Vulnerabilities in OpenClaw

672 results
CVE-2026-32023MEDIUMOpenClaw < 2026.2.24 - Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in system.runEPSS 0.3%CVE-2026-100603HIGHClawHub before 8c2de6c506 Skill Hiding via Coordinated ReportsEPSS 0.3%CVE-2026-35638HIGHOpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UIEPSS 0.3%CVE-2026-35618HIGHOpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 VerificationEPSS 0.3%CVE-2026-32972HIGHOpenClaw < 2026.3.11 - Authorization Bypass in Browser Profile Management via browser.requestEPSS 0.3%CVE-2026-62216LOWOpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media UploadEPSS 0.3%CVE-2026-44116MEDIUMOpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL ValidationEPSS 0.3%CVE-2026-100533MEDIUMOpenClaw before 2026.8.1 Path Traversal via Unicode FallbackEPSS 0.3%CVE-2026-35649MEDIUMOpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty AllowlistEPSS 0.3%CVE-2026-45005MEDIUMOpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After RotationEPSS 0.3%CVE-2026-53821HIGHOpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocketEPSS 0.3%CVE-2026-43578CRITICALOpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner DowngradeEPSS 0.3%CVE-2026-44110HIGHOpenClaw < 2026.4.15 - Authorization Bypass in Matrix Room Control Commands via DM Pairing StoreEPSS 0.3%CVE-2026-41394HIGHOpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth RoutesEPSS 0.3%CVE-2026-35663HIGHOpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-ClaimEPSS 0.3%CVE-2026-35664MEDIUMOpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card CallbacksEPSS 0.3%CVE-2026-35645MEDIUMOpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSessionEPSS 0.3%CVE-2026-32001MEDIUMOpenClaw < 2026.2.22 - Node Role Device-Identity Bypass via WebSocket AuthenticationEPSS 0.3%CVE-2026-41339MEDIUMOpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect SnapshotEPSS 0.3%CVE-2026-35660HIGHOpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session ResetEPSS 0.3%