Vulnerabilidades em OpenClaw

672 resultados
Análise Vexday

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-62190HIGHOpenClaw < 2026.6.9 Authorization Bypass via flock wrapperEPSS 0.5%CVE-2026-28478HIGHOpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body BufferingEPSS 0.5%CVE-2026-26320HIGHOpenClaw macOS deep link confirmation truncation can conceal executed agent messageEPSS 0.5%CVE-2026-45006HIGHOpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist BypassEPSS 0.5%CVE-2026-35650HIGHOpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent SanitizationEPSS 0.5%CVE-2026-29609HIGHOpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media FetchEPSS 0.5%CVE-2026-28462HIGHOpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output PathsEPSS 0.5%CVE-2026-41405HIGHOpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body ParsingEPSS 0.5%CVE-2026-32062HIGHOpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media StreamEPSS 0.5%CVE-2026-32916CRITICALOpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin ScopesEPSS 0.5%CVE-2026-28453HIGHOpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive ExtractionEPSS 0.5%CVE-2026-41374MEDIUMOpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member AuthorizationEPSS 0.5%CVE-2026-28466CRITICALOpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval BypassEPSS 0.5%CVE-2026-41349HIGHOpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patchEPSS 0.5%CVE-2026-35627MEDIUMOpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM HandlingEPSS 0.5%CVE-2026-41397HIGHOpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink TraversalEPSS 0.5%CVE-2026-28456HIGHOpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path HandlingEPSS 0.5%CVE-2026-101884HIGHOpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment OverrideEPSS 0.5%CVE-2026-35639HIGHOpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope ValidationEPSS 0.5%CVE-2026-28460MEDIUMOpenClaw < 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution in system.runEPSS 0.5%