Vulnerabilidades em OpenClaw

584 resultados
Análise Vexday

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-25593HIGHOpenClaw Affected by Unauthenticated Local RCE via WebSocket config.applyEPSS 0.7%CVE-2026-28446CRITICALOpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix MatchingEPSS 0.7%CVE-2026-32013HIGHOpenClaw < 2026.2.25 - Symlink Traversal in agents.files MethodsEPSS 0.6%CVE-2026-22176MEDIUMOpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script GenerationEPSS 0.6%CVE-2026-22179HIGHOpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.runEPSS 0.6%CVE-2026-32000MEDIUMOpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool ExecutionEPSS 0.6%CVE-2026-35653HIGHOpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.requestEPSS 0.6%CVE-2026-31994MEDIUMOpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script GenerationEPSS 0.6%CVE-2026-62207HIGHOpenClaw < 2026.6.5 Authentication Bypass via Admin ToolsEPSS 0.6%CVE-2026-22172CRITICALOpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth ConnectionsEPSS 0.6%CVE-2026-32056HIGHOpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.runEPSS 0.6%CVE-2026-33581HIGHOpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl ParametersEPSS 0.6%CVE-2026-41352HIGHOpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate BypassEPSS 0.5%CVE-2026-62202HIGHOpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via CronEPSS 0.5%CVE-2026-32049HIGHOpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit BypassEPSS 0.5%CVE-2026-43585CRITICALOpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef ResolutionEPSS 0.5%CVE-2026-41364HIGHOpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar UploadEPSS 0.5%CVE-2026-41400MEDIUMOpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-callEPSS 0.5%CVE-2026-32980HIGHOpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook RequestEPSS 0.5%CVE-2026-32003HIGHOpenClaw < 2026.2.22 - Remote Code Execution via SHELLOPTS/PS4 Environment Injection in system.runEPSS 0.5%