Vulnerabilities in OpenClaw

584 results
Vexday analysis

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-41353HIGHOpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime SelectionEPSS 0.3%CVE-2026-32057MEDIUMOpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id ParameterEPSS 0.3%CVE-2026-62197MEDIUMOpenClaw < 2026.6.6 Policy Bypass via CDP DiscoveryEPSS 0.3%CVE-2026-62226MEDIUMOpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act RouteEPSS 0.3%CVE-2026-22175HIGHOpenClaw < 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell WrappersEPSS 0.3%CVE-2026-43528HIGHOpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig AliasesEPSS 0.3%CVE-2026-34503HIGHOpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token RevocationEPSS 0.3%CVE-2026-41375HIGHOpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm EndpointsEPSS 0.3%CVE-2026-32920HIGHOpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace PluginsEPSS 0.3%CVE-2026-41351MEDIUMOpenClaw < 2026.3.31 - Webhook Replay Detection Bypass via Base64 Signature Re-encodingEPSS 0.3%CVE-2026-62186HIGHOpenClaw < 2026.6.8 Authorization Bypass via HTTP Model OverrideEPSS 0.3%CVE-2026-41386CRITICALOpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup CodesEPSS 0.3%CVE-2026-35665MEDIUMOpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body ParsingEPSS 0.3%CVE-2026-32024MEDIUMOpenClaw < 2026.2.22 - Symlink Traversal in Avatar HandlingEPSS 0.3%CVE-2026-41911MEDIUMOpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_imageEPSS 0.3%CVE-2026-26316HIGHOpenClaw has BlueBubbles webhook auth bypass via loopback proxy trustEPSS 0.3%CVE-2026-35632MEDIUMOpenClaw <= 2026.2.22 - Symlink Traversal via IDENTITY.md appendFile in agents.create/updateEPSS 0.3%CVE-2026-43570MEDIUMOpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path HandlingEPSS 0.3%CVE-2026-32055HIGHOpenClaw < 2026.2.26 - Workspace Path Boundary Bypass via Non-existent SymlinkEPSS 0.3%CVE-2026-31998HIGHOpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIdsEPSS 0.3%