GHSA-q2qc-744p-66r2
|
OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility ## Summary `session_status` sessionId resolution bypasses sandboxed session-tree visibility ## Affected Packages … |
Vulnerable Vulnerable |
|
GHSA-jw7v-5mp7-ghgm
|
Duplicate Advisory: Browser CDP discovery could accept blocked WebSocket URLs ## Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-3x84-qq85-fj65
Aliases: CVE-2026-62197 |
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs ### Summary Browser CDP discovery could accept blocked WebSocket URLs. In … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-g2f6-pwvx-r275
|
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection ### Summary `openclaw` versions `<= 2026.3.12` accepted unsanitized … | |
|
GHSA-jq3f-vjww-8rq7
|
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion ### Summary `openclaw` versions `<= 2026.3.12` … |
CVE-2026-32980
|
|
GHSA-63f5-hhc7-cx6p
|
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval ### Summary `openclaw` versions `<= 2026.3.12` … | |
|
GHSA-xwcj-hwhf-h378
|
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs ### Summary `openclaw` versions `<= 2026.3.12` could include … | |
|
GHSA-xwcj-hwhf-h378
|
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs `openclaw` versions `<= 2026.3.12` could include raw Telegram … | |
|
GHSA-63f5-hhc7-cx6p
|
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval `openclaw` versions `<= 2026.3.12` allowed bootstrap … | |
|
GHSA-jq3f-vjww-8rq7
|
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion `openclaw` versions `<= 2026.3.12` read and … | |
|
GHSA-g2f6-pwvx-r275
|
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection `openclaw` versions `<= 2026.3.12` accepted unsanitized iMessage remote … | |
|
CVE-2026-32980
|
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion `openclaw` versions `<= 2026.3.12` read and … |
GHSA-jq3f-vjww-8rq7
|