Openclaw vulnerabilities
672 CVEs and advisories name Openclaw as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-110689OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism
- CVE-2026-101884OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override
- CVE-2026-101883OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present
- CVE-2026-101882OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
- CVE-2026-101881OpenClaw Windows Node before 2026.7.1 Denial of Service
- CVE-2026-101880OpenClaw Windows Node before 2026.7.1 Authorization Bypass
- CVE-2026-101879OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
- CVE-2026-102807OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket
- CVE-2026-102806OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines
- CVE-2026-100604ClawHub Authentication Bypass via Former Publisher Skill Control
- CVE-2026-100603ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports
- CVE-2026-100602ClawHub Changelog Preview Information Disclosure via Authorization Bypass
- CVE-2026-100601ClawHub SSRF via Unchecked DNS Resolution in Profile Image
- CVE-2026-100600ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API
- CVE-2026-100599OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome
- CVE-2026-100598OpenClaw before 2026.7.1 Approval Binding Logic Error
- CVE-2026-100597OpenClaw before 2026.7.1 Path Traversal via Filesystem Race
- CVE-2026-100596OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration
- CVE-2026-100595OpenClaw before 2026.7.1 Authorization Bypass via diagnostics
- CVE-2026-100594OpenClaw before 2026.7.1 Authorization Bypass via trajectory export
- CVE-2026-100593OpenClaw before 2026.7.1 Authentication Bypass via activation
- CVE-2026-100592OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming
- CVE-2026-100591OpenClaw before 2026.7.1 Authentication Bypass via Active Memory
- CVE-2026-100590OpenClaw before 2026.7.1 Authorization Bypass via voice set
- CVE-2026-100589OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node
- CVE-2026-100588OpenClaw before 2026.7.1 Authentication Bypass via node.invoke
- CVE-2026-100587OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
- CVE-2026-100586OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind
- CVE-2026-100585OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel
- CVE-2026-100584OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows