Openclaw vulnerabilities
672 CVEs and advisories name Openclaw as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-22176OpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script Generation
- CVE-2026-27545OpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind
- CVE-2026-27524OpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Path
- CVE-2026-27523OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths
- CVE-2026-27522OpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions
- CVE-2026-22217OpenClaw 2026.2.22 < 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix Fallback
- CVE-2026-22181OpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetch
- CVE-2026-22180OpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write Operations
- CVE-2026-22179OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.run
- CVE-2026-22178OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata
- CVE-2026-22177OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars
- CVE-2026-22175OpenClaw < 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell Wrappers
- CVE-2026-22174OpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP Probe
- CVE-2026-22171OpenClaw < 2026.2.19 - Path Traversal in Feishu Media Temporary File Naming
- CVE-2026-22170OpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom Configuration
- CVE-2026-22169OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins
- CVE-2026-22168OpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.run
- CVE-2026-32302OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode
- CVE-2026-32063OpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit Generation
- CVE-2026-32062OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream
- CVE-2026-32061OpenClaw < 2026.2.17 - Arbitrary File Read via $include Directive Path Traversal
- CVE-2026-32060OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths
- CVE-2026-32059OpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBins
- CVE-2026-29613OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust
- CVE-2026-29612OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding
- CVE-2026-29611OpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media Handling
- CVE-2026-29610OpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH Handling
- CVE-2026-29609OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch
- CVE-2026-29606OpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibility
- CVE-2026-28486OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation Commands