Vulnerabilidades em OpenClaw

584 resultados
Análise Vexday

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-28452MEDIUMOpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchiveEPSS 0.3%CVE-2026-62193MEDIUMOpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin InstallEPSS 0.3%CVE-2026-34510MEDIUMOpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media LoadersEPSS 0.3%CVE-2026-41399HIGHOpenClaw < 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket UpgradesEPSS 0.3%CVE-2026-44994MEDIUMOpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config EndpointEPSS 0.3%CVE-2026-32913HIGHOpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin RedirectsEPSS 0.3%CVE-2026-42423HIGHOpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout FallbackEPSS 0.3%CVE-2026-41334HIGHOpenClaw < 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard BypassEPSS 0.3%CVE-2026-32002MEDIUMOpenClaw < 2026.2.23 - Sandbox Boundary Bypass via Image Tool workspaceOnly BypassEPSS 0.3%CVE-2026-26326MEDIUMOpenClaw skills.status could leak secrets to operator.read clientsEPSS 0.3%CVE-2026-35656MEDIUMOpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate LimiterEPSS 0.3%CVE-2026-53807HIGHOpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFromEPSS 0.3%CVE-2026-91836LOWOpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factorsEPSS 0.3%CVE-2026-32025HIGHOpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication BypassEPSS 0.3%CVE-2026-22178MEDIUMOpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention MetadataEPSS 0.3%CVE-2026-53817HIGHOpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device PairingEPSS 0.3%CVE-2026-32924MEDIUMOpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in FeishuEPSS 0.3%CVE-2026-53811HIGHOpenClaw < 2026.5.7 - Privilege Escalation via Mutable Display Names in Matrix allowFromEPSS 0.3%CVE-2026-41388MEDIUMOpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation HandlingEPSS 0.3%CVE-2026-41369HIGHOpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host ExecutionEPSS 0.3%