Vulnerabilidades em OpenClaw

672 resultados
Análise Vexday

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-26325HIGHOpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvalsEPSS 0.6%CVE-2026-28470CRITICALOpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double QuotesEPSS 0.6%CVE-2026-28363CRITICALIn OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compresEPSS 0.6%CVE-2026-41352HIGHOpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate BypassEPSS 0.5%CVE-2026-62202HIGHOpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via CronEPSS 0.5%CVE-2026-32980HIGHOpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook RequestEPSS 0.5%CVE-2026-43585CRITICALOpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef ResolutionEPSS 0.5%CVE-2026-41364HIGHOpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar UploadEPSS 0.5%CVE-2026-26321HIGHOpenClaw has a local file disclosure via sendMediaFeishu in Feishu extensionEPSS 0.5%CVE-2026-29610HIGHOpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH HandlingEPSS 0.5%CVE-2026-27002HIGHOpenClaw: Docker container escape via unvalidated bind mount config injectionEPSS 0.5%CVE-2026-62200HIGHOpenClaw < 2026.6.6 Authentication Bypass via Git ext transportEPSS 0.5%CVE-2026-62203HIGHOpenClaw < 2026.6.6 Environment Variable Injection via rustupEPSS 0.5%CVE-2026-62199HIGHOpenClaw < 2026.6.6 Authentication Bypass via Environment FilteringEPSS 0.5%CVE-2026-41400MEDIUMOpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-callEPSS 0.5%CVE-2026-32064HIGHOpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC ObserverEPSS 0.5%CVE-2026-62220MEDIUMOpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit BypassEPSS 0.5%CVE-2026-28448MEDIUMOpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access ControlEPSS 0.5%CVE-2026-35626MEDIUMOpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call WebhookEPSS 0.5%CVE-2026-28393HIGHOpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path TraversalEPSS 0.5%