Search for packages
| purl | pkg:npm/openclaw@2026.4.8 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-xmxx-7p24-h892
Aliases: CVE-2026-43585 |
OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation ## Summary Gateway HTTP and WebSocket handlers captured the resolved … |
Vulnerable |
|
GHSA-736r-jwj6-4w23
Aliases: CVE-2026-42434 |
OpenClaw: Sandboxed agents could escape exec routing via host=node override ## Summary Sandboxed agents could escape exec routing via host=node … |
Vulnerable |
|
GHSA-f3h5-h452-vp3j
|
OpenClaw: Nostr profile mutation routes allowed operator.write config persistence ## Summary Nostr profile mutation routes allowed operator.write config persistence. ## … |
Vulnerable |
|
GHSA-j4c5-89f5-f3pm
|
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-7g8c-cfr3-vqqr
Aliases: CVE-2026-43534 |
OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input ## Summary Agent hook events could enqueue … |
Vulnerable |
|
GHSA-jf25-7968-h2h5
Aliases: CVE-2026-43567 |
OpenClaw: screen_record outPath bypassed workspace-only filesystem guard ## Summary screen_record outPath bypassed workspace-only filesystem guard. ## Affected Packages / Versions … |
Vulnerable |
|
GHSA-82qx-6vj7-p8m2
Aliases: CVE-2026-43571 |
OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows ## Summary Channel setup catalog lookups could include untrusted … |
Vulnerable |
|
GHSA-qrp5-gfw2-gxv4
|
OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-527m-976r-jf79
Aliases: CVE-2026-43573 |
OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement ## Summary Existing-session browser interaction routes bypassed SSRF policy enforcement. ## … |
Vulnerable |
|
GHSA-939r-rj45-g2rj
Aliases: CVE-2026-43569 |
OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins ## Summary Workspace provider auth choices could auto-enable untrusted provider … |
Vulnerable |
|
GHSA-536q-mj95-h29h
Aliases: CVE-2026-43580 |
OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage ## Summary Browser press/type interaction routes missed complete navigation guard … |
Vulnerable |
|
GHSA-7wv4-cc7p-jhxc
Aliases: CVE-2026-43531 |
OpenClaw: Workspace .env could inject OpenClaw runtime-control variables ## Summary Workspace .env could inject OpenClaw runtime-control variables. ## Affected Packages … |
Vulnerable |
|
GHSA-xrq9-jm7v-g9h7
|
OpenClaw: Paired-device pairing actions were not limited to the caller device ## Affected Packages / Versions - Package: `openclaw` (npm) … |
Vulnerable |
|
GHSA-qgx9-6px9-7p75
|
Duplicate Advisory: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-g375-h3v6-4873
|
OpenClaw: Heartbeat owner downgrade missed local async exec completion events ## Summary Heartbeat owner downgrade missed local async exec completion … |
Vulnerable |
|
GHSA-2767-2q9v-9326
Aliases: CVE-2026-43526 |
OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes ## Summary QQBot reply media URL handling … |
Vulnerable |
|
GHSA-7jp6-r74r-995q
Aliases: CVE-2026-42433 |
OpenClaw: Matrix profile config persistence was reachable from operator.write message tools ## Summary Matrix profile config persistence was reachable from … |
Vulnerable |
|
GHSA-qmwg-qprg-3j38
|
OpenClaw: Browser interaction routes could pivot into local CDP and regain file reads ## Summary Browser interaction routes could pivot … |
Vulnerable |
|
GHSA-f934-5rqf-xx47
|
OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths ## Summary The QMD backend `memory_get` read path accepted … |
Vulnerable |
|
GHSA-xh72-v6v9-mwhc
Aliases: CVE-2026-44109 |
OpenClaw: Feishu webhook and card-action validation now fail closed ## Summary Feishu webhook mode accepted missing `encryptKey` configuration as valid … |
Vulnerable |
|
GHSA-53vx-pmqw-863c
Aliases: CVE-2026-43527 |
OpenClaw: Browser SSRF policy default allowed private-network navigation ## Summary Browser SSRF policy default allowed private-network navigation. ## Affected Packages … |
Vulnerable |
|
GHSA-vfp4-8x56-j7c5
Aliases: CVE-2026-43584 |
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables ## Summary Exec environment denylist missed high-risk interpreter startup variables. ## … |
Vulnerable |
|
GHSA-525j-hqq2-66r4
|
OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0 ## Summary Sandbox browser CDP relay could expose DevTools … |
Vulnerable |
|
GHSA-c4qg-j8jg-42q5
Aliases: CVE-2026-44117 |
OpenClaw: QQBot direct media upload skipped URL SSRF validation ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-mr34-9552-qr95
Aliases: CVE-2026-41389 |
OpenClaw: Webchat media embedding enforces local-root containment for tool-result files ## Summary Webchat tool-result media normalization could pass local and … |
Vulnerable |
|
GHSA-g2hm-779g-vm32
Aliases: CVE-2026-43566 |
OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events ## Summary Heartbeat owner downgrade missed untrusted webhook wake events. ## … |
Vulnerable |
|
GHSA-gfg9-5357-hv4c
|
OpenClaw: Webchat audio embedding could read local files without local-root containment ## Impact OpenClaw deployments before `2026.4.15` could embed host-local … |
Vulnerable |
|
GHSA-xq94-r468-qwgj
Aliases: CVE-2026-43582 |
OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding ## Summary Browser SSRF hostname validation could be bypassed … |
Vulnerable |
|
GHSA-66r7-m7xm-v49h
Aliases: CVE-2026-43533 |
OpenClaw: QQBot media tags could read arbitrary local files through reply text ## Summary QQBot media tags could read arbitrary … |
Vulnerable |
|
GHSA-j6c7-3h5x-99g9
Aliases: CVE-2026-42435 |
OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms ## Summary Shell-wrapper detection missed env-argv assignment injection forms. ## Affected Packages … |
Vulnerable |
|
GHSA-72q8-jcmc-97wx
|
OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy ## Affected Packages / Versions - Package: `openclaw` (npm) - … |
Vulnerable |
|
GHSA-92jp-89mq-4374
|
OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials ## Summary Sandbox noVNC helper route exposed interactive browser session … |
Vulnerable |
|
GHSA-qc5j-2mqx-x83q
|
Duplicate Advisory: OpenClaw: Webchat media embedding enforces local-root containment for tool-result files ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-c28g-vh7m-fm7v
Aliases: CVE-2026-44991 |
OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners ## Impact OpenClaw deployments before `2026.4.21` could treat a … |
Vulnerable |
|
GHSA-v8qf-fr4g-28p2
Aliases: CVE-2026-41908 |
OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization ## Affected Packages / Versions - Package: `openclaw` (npm) - … |
Vulnerable |
|
GHSA-5gjc-grvm-m88j
Aliases: CVE-2026-43568 |
OpenClaw: Memory dreaming config persistence was reachable from operator.write commands ## Summary Memory dreaming config persistence was reachable from operator.write … |
Vulnerable |
|
GHSA-49cg-279w-m73x
Aliases: CVE-2026-43574 |
OpenClaw: Empty approver lists could grant explicit approval authorization ## Summary Empty approver lists could grant explicit approval authorization. ## … |
Vulnerable |
|
GHSA-8372-7vhw-cm6q
Aliases: CVE-2026-43528 |
OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases ## Summary config.get redaction bypass through sourceConfig and runtimeConfig aliases. ## … |
Vulnerable |
|
GHSA-gj9q-8w99-mp8j
Aliases: CVE-2026-43529 |
OpenClaw: TOCTOU read in exec script preflight ## Summary OpenClaw's exec script preflight validator previously validated and then read a … |
Vulnerable |
|
GHSA-2xcp-x87w-q377
Aliases: CVE-2026-45002 |
OpenClaw: Hook mapping templates could bypass hook session-key opt-in ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected … |
Vulnerable |
|
GHSA-jwrq-8g5x-5fhm
Aliases: CVE-2026-43535 |
OpenClaw: Collect-mode queue batches could reuse the last sender authorization context ## Summary Collect-mode queue batches could reuse the last … |
Vulnerable |
|
GHSA-57r2-h2wj-g887
Aliases: CVE-2026-44999 |
OpenClaw: Isolated cron awareness events were recorded as trusted system events ## Affected Packages / Versions - Package: `openclaw` (npm) … |
Vulnerable |
|
GHSA-7jm2-g593-4qrc
|
OpenClaw: Agent gateway config mutations could change protected operator settings ## Affected Packages / Versions - Package: `openclaw` (npm) - … |
Vulnerable |
|
GHSA-mj59-h3q9-ghfh
Aliases: CVE-2026-44995 |
OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config ## Affected Packages / Versions - Package: … |
Vulnerable |
|
GHSA-h2vw-ph2c-jvwf
Aliases: CVE-2026-44992 |
OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests ## Affected Packages / Versions - Package: `openclaw` (npm) - … |
Vulnerable |
|
GHSA-c9h3-5p7r-mrjh
Aliases: CVE-2026-43532 |
OpenClaw: Discord event cover images bypassed sandbox media normalization ## Summary Discord event cover images bypassed sandbox media normalization. ## … |
Vulnerable |
|
GHSA-2cq5-mf3v-mx44
Aliases: CVE-2026-43530 |
OpenClaw: busybox and toybox applet execution weakened exec approval binding ## Summary busybox and toybox applet execution weakened exec approval … |
Vulnerable |
|
GHSA-c4qm-58hj-j6pj
Aliases: CVE-2026-42436 |
OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation ## Summary Browser snapshot and screenshot routes … |
Vulnerable |
|
GHSA-hxvm-xjvf-93f3
Aliases: CVE-2026-44114 |
OpenClaw: Workspace dotenv could override runtime-control environment variables ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: … |
Vulnerable |
|
GHSA-rj2p-j66c-mgqh
Aliases: CVE-2026-42439 |
OpenClaw: Browser tabs action select and close routes bypassed SSRF policy ## Summary Browser tabs action select and close routes … |
Vulnerable |
|
GHSA-rjxq-qqhf-8hwh
Aliases: CVE-2026-53840 |
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin ### Summary OpenClaw supports remote MCP Streamable … |
Vulnerable |
|
GHSA-v8j2-5f9p-fmh4
|
Duplicate Advisory: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-2hh7-c75g-qj2r
Aliases: CVE-2026-44116 |
OpenClaw validates Zalo outbound photo URLs through the SSRF guard ## Summary Zalo outbound photo URLs are validated through the … |
Vulnerable |
|
GHSA-cjg8-85gj-v9q2
|
Duplicate Advisory: OpenClaw: Feishu webhook and card-action validation now fail closed ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-wppj-c6mr-83jj
Aliases: CVE-2026-44112 |
OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root ## Summary OpenShell FS bridge writes stay pinned … |
Vulnerable |
|
GHSA-w7rc-vvgx-pj45
|
Duplicate Advisory: OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-m5j2-r859-r5cv
|
Duplicate Advisory: OpenClaw: Isolated cron awareness events were recorded as trusted system events ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-p3m6-jr2h-hhxj
|
Duplicate Advisory: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config ### Duplicate Advisory This advisory … |
Vulnerable |
|
GHSA-35vf-vw9f-q3cr
|
Duplicate Advisory: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-9j32-3m66-mc4m
|
Duplicate Advisory: OpenClaw: Hook mapping templates could bypass hook session-key opt-in ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-5h3g-6xhh-rg6p
Aliases: CVE-2026-44113 |
OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes ## Summary OpenShell FS bridge reads … |
Vulnerable |
|
GHSA-p3pv-c954-9m6f
|
Duplicate Advisory: OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-xpr6-2hgm-4wwp
|
Duplicate Advisory: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution ### Duplicate Advisory … |
Vulnerable |
|
GHSA-q8ff-7ffm-m3r9
Aliases: CVE-2026-45005 |
OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload ## Summary OpenClaw webhooks allowed route secrets to be backed by … |
Vulnerable |
|
GHSA-93rg-2xm5-2p9v
|
OpenClaw's Gateway Control UI bootstrap config required Gateway auth ## Summary Gateway Control UI bootstrap config required Gateway auth. ## … |
Vulnerable |
|
GHSA-m8wm-r5vq-qjpg
|
Duplicate Advisory: OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-w626-296m-8f85
|
Duplicate Advisory: OpenClaw's ACP child sessions inherit subagent security envelope constraints ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-5jgm-f9wr-9qm7
|
Duplicate Advisory: OpenClaw: Workspace dotenv files cannot override connector endpoint hosts ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-55cf-xx38-4p9p
Aliases: CVE-2026-45003 |
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts ## Summary Workspace dotenv files cannot override connector endpoint hosts. ## … |
Vulnerable |
|
GHSA-frr5-j3mh-h9ch
|
Duplicate Advisory: OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes ### Duplicate Advisory This … |
Vulnerable |
|
GHSA-xrgf-r9gr-jjjf
|
Duplicate Advisory: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-q3jj-46pq-826r
Aliases: CVE-2026-44997 |
OpenClaw's ACP child sessions inherit subagent security envelope constraints ## Summary ACP child sessions inherit subagent security envelope constraints. ## … |
Vulnerable |
|
GHSA-wwwc-f646-vj2j
|
Duplicate Advisory: OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-r39h-4c2p-3jxp
Aliases: CVE-2026-45004 |
OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution ## Summary OpenClaw's bundled plugin … |
Vulnerable |
|
GHSA-r747-33r4-rmjw
|
Duplicate Advisory: OpenClaw: QQBot direct media upload skipped URL SSRF validation ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-4mhr-cxr4-2prm
|
Duplicate Advisory: OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-6f72-9gxx-98mj
|
Duplicate Advisory: OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-cwj3-vqpp-pmxr
|
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes ## Summary The agent-facing `gateway` tool protects `config.apply` and `config.patch` … |
Vulnerable |
|
GHSA-r6xh-pqhr-v4xh
Aliases: CVE-2026-44118 |
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens ## Summary MCP loopback owner context is derived from … |
Vulnerable |
|
GHSA-x3h8-jrgh-p8jx
|
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs ## Summary Exec allowlist analysis rejects shell expansion in unquoted … |
Vulnerable |
|
GHSA-9r9j-3r2w-fg3v
|
Duplicate Advisory: OpenClaw: Workspace dotenv could override runtime-control environment variables ### Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-qvmw-h675-h7qg
|
Duplicate Advisory: OpenClaw validates Zalo outbound photo URLs through the SSRF guard ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-q86m-697p-h7fh
|
Duplicate Advisory: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind ## Duplicate Advisory This advisory … | There are no reported fixed by versions. |
|
GHSA-44c9-4rg5-qjgq
|
Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
GHSA-wr92-6w3g-2hwc
|
Duplicate Advisory: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-x3h8-jrgh-p8jx
|
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs Exec allowlist analysis rejects shell expansion in unquoted heredocs |
Vulnerable |
|
GHSA-72fw-cqh5-f324
Aliases: CVE-2026-53844 |
OpenClaw: memory-wiki shared search could miss session visibility checks ### Summary memory-wiki shared search could miss session visibility checks. In … |
Vulnerable |
|
GHSA-24vr-rprv-67rf
Aliases: CVE-2026-53846 |
OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install ### Summary Workspace .env npm_execpath could influence bundled runtime dependency … |
Vulnerable |
|
GHSA-c8w7-9w9h-x69q
|
Duplicate Advisory: Slack reaction events could ignore reaction notification settings ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-fcvx-5cxc-v5p8
Aliases: CVE-2026-53851 |
OpenClaw: Slack reaction events could ignore reaction notification settings ### Summary Slack reaction events could ignore reaction notification settings. In … |
Vulnerable |
|
GHSA-58wc-8wrv-xp9j
|
Duplicate Advisory: Active Memory write scope could mutate global config ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-wc84-j36w-pw4x
Aliases: CVE-2026-53858 |
OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots ### Summary Workspace .env STATE_DIRECTORY could influence bundled runtime dependency … |
Vulnerable |
|
GHSA-c226-q6fx-6j6c
Aliases: CVE-2026-53861 |
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags ### Summary macOS Swift exec allowlist missed combined POSIX inline … |
Vulnerable |
|
GHSA-vqx6-6j84-2794
|
Duplicate Advisory: Hostname checks could treat trailing-dot hosts inconsistently ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
GHSA-gxg4-2rrr-jhc7
Aliases: CVE-2026-53859 |
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently ### Summary Hostname checks could treat trailing-dot hosts inconsistently. In affected versions, … |
Vulnerable |
|
GHSA-w9hf-3pp7-pvxv
Aliases: CVE-2026-53841 |
OpenClaw: Exported session HTML could keep unsafe markdown links ### Summary Exported session HTML could keep unsafe markdown links. In … |
Vulnerable |
|
GHSA-wrr6-p5r6-474m
|
Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-g796-jqmx-wf9q
|
Duplicate Advisory: macOS Swift exec allowlist missed combined POSIX inline flags ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-p44v-rx83-vjp4
|
Duplicate Advisory: Discord allowFrom could bind to mutable display names ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-ccwh-wwpp-6wg5
Aliases: CVE-2026-53864 |
OpenClaw: Host environment sanitizer missed two Node.js control variables ### Summary Host environment sanitizer missed two Node.js control variables. In … |
Vulnerable |
|
GHSA-8wmm-344f-mpjg
|
Duplicate Advisory: Tool group policy callers could accept unvalidated group IDs ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-cwpp-5962-q4f6
Aliases: CVE-2026-53848 |
OpenClaw: Exec allowlist could miss side effects from transparent command wrappers ### Summary Exec allowlist could miss side effects from … |
Vulnerable |
|
GHSA-hc4w-hm59-9w88
|
Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-9v8j-9c9g-w66c
Aliases: CVE-2026-53862 |
OpenClaw: Bootstrap token replay could widen pending pairing scopes ### Summary Bootstrap token replay could widen pending pairing scopes. In … |
Vulnerable |
|
GHSA-4hpg-mp64-x7xq
Aliases: CVE-2026-53854 |
OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state ### Summary Internal/webchat command auth could inherit ownerAllowFrom wildcard state. In … |
Vulnerable |
|
GHSA-v383-2wgg-v483
|
Duplicate Advisory: Shell inline-command parsing could miss an allowlist check ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-x629-46cc-7xgw
Aliases: CVE-2026-53847 |
OpenClaw: Active Memory write scope could mutate global config ### Summary Active Memory write scope could mutate global config. In … |
Vulnerable |
|
GHSA-985f-72mj-8gf7
Aliases: CVE-2026-53863 |
OpenClaw: Tool group policy callers could accept unvalidated group IDs ### Summary Tool group policy callers could accept unvalidated group … |
Vulnerable |
|
GHSA-68xw-r643-9p5w
Aliases: CVE-2026-53845 |
OpenClaw: Skill-command dispatch could skip before-tool-call hooks ### Summary Skill-command dispatch could skip before-tool-call hooks. In affected versions, a skill … |
Vulnerable |
|
GHSA-8mg9-j9cf-54cj
Aliases: CVE-2026-53852 |
OpenClaw: Empty-scope device re-pairing could confuse caller scope containment ### Summary Empty-scope device re-pairing could confuse caller scope containment. In … |
Vulnerable |
|
GHSA-gw2c-6hcg-5g52
|
Duplicate Advisory: Focus command could miss controlScope enforcement ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-cw4q-gqg5-g38h
Aliases: CVE-2026-53849 |
OpenClaw: Discord allowFrom could bind to mutable display names ### Summary Discord allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-h9h6-pwqv-j9hv
|
Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-8j37-5w68-wj2g
Aliases: CVE-2026-53860 |
OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers ### Summary BlueBubbles sender policy could match mutable conversation identifiers. In … |
Vulnerable |
|
GHSA-6xcg-6q43-rj2v
|
Duplicate Advisory: Exported session HTML could keep unsafe markdown links ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-mpc8-jxjh-qpgh
Aliases: CVE-2026-53850 |
OpenClaw: Focus command could miss controlScope enforcement ### Summary Focus command could miss controlScope enforcement. In affected versions, a caller … |
Vulnerable |
|
GHSA-r7vv-6763-m739
|
Duplicate Advisory: Skill-command dispatch could skip before-tool-call hooks ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-rx78-29qr-5hq8
Aliases: CVE-2026-53865 |
OpenClaw: Workspace-derived service PATH could influence trash command selection ### Summary Workspace-derived service PATH could influence trash command selection. In … |
Vulnerable |
|
GHSA-q99w-vh6v-q3v7
Aliases: CVE-2026-53843 |
OpenClaw: Pairing-scoped device session could restore revoked node token authority ### Summary In affected releases, a surviving pairing-scoped session for … |
Vulnerable |
|
GHSA-f397-5vjw-v2c2
Aliases: CVE-2026-53866 |
OpenClaw: Shell inline-command parsing could miss an allowlist check ### Summary Shell inline-command parsing could miss an allowlist check. In … |
Vulnerable |
|
GHSA-fq9j-vw4w-fr6v
Aliases: CVE-2026-53842 |
OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution ### Summary Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud … |
Vulnerable |
|
GHSA-vr6h-vxqj-3pjx
|
Duplicate Advisory: Host environment sanitizer missed two Node.js control variables ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-8c59-hr4w-qg69
Aliases: CVE-2026-53857 |
OpenClaw: Zalo allowFrom could bind to mutable display names ### Summary Zalo allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-r2fx-hp6p-pgrm
|
Duplicate Advisory: Internal/webchat command auth could inherit ownerAllowFrom wildcard state ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-8hj2-w4c9-fjfq
|
Duplicate Advisory: BlueBubbles sender policy could match mutable conversation identifiers ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-w7m7-3xcf-mp48
|
Duplicate Advisory: Zalo allowFrom could bind to mutable display names ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-v2ww-5rh7-2h5v
Aliases: CVE-2026-53853 |
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns ### Summary OpenClaw's exec allowlist supported optional `argPattern` entries to … |
Vulnerable |
|
GHSA-9c3v-684m-579c
|
OpenClaw MCP SSE redirects could forward Authorization headers ### Summary MCP SSE redirects could forward Authorization headers. In affected versions, … |
Vulnerable |
|
GHSA-v6r2-jh58-xx6w
Aliases: CVE-2026-53810 |
OpenClaw's marketplace runtime extension metadata could point at unscanned payloads ### Summary Marketplace runtime extension metadata could point at unscanned … |
Vulnerable |
|
GHSA-2hfg-4fh4-qp7f
Aliases: CVE-2026-53812 |
OpenClaw's browser act interactions could bypass private-network navigation checks ### Summary OpenClaw's browser control SSRF checks blocked direct navigation to … |
Vulnerable |
|
GHSA-2j8v-hwgc-x698
|
OpenClaw: Shell wrapper argv could change between approval and execution ### Summary Shell wrapper argv could change between approval and … |
Vulnerable |
|
GHSA-p2fh-f5fc-44hr
|
OpenClaw: memory-wiki ingest could read local files with operator.write scope ### Summary memory-wiki ingest could read local files with operator.write … |
Vulnerable |
|
GHSA-hw9r-h9mr-4jff
|
OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates ### Summary Some internal command handlers require `operator.approvals` or … |
Vulnerable |
|
GHSA-chr9-m4q2-76hw
Aliases: CVE-2026-53817 |
OpenClaw: Control UI locality spoofing could mint a durable admin device token ### Summary In affected LAN/shared-token Control UI deployments, … |
Vulnerable |
|
GHSA-qh2f-99mv-mrcf
|
OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn ### Summary Bundle MCP loopback could miss its … |
Vulnerable |
|
GHSA-q7q8-3mgw-q67r
Aliases: CVE-2026-53815 |
OpenClaw: Message read actions could skip channel allowlist checks ### Summary Message read actions could skip channel allowlist checks. In … |
Vulnerable |
|
GHSA-wv26-j37q-2g7p
|
OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions ### Summary Slack plugin approvals used the exec … |
Vulnerable |
|
GHSA-6fvr-66p3-3qj4
Aliases: CVE-2026-53814 |
OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority ### Summary OpenClaw hook ingress can start automated agent runs … |
Vulnerable |
|
GHSA-xww8-gqvh-92x9
|
OpenClaw: Exec approval display truncation could hide the command being approved ### Summary OpenClaw exec approvals could show a shortened … |
Vulnerable |
|
GHSA-hx4v-668p-g2qr
|
Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-c29c-2q9c-pc86
|
OpenClaw: Slack allowFrom could bind to mutable display names ### Summary Slack allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-grc3-2j34-p6gm
|
OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs ### Summary message.action forwarding could send Gateway credentials to … |
Vulnerable |
|
GHSA-p39j-x9h5-q66m
Aliases: CVE-2026-53809 |
OpenClaw: Embedded runner policy could be confused by provider aliases ### Summary Embedded runner policy could be confused by provider … |
Vulnerable |
|
GHSA-mgq6-vr84-7m2j
Aliases: CVE-2026-35630 |
OpenClaw: QQBot native approval buttons did not enforce configured approver identity ### Summary OpenClaw's QQBot channel can deliver native approval … |
Vulnerable Vulnerable |
|
GHSA-w4v6-g3wm-w36c
|
OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy ### Summary QQBot admin commands could skip DM-only and allowFrom … |
Vulnerable |
|
GHSA-3c6j-hq33-3jv4
Aliases: CVE-2026-53816 |
OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance ### Summary OpenClaw nodes send lifecycle events back to … |
Vulnerable |
|
GHSA-cqwv-9qjx-vxw2
|
OpenClaw: Skill Workshop apply flow could override pending approval ### Summary Skill Workshop apply flow could override pending approval. In … |
Vulnerable |
|
GHSA-w5ww-7chg-mxcq
|
OpenClaw: Telegram interactive callbacks could skip commands.allowFrom ### Summary Telegram interactive callbacks could skip commands.allowFrom. In affected versions, a Telegram … |
Vulnerable |
|
GHSA-77q5-rr5v-x43q
|
OpenClaw: Trusted retry endpoint checks could match hostname prefixes ### Summary Trusted retry endpoint checks could match hostname prefixes. In … |
Vulnerable |
|
GHSA-hcm3-8f6r-6xwg
|
OpenClaw: Browser debug/export routes could reuse already-open blocked tabs ### Summary Browser debug/export routes could reuse already-open blocked tabs. In … |
Vulnerable |
|
GHSA-6c4r-g249-wv3c
|
OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts ### Summary Sandboxed session spawn could expose … |
Vulnerable |
|
GHSA-8wg3-5mcm-fjq8
Aliases: CVE-2026-53819 |
OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows ### Summary Workspace .env could override Homebrew executable … |
Vulnerable |
|
GHSA-v8cx-933x-r976
Aliases: CVE-2026-53813 |
OpenClaw: Fake package roots could influence memory-core artifact loading ### Summary Fake package roots could influence memory-core artifact loading. In … |
Vulnerable |
|
GHSA-7hxm-f538-3xp6
Aliases: CVE-2026-53811 |
OpenClaw: Matrix allowFrom could bind to mutable display names ### Summary Matrix allowFrom could bind to mutable display names. In … |
Vulnerable |
|
GHSA-rj6p-xmxr-qj4h
Aliases: CVE-2026-53818 |
OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers ### Summary MCP loopback could skip owner-only tool policy … |
Vulnerable |
|
GHSA-xr4f-mjxj-w6w5
|
OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes ### Summary The bundled device-pair plugin exposed `/pair` on normal chat … |
Vulnerable |
|
GHSA-vxx3-6hc9-7cc3
Aliases: CVE-2026-53806 |
OpenClaw: Combined POSIX shell options could confuse exec revalidation ### Summary Combined POSIX shell options could confuse exec revalidation. In … |
Vulnerable |
|
GHSA-p73f-w79w-jqr5
|
OpenClaw: Native command authorization could skip owner-command enforcement ### Summary Native command authorization could skip owner-command enforcement. In affected versions, … |
Vulnerable |
|
GHSA-3wqp-prf6-2m72
|
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement ### Summary Feishu dynamic-agent bindings could miss configWrites enforcement. In affected versions, … |
Vulnerable |
|
GHSA-4m3v-q747-pc6h
|
OpenClaw: Mattermost slash token revocation could lag until monitor refresh ### Summary Mattermost slash token revocation could lag until monitor … |
Vulnerable |
|
GHSA-qjpc-qf9m-xwmr
|
OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing ### Summary In trusted-proxy Control UI mode, OpenClaw accepted a … |
Vulnerable |
|
GHSA-cxcw-jm67-3wwp
|
Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
CVE-2026-53854
Aliases: GHSA-4hpg-mp64-x7xq |
OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state Internal/webchat command auth could inherit ownerAllowFrom wildcard state. In affected versions, … |
Vulnerable |
|
CVE-2026-53844
Aliases: GHSA-72fw-cqh5-f324 |
OpenClaw: memory-wiki shared search could miss session visibility checks memory-wiki shared search could miss session visibility checks. In affected versions, … |
Vulnerable |
|
CVE-2026-45003
Aliases: GHSA-55cf-xx38-4p9p |
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts Workspace dotenv files cannot override connector endpoint hosts. |
Vulnerable Vulnerable |
|
CVE-2026-53863
Aliases: GHSA-985f-72mj-8gf7 |
OpenClaw: Tool group policy callers could accept unvalidated group IDs Tool group policy callers could accept unvalidated group IDs. In … |
Vulnerable |
|
GHSA-r849-826x-wgqm
|
Duplicate Advisory: Signal group allowlist authorization bypass via DM pairing-store leakage ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
CVE-2026-53848
Aliases: GHSA-cwpp-5962-q4f6 |
OpenClaw: Exec allowlist could miss side effects from transparent command wrappers Exec allowlist could miss side effects from transparent command … |
Vulnerable |
|
CVE-2026-53866
Aliases: GHSA-f397-5vjw-v2c2 |
OpenClaw: Shell inline-command parsing could miss an allowlist check Shell inline-command parsing could miss an allowlist check. In affected versions, … |
Vulnerable |
|
CVE-2026-44110
Aliases: GHSA-2gvc-4f3c-2855 |
OpenClaw: Matrix room control-command authorization no longer trusts DM pairing-store entries Matrix room control-command authorization used the effective allowlist for … |
Vulnerable Vulnerable |
|
GHSA-3r78-rqg8-95gg
|
Duplicate Advisory: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse ## … | There are no reported fixed by versions. |
|
GHSA-cjq8-m7wj-xmq9
|
Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-xq3g-m3j8-2vmm
|
Duplicate Advisory: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels ## Duplicate Advisory This … | There are no reported fixed by versions. |
|
CVE-2026-53861
Aliases: GHSA-c226-q6fx-6j6c |
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags macOS Swift exec allowlist missed combined POSIX inline flags. In … |
Vulnerable |
|
CVE-2026-44997
Aliases: GHSA-q3jj-46pq-826r |
OpenClaw's ACP child sessions inherit subagent security envelope constraints ACP child sessions inherit subagent security envelope constraints. |
Vulnerable Vulnerable |
|
GHSA-pfv5-rpcw-x34x
|
Duplicate Advisory: OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
GHSA-vh4c-j2xv-9pv9
|
Duplicate Advisory: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback) ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
CVE-2026-53850
Aliases: GHSA-mpc8-jxjh-qpgh |
OpenClaw: Focus command could miss controlScope enforcement Focus command could miss controlScope enforcement. In affected versions, a caller able to … |
Vulnerable |
|
GHSA-rj39-33v7-9xrq
|
Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class) ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-qwmf-95r9-gx9x
|
Duplicate Advisory: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
CVE-2026-53852
Aliases: GHSA-8mg9-j9cf-54cj |
OpenClaw: Empty-scope device re-pairing could confuse caller scope containment Empty-scope device re-pairing could confuse caller scope containment. In affected versions, … |
Vulnerable |
|
CVE-2026-53857
Aliases: GHSA-8c59-hr4w-qg69 |
OpenClaw: Zalo allowFrom could bind to mutable display names Zalo allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
GHSA-5326-6f73-m96w
|
Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
CVE-2026-53847
Aliases: GHSA-x629-46cc-7xgw |
OpenClaw: Active Memory write scope could mutate global config Active Memory write scope could mutate global config. In affected versions, … |
Vulnerable |
|
CVE-2026-53841
Aliases: GHSA-w9hf-3pp7-pvxv |
OpenClaw: Exported session HTML could keep unsafe markdown links Exported session HTML could keep unsafe markdown links. In affected versions, … |
Vulnerable |
|
CVE-2026-53862
Aliases: GHSA-9v8j-9c9g-w66c |
OpenClaw: Bootstrap token replay could widen pending pairing scopes Bootstrap token replay could widen pending pairing scopes. In affected versions, … |
Vulnerable |
|
GHSA-gfg9-5357-hv4c
|
OpenClaw: Webchat audio embedding could read local files without local-root containment OpenClaw deployments before `2026.4.15` could embed host-local audio files … |
Vulnerable Vulnerable |
|
CVE-2026-44112
Aliases: GHSA-wppj-c6mr-83jj |
OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root OpenShell FS bridge writes stay pinned to the … |
Vulnerable Vulnerable |
|
GHSA-93rg-2xm5-2p9v
|
OpenClaw's Gateway Control UI bootstrap config required Gateway auth Gateway Control UI bootstrap config required Gateway auth. |
Vulnerable Vulnerable |
|
CVE-2026-44116
Aliases: GHSA-2hh7-c75g-qj2r |
OpenClaw validates Zalo outbound photo URLs through the SSRF guard Zalo outbound photo URLs are validated through the SSRF guard. |
Vulnerable Vulnerable |
|
CVE-2026-53849
Aliases: GHSA-cw4q-gqg5-g38h |
OpenClaw: Discord allowFrom could bind to mutable display names Discord allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
GHSA-xrgv-34cc-q765
|
Duplicate Advisory: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-ffr4-mrhv-vfr2
|
Duplicate Advisory: OpenClaw has browser trace/download path symlink escape in temp output handling ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-3846-mfvc-xwpf
|
Duplicate Advisory: Exec allowlist wrapper analysis did not unwrap env/shell dispatch chains ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
CVE-2026-53851
Aliases: GHSA-fcvx-5cxc-v5p8 |
OpenClaw: Slack reaction events could ignore reaction notification settings Slack reaction events could ignore reaction notification settings. In affected versions, … |
Vulnerable |
|
GHSA-q94v-v6m9-jhq9
|
Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
CVE-2026-53859
Aliases: GHSA-gxg4-2rrr-jhc7 |
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently Hostname checks could treat trailing-dot hosts inconsistently. In affected versions, a request … |
Vulnerable |
|
GHSA-x742-88jj-7hv9
|
Duplicate Advisory: allowlist exec-guard bypass via env -S ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
CVE-2026-44113
Aliases: GHSA-5h3g-6xhh-rg6p |
OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes OpenShell FS bridge reads pin and … |
Vulnerable Vulnerable |
|
CVE-2026-44118
Aliases: GHSA-r6xh-pqhr-v4xh |
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens MCP loopback owner context is derived from server-issued bearer … |
Vulnerable Vulnerable |
|
CVE-2026-53864
Aliases: GHSA-ccwh-wwpp-6wg5 |
OpenClaw: Host environment sanitizer missed two Node.js control variables Host environment sanitizer missed two Node.js control variables. In affected versions, … |
Vulnerable |
|
CVE-2026-53860
Aliases: GHSA-8j37-5w68-wj2g |
OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers BlueBubbles sender policy could match mutable conversation identifiers. In affected versions, … |
Vulnerable |
|
CVE-2026-53845
Aliases: GHSA-68xw-r643-9p5w |
OpenClaw: Skill-command dispatch could skip before-tool-call hooks Skill-command dispatch could skip before-tool-call hooks. In affected versions, a skill command routed … |
Vulnerable |
|
GHSA-2j8v-hwgc-x698
|
OpenClaw: Shell wrapper argv could change between approval and execution Shell wrapper argv could change between approval and execution. In … |
Vulnerable |
|
GHSA-c29c-2q9c-pc86
|
OpenClaw: Slack allowFrom could bind to mutable display names Slack allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
GHSA-p73f-w79w-jqr5
|
OpenClaw: Native command authorization could skip owner-command enforcement Native command authorization could skip owner-command enforcement. In affected versions, a sender … |
Vulnerable |
|
GHSA-w5ww-7chg-mxcq
|
OpenClaw: Telegram interactive callbacks could skip commands.allowFrom Telegram interactive callbacks could skip commands.allowFrom. In affected versions, a Telegram user able … |
Vulnerable |
|
GHSA-grc3-2j34-p6gm
|
OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs message.action forwarding could send Gateway credentials to model-supplied loopback … |
Vulnerable |
|
GHSA-3wqp-prf6-2m72
|
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement Feishu dynamic-agent bindings could miss configWrites enforcement. In affected versions, a Feishu … |
Vulnerable |
|
GHSA-cqwv-9qjx-vxw2
|
OpenClaw: Skill Workshop apply flow could override pending approval Skill Workshop apply flow could override pending approval. In affected versions, … |
Vulnerable |
|
CVE-2026-53806
Aliases: GHSA-vxx3-6hc9-7cc3 |
OpenClaw: Combined POSIX shell options could confuse exec revalidation Combined POSIX shell options could confuse exec revalidation. In affected versions, … |
Vulnerable |
|
CVE-2026-53809
Aliases: GHSA-p39j-x9h5-q66m |
OpenClaw: Embedded runner policy could be confused by provider aliases Embedded runner policy could be confused by provider aliases. In … |
Vulnerable |
|
CVE-2026-53811
Aliases: GHSA-7hxm-f538-3xp6 |
OpenClaw: Matrix allowFrom could bind to mutable display names Matrix allowFrom could bind to mutable display names. In affected versions, … |
Vulnerable |
|
CVE-2026-53813
Aliases: GHSA-v8cx-933x-r976 |
OpenClaw: Fake package roots could influence memory-core artifact loading Fake package roots could influence memory-core artifact loading. In affected versions, … |
Vulnerable |
|
GHSA-6c4r-g249-wv3c
|
OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts Sandboxed session spawn could expose the real … |
Vulnerable |
|
GHSA-4m3v-q747-pc6h
|
OpenClaw: Mattermost slash token revocation could lag until monitor refresh Mattermost slash token revocation could lag until monitor refresh. In … |
Vulnerable |
|
GHSA-275c-xpvc-jgfw
Aliases: CVE-2026-53830 |
OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload Slack and Zalo webhook secrets could remain active after … |
Vulnerable |
|
GHSA-j472-gf56-x589
Aliases: CVE-2026-53836 |
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks PowerShell encoded-command aliases could miss exec allowlist checks. In affected versions, … |
Vulnerable |
|
GHSA-jvm4-4j77-39p6
Aliases: CVE-2026-53833 |
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom QQBot streaming command could mutate config without explicit allowFrom. In … |
Vulnerable Vulnerable |
|
GHSA-r27j-fxmq-rg2q
|
Duplicate Advisory: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-ffhm-8fwq-7q27
|
Duplicate Advisory: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-35c7-4r45-9gv3
|
Duplicate Advisory: OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-gwcq-453v-2frr
|
Duplicate Advisory: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-chqm-wxm2-w73w
|
Duplicate Advisory: OpenClaw: Mattermost handlers could fall open when channel type was missing ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-3qg8-hq7j-jj33
|
Duplicate Advisory: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers ### Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-c85p-9pvr-f7f5
|
Duplicate Advisory: OpenClaw: Node pairing reconnection could confuse approval scope state ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-p68j-q8j9-jwf5
|
Duplicate Advisory: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-jvm4-4j77-39p6
Aliases: CVE-2026-53833 |
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom ### Summary QQBot streaming command could mutate config without explicit … |
Vulnerable Vulnerable |
|
GHSA-mhq8-78pj-5j79
Aliases: CVE-2026-53831 |
OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion ### Summary On POSIX nodes, OpenClaw's `system.run` safe-bin … |
Vulnerable Vulnerable |
|
GHSA-j472-gf56-x589
Aliases: CVE-2026-53836 |
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks ### Summary PowerShell encoded-command aliases could miss exec allowlist checks. In … |
Vulnerable Vulnerable |
|
GHSA-gp79-m99v-gjmh
Aliases: CVE-2026-53837 |
OpenClaw: Mattermost handlers could fall open when channel type was missing ### Summary Mattermost handlers could fall open when channel … |
Vulnerable Vulnerable |
|
GHSA-rggc-m335-3wvj
Aliases: CVE-2026-53832 |
OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers ### Summary Same-host trusted-proxy deployments could accept local forged identity … |
Vulnerable Vulnerable |
|
GHSA-83w9-h5wv-j9xm
Aliases: CVE-2026-53838 |
OpenClaw: Node pairing reconnection could confuse approval scope state ### Summary Node pairing reconnection could confuse approval scope state. In … |
Vulnerable Vulnerable |
|
GHSA-77pv-3w4q-vrj5
Aliases: CVE-2026-53834 |
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks ### Summary QQBot pre-dispatch slash commands could skip allowFrom checks. In … |
Vulnerable Vulnerable |
|
GHSA-275c-xpvc-jgfw
Aliases: CVE-2026-53830 |
OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload ### Summary Slack and Zalo webhook secrets could remain … |
Vulnerable Vulnerable |
|
GHSA-77pv-3w4q-vrj5
Aliases: CVE-2026-53834 |
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks QQBot pre-dispatch slash commands could skip allowFrom checks. In affected versions, … |
Vulnerable Vulnerable |
|
GHSA-gp79-m99v-gjmh
Aliases: CVE-2026-53837 |
OpenClaw: Mattermost handlers could fall open when channel type was missing Mattermost handlers could fall open when channel type was … |
Vulnerable Vulnerable |
|
GHSA-h36m-2vh5-x699
|
Duplicate Advisory: ACPX Windows wrapper shell fallback allowed cwd injection in specific paths ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-jw7v-5mp7-ghgm
|
Duplicate Advisory: Browser CDP discovery could accept blocked WebSocket URLs ## Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-3x84-qq85-fj65
Aliases: CVE-2026-62197 |
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs ### Summary Browser CDP discovery could accept blocked WebSocket URLs. In … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-w8g9-x8gx-crmm
|
OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable ## Impact Strict browser SSRF bypass in … |
CVE-2026-42430
|
|
GHSA-5wj5-87vq-39xm
|
OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement ## Impact Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope … |
CVE-2026-42432
|
|
GHSA-q2gc-xjqw-qp89
|
OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts ## Impact strictInlineEval explicit-approval boundary bypassed … |
CVE-2026-42423
|
|
GHSA-3vvq-q2qc-7rmp
|
OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification ## Impact B-M3: ClawHub package downloads are not enforced … |
CVE-2026-42428
|
|
GHSA-3fv3-6p2v-gxwj
|
OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths ## Impact QQ Bot Extension: Missing SSRF Protection … |
CVE-2026-41914
|
|
GHSA-cm8v-2vh9-cxf3
|
OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant) ## Impact GIT_DIR and related … |
CVE-2026-41915
|
|
GHSA-w9j9-w4cp-6wgr
|
## Impact OpenClaw Host-Exec Environment Variable Injection. Host exec could inherit environment variables that influence interpreters, shells, or build tools. … | |
|
GHSA-jf56-mccx-5f3f
|
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel ## Impact Authenticated `/hooks/wake` and … | |
|
GHSA-4f8g-77mw-3rxc
|
OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write` ## Impact Gateway plugin HTTP `auth: gateway` … |
CVE-2026-42429
|
|
GHSA-cmfr-9m2r-xwhq
|
## Impact OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard. node.invoke(browser.proxy) could mutate persistent browser profiles through a path that bypassed … |
CVE-2026-42431
|
|
GHSA-whf9-3hcx-gq54
|
## Impact OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing. Device token rotation could mint or preserve … |
CVE-2026-42422
|
|
GHSA-7437-7hg8-frrw
|
OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class) … |
CVE-2026-42427
|
|
GHSA-5fc7-f62m-8983
|
OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix) ## Impact Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy … |
CVE-2026-41911
|
|
GHSA-vr5g-mmx7-h897
|
OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation ## Impact Browser SSRF Policy Bypass via Interaction-Triggered Navigation. Browser interactions … |
CVE-2026-41912
|
|
GHSA-67mf-f936-ppxf
|
## Impact OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval. The pairing approval method accepted … |
CVE-2026-42426
|
|
GHSA-qqq7-4hxc-x63c
|
OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration ## Impact Shared … |
CVE-2026-42424
|
|
GHSA-68x5-xx89-w9mm
|
OpenClaw: resolvedAuth closure becomes stale after config reload ## Impact resolvedAuth closure becomes stale after config reload. After a config … |
CVE-2026-41916
|
|
GHSA-gfmx-pph7-g46x
|
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` … | |
|
GHSA-vc32-h5mq-453v
|
OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes ## Impact /allowlist omits owner-only enforcement for cross-channel allowlist writes. An … |
CVE-2026-41910
|
|
GHSA-5h3f-885m-v22w
|
OpenClaw: Existing WS sessions survive shared gateway token rotation ## Impact Existing WS sessions survive shared gateway token rotation. Rotating … |
CVE-2026-42421
|
|
GHSA-ccx3-fw7q-rr2r
|
OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks ## Impact Multiple Code Paths Missing Base64 Pre-Allocation Size Checks. Several … |
CVE-2026-42420
|
|
GHSA-pg8g-f2hf-x82m
|
Duplicate Advisory: OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects ### Duplicate Advisory This advisory has been withdrawn because … | |
|
GHSA-qx8j-g322-qj6m
|
OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects ## Impact `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects. A … |
CVE-2026-40037
|
|
GHSA-vr5g-mmx7-h897
|
OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation Browser SSRF Policy Bypass via Interaction-Triggered Navigation. Browser interactions could trigger … | |
|
GHSA-cmfr-9m2r-xwhq
|
OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard. node.invoke(browser.proxy) could mutate persistent browser profiles through a path that bypassed the browser.request … | |
|
GHSA-w8g9-x8gx-crmm
|
OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable Strict browser SSRF bypass in Playwright redirect … | |
|
GHSA-cm8v-2vh9-cxf3
|
OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant) GIT_DIR and related git plumbing … | |
|
GHSA-q2gc-xjqw-qp89
|
OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts strictInlineEval explicit-approval boundary bypassed by approval-timeout … | |
|
GHSA-vc32-h5mq-453v
|
OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes /allowlist omits owner-only enforcement for cross-channel allowlist writes. An authorized non-owner … | |
|
GHSA-whf9-3hcx-gq54
|
OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing. Device token rotation could mint or preserve roles/scopes that … | |
|
GHSA-5h3f-885m-v22w
|
OpenClaw: Existing WS sessions survive shared gateway token rotation Existing WS sessions survive shared gateway token rotation. Rotating the shared … | |
|
GHSA-qqq7-4hxc-x63c
|
OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration Shared reply MEDIA: … | |
|
GHSA-qx8j-g322-qj6m
|
OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects. A guarded fetch … | |
|
GHSA-5fc7-f62m-8983
|
OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix) Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete … | |
|
GHSA-4f8g-77mw-3rxc
|
OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write` Gateway plugin HTTP `auth: gateway` widens identity-bearing … | |
|
GHSA-gfmx-pph7-g46x
|
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` … | |
|
GHSA-7437-7hg8-frrw
|
OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class) … | |
|
GHSA-3vvq-q2qc-7rmp
|
OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification B-M3: ClawHub package downloads are not enforced with integrity … | |
|
GHSA-ccx3-fw7q-rr2r
|
OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks Multiple Code Paths Missing Base64 Pre-Allocation Size Checks. Several base64 decode … | |
|
GHSA-jf56-mccx-5f3f
|
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel Authenticated `/hooks/wake` and mapped `wake` … | |
|
GHSA-67mf-f936-ppxf
|
OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval. The pairing approval method accepted operator.write instead … | |
|
GHSA-68x5-xx89-w9mm
|
OpenClaw: resolvedAuth closure becomes stale after config reload resolvedAuth closure becomes stale after config reload. After a config reload, newly … | |
|
GHSA-5wj5-87vq-39xm
|
OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement. A … | |
|
GHSA-3fv3-6p2v-gxwj
|
OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths QQ Bot Extension: Missing SSRF Protection on All … |