Vulnerabilidades en OpenClaw

584 resultados
Análisis Vexday

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-62203HIGHOpenClaw < 2026.6.6 Environment Variable Injection via rustupEPSS 0.5%CVE-2026-62199HIGHOpenClaw < 2026.6.6 Authentication Bypass via Environment FilteringEPSS 0.5%CVE-2026-62200HIGHOpenClaw < 2026.6.6 Authentication Bypass via Git ext transportEPSS 0.5%CVE-2026-31995MEDIUMOpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster ExtensionEPSS 0.5%CVE-2026-62220MEDIUMOpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit BypassEPSS 0.5%CVE-2026-32064HIGHOpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC ObserverEPSS 0.5%CVE-2026-26325HIGHOpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvalsEPSS 0.5%CVE-2026-62190HIGHOpenClaw < 2026.6.9 Authorization Bypass via flock wrapperEPSS 0.5%CVE-2026-28391CRITICALOpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist EnforcementEPSS 0.5%CVE-2026-28363CRITICALIn OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compresEPSS 0.5%CVE-2026-35626MEDIUMOpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call WebhookEPSS 0.5%CVE-2026-26321HIGHOpenClaw has a local file disclosure via sendMediaFeishu in Feishu extensionEPSS 0.5%CVE-2026-45006HIGHOpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist BypassEPSS 0.5%CVE-2026-35650HIGHOpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent SanitizationEPSS 0.5%CVE-2026-27002HIGHOpenClaw: Docker container escape via unvalidated bind mount config injectionEPSS 0.5%CVE-2026-28474CRITICALOpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name SpoofingEPSS 0.5%CVE-2026-41405HIGHOpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body ParsingEPSS 0.5%CVE-2026-41374MEDIUMOpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member AuthorizationEPSS 0.5%CVE-2026-41349HIGHOpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patchEPSS 0.5%CVE-2026-41397HIGHOpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink TraversalEPSS 0.5%