Vulnerabilidades em OpenClaw

672 resultados
Análise Vexday

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-32017MEDIUMOpenClaw < 2026.2.19 - Arbitrary File Write via Short-Option Bypass in exec AllowlistEPSS 0.3%CVE-2026-41362LOWOpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared AuthenticationEPSS 0.3%CVE-2026-32897MEDIUMOpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing FallbackEPSS 0.3%CVE-2026-59261HIGHOpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv FilesEPSS 0.3%CVE-2026-34506LOWOpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist ConfigurationEPSS 0.3%CVE-2026-53866HIGHOpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command ParsingEPSS 0.3%CVE-2026-35651MEDIUMOpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval PromptEPSS 0.3%CVE-2026-22170MEDIUMOpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom ConfigurationEPSS 0.3%CVE-2026-62198MEDIUMOpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web SearchEPSS 0.3%CVE-2026-34426MEDIUMOpenClaw - Approval Bypass via Environment Variable NormalizationEPSS 0.3%CVE-2026-27523MEDIUMOpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf PathsEPSS 0.3%CVE-2026-100532HIGHopenclaw WhatsApp before 2026.8.1 Authentication BypassEPSS 0.3%CVE-2026-100604MEDIUMClawHub Authentication Bypass via Former Publisher Skill ControlEPSS 0.3%CVE-2026-35636HIGHOpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId ResolutionEPSS 0.3%CVE-2026-28471MEDIUMOpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix PluginEPSS 0.3%CVE-2026-32898MEDIUMOpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool MetadataEPSS 0.3%CVE-2026-42436MEDIUMOpenClaw < 2026.4.14 - Internal Page Content Exposure via Browser Snapshot and Screenshot RoutesEPSS 0.3%CVE-2026-53828HIGHOpenClaw < 2026.5.6 - Native Command Authorization Bypass via Owner-Command EnforcementEPSS 0.3%CVE-2026-53849HIGHOpenClaw < 2026.5.7 - Privilege Escalation via Mutable Discord Display Names in allowFromEPSS 0.3%CVE-2026-41402LOWOpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope BypassEPSS 0.3%