Vulnerabilities in openclaw

663 results
Vexday analysis

A OpenClaw apresenta um portfólio de 47 vulnerabilidades, com 10 descobertas nos últimos 90 dias, indicando atividade contínua de risco. Nenhuma vulnerabilidade está sob exploração ativa registrada (KEV), mas a fraqueza dominante em path traversal (CWE-22) é crítica em ambientes com controle de acesso inadequado. Com apenas 1 vulnerabilidade crítica (CVSS), o risco permanece moderado, mas exige monitoramento nas próximas atualizações da plataforma.

CVE-2026-32044MEDIUMOpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills InstallationEPSS 0.2%CVE-2026-100550MEDIUMOpenClaw before 2026.8.1 Authentication Bypass via Access GroupEPSS 0.2%CVE-2026-41294HIGHOpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env FileEPSS 0.2%CVE-2026-100562MEDIUMOpenClaw before 2026.8.1 Authorization Bypass via sessions.createEPSS 0.2%CVE-2026-100564MEDIUMOpenClaw before 2026.8.1 CSV Formula Injection via Attendance ExportEPSS 0.2%CVE-2026-100537LOWOpenClaw before 2026.8.1 Authentication Bypass via Active MemoryEPSS 0.2%CVE-2026-100563MEDIUMOpenClaw before 2026.8.1 CSV Formula Injection via Session LabelsEPSS 0.2%CVE-2026-45224MEDIUMCrabbox < 0.9.0 Path Traversal via Islo Provider Workspace ResolutionEPSS 0.2%CVE-2026-44114HIGHOpenClaw < 2026.4.20 - Environment Variable Namespace Collision via Workspace dotenvEPSS 0.2%CVE-2026-41396HIGHOpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust RootEPSS 0.2%CVE-2026-100530HIGHOpenClaw before 2026.8.1 Exec Approval Directory BindingEPSS 0.2%CVE-2026-41341LOWOpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord ExtensionEPSS 0.2%CVE-2026-53858HIGHOpenClaw < 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE_DIRECTORY Environment VariableEPSS 0.2%CVE-2026-35659MEDIUMOpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD DiscoveryEPSS 0.2%CVE-2026-100583MEDIUMOpenClaw Discord before 2026.7.1 Authorization BypassEPSS 0.2%CVE-2026-100546MEDIUMOpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice TranscriptEPSS 0.2%CVE-2026-29608MEDIUMOpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv RewritingEPSS 0.2%CVE-2026-32061MEDIUMOpenClaw < 2026.2.17 - Arbitrary File Read via $include Directive Path TraversalEPSS 0.2%CVE-2026-41373MEDIUMOpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution PolicyEPSS 0.2%CVE-2026-28482HIGHOpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile ParametersEPSS 0.2%