Vulnerabilities in OpenClaw
672 resultsCVE-2026-32846HIGHOpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File ReadEPSS 0.7%CVE-2026-101880HIGHOpenClaw Windows Node before 2026.7.1 Authorization BypassEPSS 0.7%CVE-2026-32013HIGHOpenClaw < 2026.2.25 - Symlink Traversal in agents.files MethodsEPSS 0.7%CVE-2026-22176MEDIUMOpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script GenerationEPSS 0.7%CVE-2026-3690HIGHOpenClaw Canvas Authentication Bypass VulnerabilityEPSS 0.7%CVE-2026-22179HIGHOpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.runEPSS 0.7%CVE-2026-101882HIGHOpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.setEPSS 0.7%CVE-2026-32000MEDIUMOpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool ExecutionEPSS 0.7%CVE-2026-31994MEDIUMOpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script GenerationEPSS 0.6%CVE-2026-35653HIGHOpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.requestEPSS 0.6%CVE-2026-22172CRITICALOpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth ConnectionsEPSS 0.6%CVE-2026-32056HIGHOpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.runEPSS 0.6%CVE-2026-28391CRITICALOpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist EnforcementEPSS 0.6%CVE-2026-100560HIGHOpenClaw before 2026.8.1 Reusable Exec Approvals Authorization BypassEPSS 0.6%CVE-2026-33581HIGHOpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl ParametersEPSS 0.6%CVE-2026-62207HIGHOpenClaw < 2026.6.5 Authentication Bypass via Admin ToolsEPSS 0.6%CVE-2026-32003HIGHOpenClaw < 2026.2.22 - Remote Code Execution via SHELLOPTS/PS4 Environment Injection in system.runEPSS 0.6%CVE-2026-31995MEDIUMOpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster ExtensionEPSS 0.6%CVE-2026-28474CRITICALOpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name SpoofingEPSS 0.6%CVE-2026-32049HIGHOpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit BypassEPSS 0.6%