Vulnerabilities in OpenClaw
672 resultsCVE-2026-40037HIGHOpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin RedirectsEPSS 0.3%CVE-2026-41334HIGHOpenClaw < 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard BypassEPSS 0.3%CVE-2026-32924MEDIUMOpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in FeishuEPSS 0.3%CVE-2026-34425MEDIUMOpenClaw - Shell-Bleed Protection Preflight Validation BypassEPSS 0.3%CVE-2026-32006LOWOpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Fallback in Group AllowlistEPSS 0.3%CVE-2026-53807HIGHOpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFromEPSS 0.3%CVE-2026-29612MEDIUMOpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File DecodingEPSS 0.3%CVE-2026-31993MEDIUMOpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell ChainsEPSS 0.3%CVE-2026-53817HIGHOpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device PairingEPSS 0.3%CVE-2026-53811HIGHOpenClaw < 2026.5.7 - Privilege Escalation via Mutable Display Names in Matrix allowFromEPSS 0.3%CVE-2026-41388MEDIUMOpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation HandlingEPSS 0.3%CVE-2026-41369HIGHOpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host ExecutionEPSS 0.3%CVE-2026-32046MEDIUMOpenClaw < 2026.2.21 - OS-level Sandbox Bypass via --no-sandbox FlagEPSS 0.3%CVE-2026-44996MEDIUMOpenClaw < 2026.4.15 - Arbitrary Local File Read via Webchat Audio EmbeddingEPSS 0.3%CVE-2026-100599HIGHOpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chromeEPSS 0.3%CVE-2026-35622MEDIUMOpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat WebhookEPSS 0.3%CVE-2026-35669HIGHOpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication ScopeEPSS 0.3%CVE-2026-33578MEDIUMOpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser ExtensionsEPSS 0.3%CVE-2026-100541HIGHOpenClaw Matrix before 2026.8.1 Authorization Bypass via Case FoldingEPSS 0.3%CVE-2026-28481MEDIUMOpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix MatchingEPSS 0.3%