Openclaw vulnerabilities
672 CVEs and advisories name Openclaw as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-62199OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering
- CVE-2026-62198OpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web Search
- CVE-2026-62197OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery
- CVE-2026-62196OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs
- CVE-2026-62195OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback
- CVE-2026-62194OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install
- CVE-2026-62193OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install
- CVE-2026-62192OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass
- CVE-2026-62191OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations
- CVE-2026-62190OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper
- CVE-2026-62189OpenClaw < 2026.6.9 Symlink Following via Mirror Sync
- CVE-2026-62188OpenClaw < 2026.6.9 Feishu Authorization Bypass
- CVE-2026-62187OpenClaw < 2026.6.9 Feishu tools Authorization Bypass
- CVE-2026-62186OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override
- CVE-2026-59261OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files
- CVE-2026-53866OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing
- CVE-2026-53865OpenClaw < 2026.5.2 - Arbitrary Command Execution via Workspace-Derived Service PATH
- CVE-2026-53864OpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control Variables
- CVE-2026-53863OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy
- CVE-2026-53862OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening
- CVE-2026-53861OpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOS
- CVE-2026-53860OpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubbles
- CVE-2026-53859OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency
- CVE-2026-53858OpenClaw < 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE_DIRECTORY Environment Variable
- CVE-2026-53857OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy
- CVE-2026-53856OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json
- CVE-2026-53855OpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checks
- CVE-2026-53854OpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commands
- CVE-2026-53853OpenClaw < 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOS
- CVE-2026-53852OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing