| CVE-2026-22172 |
🟣 CRITICAL |
9.4 |
OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections |
2026-03-20 |
| CVE-2026-28466 |
🟣 CRITICAL |
9.4 |
OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass |
2026-03-05 |
| CVE-2026-32922 |
🟣 CRITICAL |
9.4 |
OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate |
2026-03-29 |
| CVE-2026-32038 |
🟣 CRITICAL |
9.3 |
OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter |
2026-03-19 |
| CVE-2026-32916 |
🟣 CRITICAL |
9.2 |
OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes |
2026-03-31 |
| CVE-2026-25253 |
🔴 HIGH |
8.8 |
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl |
2026-02-01 |
| CVE-2026-24763 |
🔴 HIGH |
8.8 |
OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable |
2026-02-02 |
| CVE-2026-32974 |
🔴 HIGH |
8.8 |
OpenClaw < 2026.3.12 - Forged Event Injection via Feishu Webhook Verification Token |
2026-03-29 |
| CVE-2026-28478 |
🔴 HIGH |
8.7 |
OpenClaw affected by denial of service via unbounded webhook request body buffering |
2026-03-05 |
| CVE-2026-32049 |
🔴 HIGH |
8.7 |
OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass |
2026-03-21 |
| CVE-2026-32062 |
🔴 HIGH |
8.7 |
OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream |
2026-03-11 |
| CVE-2026-35663 |
🔴 HIGH |
8.7 |
OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim |
2026-04-10 |
| CVE-2026-33579 |
🔴 HIGH |
8.6 |
OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval |
2026-03-31 |
| CVE-2026-34503 |
🔴 HIGH |
8.6 |
OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation |
2026-03-31 |
| CVE-2026-35643 |
🔴 HIGH |
8.6 |
OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface |
2026-04-10 |
| CVE-2026-32064 |
🔴 HIGH |
8.5 |
OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer |
2026-03-21 |
| CVE-2026-32004 |
🔴 HIGH |
8.3 |
OpenClaw < 2026.3.2 - Authentication Bypass via Encoded Path in /api/channels Route |
2026-03-19 |
| CVE-2026-35618 |
🔴 HIGH |
8.3 |
OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification |
2026-04-09 |
| CVE-2026-28469 |
🔴 HIGH |
8.2 |
OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting |
2026-03-05 |
| CVE-2026-29613 |
🔴 HIGH |
8.2 |
OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust |
2026-03-05 |
| CVE-2026-25157 |
🔴 HIGH |
7.8 |
OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand |
2026-02-04 |
| CVE-2026-32048 |
🔴 HIGH |
7.7 |
OpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn |
2026-03-21 |
| CVE-2026-32056 |
🔴 HIGH |
7.7 |
OpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run |
2026-03-21 |
| CVE-2026-35666 |
🔴 HIGH |
7.7 |
OpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch Wrapper |
2026-04-10 |
| CVE-2026-32007 |
🔴 HIGH |
7.6 |
OpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass |
2026-03-19 |
| CVE-2026-25474 |
🔴 HIGH |
7.5 |
OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass |
2026-02-19 |
| CVE-2026-28485 |
🔴 HIGH |
7.5 |
OpenClaw 2026.1.5 < 2026.2.12 - Missing Authentication in Browser Control HTTP Endpoints |
2026-03-05 |
| CVE-2026-32041 |
🔴 HIGH |
7.5 |
OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap |
2026-03-19 |
| CVE-2026-28458 |
🔴 HIGH |
7.4 |
OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access |
2026-03-05 |
| CVE-2026-26320 |
🔴 HIGH |
7.1 |
OpenClaw macOS deep link confirmation truncation can conceal executed agent message |
2026-02-19 |
| CVE-2026-26329 |
🔴 HIGH |
7.1 |
OpenClaw has a path traversal in browser upload allows local file read |
2026-02-19 |
| CVE-2026-26317 |
🔴 HIGH |
7.1 |
OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints |
2026-02-19 |
| CVE-2026-22175 |
🔴 HIGH |
7.1 |
OpenClaw < 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell Wrappers |
2026-03-18 |
| CVE-2026-31992 |
🔴 HIGH |
7.1 |
OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S |
2026-03-19 |
| CVE-2026-32976 |
🔴 HIGH |
7.1 |
OpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands |
2026-03-31 |
| CVE-2026-35631 |
🔴 HIGH |
7.1 |
OpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat Commands |
2026-04-09 |
| CVE-2026-35644 |
🔴 HIGH |
7.1 |
OpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots |
2026-04-09 |
| CVE-2026-40037 |
🔴 HIGH |
7.1 |
OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects |
2026-04-08 |
| CVE-2026-27004 |
🟡 MEDIUM |
6.9 |
OpenClaw session tool visibility hardening and Telegram webhook secret fallback |
2026-02-19 |
| CVE-2026-28480 |
🟡 MEDIUM |
6.9 |
OpenClaw Telegram allowlist authorization accepted mutable usernames |
2026-03-05 |
| CVE-2026-31994 |
🟡 MEDIUM |
6.9 |
OpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generation |
2026-03-19 |
| CVE-2026-32924 |
🟡 MEDIUM |
6.9 |
OpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in Feishu |
2026-03-29 |
| CVE-2026-35626 |
🟡 MEDIUM |
6.9 |
OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook |
2026-04-09 |
| CVE-2026-35632 |
🟡 MEDIUM |
6.9 |
OpenClaw < 2026.2.22 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update |
2026-04-09 |
| CVE-2026-35637 |
🟡 MEDIUM |
6.9 |
OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM |
2026-04-09 |
| CVE-2026-35654 |
🟡 MEDIUM |
6.9 |
OpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke |
2026-04-10 |
| CVE-2026-35664 |
🟡 MEDIUM |
6.9 |
OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks |
2026-04-10 |
| CVE-2026-41301 |
🟡 MEDIUM |
6.9 |
OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass |
2026-04-20 |
| CVE-2026-41335 |
🟡 MEDIUM |
6.9 |
OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON |
2026-04-23 |
| CVE-2026-41343 |
🟡 MEDIUM |
6.9 |
OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency |
2026-04-23 |
| CVE-2026-27008 |
🟡 MEDIUM |
6.8 |
OpenClaw hardened the skill download target directory validation |
2026-02-19 |
| CVE-2026-29612 |
🟡 MEDIUM |
6.8 |
OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding |
2026-03-05 |
| CVE-2026-33572 |
🟡 MEDIUM |
6.8 |
OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript Files |
2026-03-29 |
| CVE-2026-28452 |
🟡 MEDIUM |
6.7 |
OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR) |
2026-03-05 |
| CVE-2026-26328 |
🟡 MEDIUM |
6.5 |
OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities |
2026-02-19 |
| CVE-2026-28475 |
🟡 MEDIUM |
6.3 |
OpenClaw < 2026.2.13 - Timing Attack via Hook Token Comparison |
2026-03-05 |
| CVE-2026-32897 |
🟡 MEDIUM |
6.3 |
OpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallback |
2026-03-21 |
| CVE-2026-35635 |
🟡 MEDIUM |
6.3 |
OpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat |
2026-04-09 |
| CVE-2026-35628 |
🟡 MEDIUM |
6.3 |
OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting |
2026-04-09 |
| CVE-2026-35649 |
🟡 MEDIUM |
6.3 |
OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist |
2026-04-10 |
| CVE-2026-35646 |
🟡 MEDIUM |
6.3 |
OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation |
2026-04-09 |
| CVE-2026-41333 |
🟡 MEDIUM |
6.3 |
OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken |
2026-04-23 |
| CVE-2026-41337 |
🟡 MEDIUM |
6.3 |
OpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay |
2026-04-23 |
| CVE-2026-41354 |
🟡 MEDIUM |
6.3 |
OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys |
2026-04-23 |
| CVE-2026-41340 |
🟡 MEDIUM |
6.3 |
OpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration |
2026-04-23 |
| CVE-2026-22181 |
🟡 MEDIUM |
6.1 |
OpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetch |
2026-03-18 |
| CVE-2026-32034 |
🟡 MEDIUM |
6.1 |
OpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP |
2026-03-19 |
| CVE-2026-32002 |
🟡 MEDIUM |
6 |
OpenClaw < 2026.2.23 - Sandbox Boundary Bypass via Image Tool workspaceOnly Bypass |
2026-03-19 |
| CVE-2026-32033 |
🟡 MEDIUM |
6 |
OpenClaw < 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validation |
2026-03-19 |
| CVE-2026-32057 |
🟡 MEDIUM |
6 |
OpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id Parameter |
2026-03-21 |
| CVE-2026-35670 |
🟡 MEDIUM |
6 |
OpenClaw < 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology Chat |
2026-04-10 |
| CVE-2026-41363 |
🟡 MEDIUM |
6 |
OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter |
2026-04-27 |
| CVE-2026-28481 |
🟡 MEDIUM |
5.9 |
OpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matching |
2026-03-05 |
| CVE-2026-40045 |
🟡 MEDIUM |
5.9 |
OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws:// |
2026-04-20 |
| CVE-2026-27670 |
🟡 MEDIUM |
5.8 |
OpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition |
2026-03-19 |
| CVE-2026-32010 |
🟡 MEDIUM |
5.8 |
OpenClaw < 2026.2.22 - Allowlist Bypass via sort --compress-program Parameter |
2026-03-19 |
| CVE-2026-32977 |
🟡 MEDIUM |
5.8 |
OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path |
2026-03-31 |
| CVE-2026-32065 |
🟡 MEDIUM |
5.7 |
OpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command Execution |
2026-03-21 |
| CVE-2026-29608 |
🟡 MEDIUM |
5.4 |
OpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting |
2026-03-19 |
| CVE-2026-32899 |
🟡 MEDIUM |
5.3 |
OpenClaw < 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event Handlers |
2026-03-21 |
| CVE-2026-32895 |
🟡 MEDIUM |
5.3 |
OpenClaw < 2026.2.26 - Sender Authorization Bypass in Slack System Event Handlers |
2026-03-21 |
| CVE-2026-32898 |
🟡 MEDIUM |
5.3 |
OpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata |
2026-03-21 |
| CVE-2026-33578 |
🟡 MEDIUM |
5.3 |
OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions |
2026-03-31 |
| CVE-2026-35619 |
🟡 MEDIUM |
5.3 |
OpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint |
2026-04-10 |
| CVE-2026-35620 |
🟡 MEDIUM |
5.3 |
OpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commands |
2026-04-10 |
| CVE-2026-35642 |
🟡 MEDIUM |
5.3 |
OpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass |
2026-04-09 |
| CVE-2026-41339 |
🟡 MEDIUM |
5.3 |
OpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect Snapshot |
2026-04-23 |
| CVE-2026-41350 |
🟡 MEDIUM |
5.3 |
OpenClaw < 2026.3.31 - Session Visibility Bypass via session_status in Unsandboxed Invocations |
2026-04-23 |
| CVE-2026-41365 |
🟡 MEDIUM |
5.3 |
OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History |
2026-04-27 |
| CVE-2026-41367 |
🟡 MEDIUM |
5.3 |
OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions |
2026-04-27 |
| CVE-2026-35634 |
🟡 MEDIUM |
5.1 |
OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway |
2026-04-09 |
| CVE-2026-27007 |
🟡 MEDIUM |
4.8 |
OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation |
2026-02-19 |
| CVE-2026-27576 |
🟡 MEDIUM |
4.8 |
OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs |
2026-02-21 |
| CVE-2026-32046 |
🟡 MEDIUM |
4.8 |
OpenClaw < 2026.2.21 - OS-level Sandbox Bypass via --no-sandbox Flag |
2026-03-21 |
| CVE-2026-32020 |
🟡 MEDIUM |
4.8 |
OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler |
2026-03-19 |
| CVE-2026-27486 |
🟡 MEDIUM |
4.3 |
OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup |
2026-02-21 |
| CVE-2026-24764 |
🟢 LOW |
3.7 |
OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions |
2026-02-19 |
| CVE-2026-32006 |
🟢 LOW |
2.3 |
OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Fallback in Group Allowlist |
2026-03-19 |
| CVE-2026-32037 |
🟢 LOW |
2.3 |
OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling |
2026-03-19 |
| CVE-2026-41341 |
🟢 LOW |
2.3 |
OpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord Extension |
2026-04-23 |
| CVE-2026-41347 |
🟢 LOW |
2.3 |
OpenClaw < 2026.3.31 - Cross-Site Request Forgery via Missing Browser-Origin Validation in HTTP Operator Endpoints |
2026-04-23 |
| CVE-2026-41348 |
🟢 LOW |
2.3 |
OpenClaw < 2026.3.31 - Group DM Channel Allowlist Bypass via Discord Slash Commands |
2026-04-23 |
| CVE-2026-41362 |
🟢 LOW |
2.3 |
OpenClaw 2026.2.19 < 2026.3.31 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication |
2026-04-27 |
| CVE-2026-31991 |
🟢 LOW |
2 |
OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist |
2026-03-19 |
| CVE-2026-32067 |
🟢 LOW |
2 |
OpenClaw < 2026.2.26 - Cross-Account Authorization Bypass in DM Pairing Store |
2026-03-21 |
| CVE-2026-32970 |
🟢 LOW |
2 |
OpenClaw < 2026.3.11 - Credential Fallback Logic Bypass via Unavailable Local Auth SecretRefs |
2026-03-31 |