Vulnerabilities in openclaw

663 results
Vexday analysis

A OpenClaw apresenta um portfólio de 47 vulnerabilidades, com 10 descobertas nos últimos 90 dias, indicando atividade contínua de risco. Nenhuma vulnerabilidade está sob exploração ativa registrada (KEV), mas a fraqueza dominante em path traversal (CWE-22) é crítica em ambientes com controle de acesso inadequado. Com apenas 1 vulnerabilidade crítica (CVSS), o risco permanece moderado, mas exige monitoramento nas próximas atualizações da plataforma.

CVE-2026-32970LOWOpenClaw < 2026.3.11 - Credential Fallback Logic Bypass via Unavailable Local Auth SecretRefsEPSS 0.1%CVE-2026-45003MEDIUMOpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv FilesEPSS 0.1%CVE-2026-53832HIGHOpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy ConfigurationEPSS 0.1%CVE-2026-32918CRITICALOpenClaw < 2026.3.11 - Session Sandbox Escape via session_status ToolEPSS 0.1%CVE-2026-100593MEDIUMOpenClaw before 2026.7.1 Authentication Bypass via activationEPSS 0.1%CVE-2026-100577MEDIUMOpenClaw before 2026.8.1 Server-Side Request Forgery via Video AssetEPSS 0.1%CVE-2026-53818MEDIUMOpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP LoopbackEPSS 0.1%CVE-2026-27545MEDIUMOpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory RebindEPSS 0.1%CVE-2026-53820MEDIUMOpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session SpawnEPSS 0.1%CVE-2026-41332MEDIUMOpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable BlocklistEPSS 0.1%CVE-2026-53850MEDIUMOpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus CommandEPSS 0.1%CVE-2026-53856MEDIUMOpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.jsonEPSS 0.1%CVE-2026-32919MEDIUMOpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash CommandsEPSS 0.1%CVE-2026-53809MEDIUMOpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner PolicyEPSS 0.1%CVE-2026-35641HIGHOpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook InstallationEPSS 0.1%CVE-2026-100570HIGHOpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGSEPSS 0.1%CVE-2026-32043MEDIUMOpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd ParameterEPSS 0.1%CVE-2026-22180MEDIUMOpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write OperationsEPSS 0.1%CVE-2026-53862LOWOpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope WideningEPSS 0.1%CVE-2026-22174MEDIUMOpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP ProbeEPSS 0.1%