Openclaw vulnerabilities
672 CVEs and advisories name Openclaw as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-35637OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM
- CVE-2026-35636OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution
- CVE-2026-35635OpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat
- CVE-2026-35634OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway
- CVE-2026-35633OpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responses
- CVE-2026-35632OpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update
- CVE-2026-35631OpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat Commands
- CVE-2026-35629OpenClaw < 2026.3.25 - Server-Side Request Forgery via Unguarded Configured Base URLs in Channel Extensions
- CVE-2026-35628OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting
- CVE-2026-35627OpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM Handling
- CVE-2026-35626OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook
- CVE-2026-35625OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect
- CVE-2026-35624OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk
- CVE-2026-35623OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limiting
- CVE-2026-35622OpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat Webhook
- CVE-2026-35618OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification
- CVE-2026-35617OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName
- CVE-2026-34512OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint
- CVE-2026-40037OpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects
- CVE-2026-34511OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter
- CVE-2026-34426OpenClaw - Approval Bypass via Environment Variable Normalization
- CVE-2026-34425OpenClaw - Shell-Bleed Protection Preflight Validation Bypass
- CVE-2026-34510OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders
- CVE-2026-34504OpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Provider
- CVE-2026-34503OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation
- CVE-2026-33581OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters
- CVE-2026-33580OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication
- CVE-2026-33579OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval
- CVE-2026-33578OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions
- CVE-2026-33577OpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve