Vulnerabilidades en openclaw
663 resultadosAnálisis Vexday
A OpenClaw apresenta um portfólio de 47 vulnerabilidades, com 10 descobertas nos últimos 90 dias, indicando atividade contínua de risco. Nenhuma vulnerabilidade está sob exploração ativa registrada (KEV), mas a fraqueza dominante em path traversal (CWE-22) é crítica em ambientes com controle de acesso inadequado. Com apenas 1 vulnerabilidade crítica (CVSS), o risco permanece moderado, mas exige monitoramento nas próximas atualizações da plataforma.
CVE-2026-35668HIGHOpenClaw < 2026.3.24 - Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl ParametersEPSS 0.5%CVE-2026-29611HIGHOpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media HandlingEPSS 0.5%CVE-2026-28447HIGHOpenClaw 2026.1.29-beta.1 < 2026.2.1 - Path Traversal in Plugin Installation via Package NameEPSS 0.5%CVE-2026-53843HIGHOpenClaw < 2026.5.26 - Node Token Revocation Bypass via Pairing-Scoped Device SessionEPSS 0.5%CVE-2026-41340MEDIUMOpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom MigrationEPSS 0.5%CVE-2026-43570MEDIUMOpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path HandlingEPSS 0.5%CVE-2026-26324HIGHOpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)EPSS 0.5%CVE-2026-41354MEDIUMOpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe KeysEPSS 0.5%CVE-2026-53821HIGHOpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocketEPSS 0.5%CVE-2026-32024MEDIUMOpenClaw < 2026.2.22 - Symlink Traversal in Avatar HandlingEPSS 0.5%CVE-2026-41911MEDIUMOpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_imageEPSS 0.5%CVE-2026-35664MEDIUMOpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card CallbacksEPSS 0.5%CVE-2026-32007HIGHOpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check BypassEPSS 0.5%CVE-2026-41375HIGHOpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm EndpointsEPSS 0.5%CVE-2026-41362LOWOpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared AuthenticationEPSS 0.5%CVE-2026-34426MEDIUMOpenClaw - Approval Bypass via Environment Variable NormalizationEPSS 0.5%CVE-2026-44116MEDIUMOpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL ValidationEPSS 0.5%CVE-2026-45002MEDIUMOpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template MappingEPSS 0.5%CVE-2026-32053MEDIUMOpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID NormalizationEPSS 0.5%CVE-2026-29606MEDIUMOpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback CompatibilityEPSS 0.5%