Openclaw vulnerabilities
672 CVEs and advisories name Openclaw as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-100552OpenClaw before 2026.8.1 Policy Bypass via Native Tools
- CVE-2026-100551OpenClaw iOS Control UI TLS Pin Enforcement Bypass
- CVE-2026-100550OpenClaw before 2026.8.1 Authentication Bypass via Access Group
- CVE-2026-100549OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames
- CVE-2026-100548OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback
- CVE-2026-100547OpenClaw before 2026.8.1 Authentication Bypass via File URL
- CVE-2026-100546OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript
- CVE-2026-100545OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation
- CVE-2026-100544openclaw voice-call before 2026.8.1 Authorization Bypass
- CVE-2026-100543OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash
- CVE-2026-100542OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2
- CVE-2026-100541OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding
- CVE-2026-100540OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account
- CVE-2026-100539OpenClaw before 2026.8.1 Memory Access Control Bypass
- CVE-2026-100538OpenClaw before 2026.8.1 Local File Read via Outbound Attachments
- CVE-2026-100537OpenClaw before 2026.8.1 Authentication Bypass via Active Memory
- CVE-2026-100536OpenClaw before 2026.8.1 Path Traversal via Structured Attachments
- CVE-2026-100535OpenClaw before 2026.8.1 Privilege Escalation via Session Memory
- CVE-2026-100534OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass
- CVE-2026-100533OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback
- CVE-2026-100532openclaw WhatsApp before 2026.8.1 Authentication Bypass
- CVE-2026-100531openclaw Slack before 2026.8.1 Authorization Bypass
- CVE-2026-100530OpenClaw before 2026.8.1 Exec Approval Directory Binding
- CVE-2026-100529OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer
- CVE-2026-100528OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint
- CVE-2026-100527OpenClaw before 2026.8.2 Denial of Service via Browser Relay
- CVE-2026-100526Vulnerability in discord
- CVE-2026-100525OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass
- CVE-2026-95815OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging
- CVE-2026-91836OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors