Vulnerabilidades em OpenClaw

672 resultados
Análise Vexday

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-35632MEDIUMOpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/updateEPSS 0.4%CVE-2026-62192HIGHOpenClaw 2026.6.6 < 2026.6.9 Authorization BypassEPSS 0.4%CVE-2026-32973HIGHOpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path NormalizationEPSS 0.4%CVE-2026-42437HIGHOpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime PathEPSS 0.4%CVE-2026-28472CRITICALOpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect HandshakeEPSS 0.4%CVE-2026-42435HIGHOpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment InjectionEPSS 0.4%CVE-2026-32045HIGHOpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale AuthEPSS 0.4%CVE-2026-41303HIGHOpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval CommandsEPSS 0.4%CVE-2026-28392HIGHOpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct MessagesEPSS 0.4%CVE-2026-43575CRITICALOpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper RouteEPSS 0.4%CVE-2026-62195HIGHOpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopbackEPSS 0.4%CVE-2026-62196HIGHOpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDsEPSS 0.4%CVE-2026-32034MEDIUMOpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTPEPSS 0.4%CVE-2026-28450HIGHOpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP EndpointsEPSS 0.4%CVE-2026-27522HIGHOpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message ActionsEPSS 0.4%CVE-2026-22177MEDIUMOpenClaw < 2026.2.21 - Environment Variable Injection via Config env.varsEPSS 0.4%CVE-2026-43584HIGHOpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec PolicyEPSS 0.4%CVE-2026-62227MEDIUMOpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser SnapshotEPSS 0.4%CVE-2026-41333MEDIUMOpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceTokenEPSS 0.4%CVE-2026-33577HIGHOpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approveEPSS 0.4%