Openclaw vulnerabilities
672 CVEs and advisories name Openclaw as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-100583OpenClaw Discord before 2026.7.1 Authorization Bypass
- CVE-2026-100582OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass
- CVE-2026-100581OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension
- CVE-2026-100580OpenClaw before 2026.7.1 Remote Code Execution via cron tool
- CVE-2026-100579OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester
- CVE-2026-100578OpenClaw before 2026.7.1 Authorization Bypass via chat.send
- CVE-2026-100577OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset
- CVE-2026-100576OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates
- CVE-2026-100575OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM
- CVE-2026-100574OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS
- CVE-2026-100573OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback
- CVE-2026-100572OpenClaw before 2026.8.1 Denial of Service via Rate Limit
- CVE-2026-100571OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
- CVE-2026-100570OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS
- CVE-2026-100569OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override
- CVE-2026-100568OpenClaw before 2026.8.1 Unauthorized Command Job Access
- CVE-2026-100567OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname
- CVE-2026-100566OpenClaw LINE before 2026.8.1 Access Control Inheritance
- CVE-2026-100564OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export
- CVE-2026-100563OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
- CVE-2026-100562OpenClaw before 2026.8.1 Authorization Bypass via sessions.create
- CVE-2026-100561OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
- CVE-2026-100560OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass
- CVE-2026-100559OpenClaw before 2026.8.1 Command Injection via Escaped Newlines
- CVE-2026-100558OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade
- CVE-2026-100557OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch
- CVE-2026-100556OpenClaw before 2026.8.1 Authentication Bypass via Session Reset
- CVE-2026-100555OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
- CVE-2026-100554OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
- CVE-2026-100553OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin