Vulnerabilidades em OpenClaw

584 resultados
Análise Vexday

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-26327HIGHOpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinningEPSS 0.1%CVE-2026-41332MEDIUMOpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable BlocklistEPSS 0.1%CVE-2026-45003MEDIUMOpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv FilesEPSS 0.1%CVE-2026-32970LOWOpenClaw < 2026.3.11 - Credential Fallback Logic Bypass via Unavailable Local Auth SecretRefsEPSS 0.1%CVE-2026-27646MEDIUMOpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn CommandEPSS 0.1%CVE-2026-53832HIGHOpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy ConfigurationEPSS 0.1%CVE-2026-32918CRITICALOpenClaw < 2026.3.11 - Session Sandbox Escape via session_status ToolEPSS 0.1%CVE-2026-32043MEDIUMOpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd ParameterEPSS 0.1%CVE-2026-32919MEDIUMOpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash CommandsEPSS 0.1%CVE-2026-53818MEDIUMOpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP LoopbackEPSS 0.1%CVE-2026-27545MEDIUMOpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory RebindEPSS 0.1%CVE-2026-53856MEDIUMOpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.jsonEPSS 0.1%CVE-2026-53820MEDIUMOpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session SpawnEPSS 0.1%CVE-2026-53809MEDIUMOpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner PolicyEPSS 0.1%CVE-2026-53850MEDIUMOpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus CommandEPSS 0.1%CVE-2026-31997MEDIUMOpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run ApprovalsEPSS 0.1%CVE-2026-41360MEDIUMOpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script BindingEPSS 0.1%CVE-2026-53862LOWOpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope WideningEPSS 0.1%CVE-2026-41338MEDIUMOpenClaw < 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File OperationsEPSS 0.1%CVE-2026-33574MEDIUMOpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills DownloadEPSS 0.1%