Vulnerabilidades em openclaw
584 resultadosAnálise Vexday
A OpenClaw apresenta um portfólio de 47 vulnerabilidades, com 10 descobertas nos últimos 90 dias, indicando atividade contínua de risco. Nenhuma vulnerabilidade está sob exploração ativa registrada (KEV), mas a fraqueza dominante em path traversal (CWE-22) é crítica em ambientes com controle de acesso inadequado. Com apenas 1 vulnerabilidade crítica (CVSS), o risco permanece moderado, mas exige monitoramento nas próximas atualizações da plataforma.
CVE-2026-28470CRITICALOpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double QuotesEPSS 0.9%CVE-2026-29610HIGHOpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH HandlingEPSS 0.9%CVE-2026-28391CRITICALOpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist EnforcementEPSS 0.9%CVE-2026-25593HIGHOpenClaw Affected by Unauthenticated Local RCE via WebSocket config.applyEPSS 0.9%CVE-2026-25475MEDIUMOpenClaw Vulnerable to Local File Inclusion via MEDIA: Path ExtractionEPSS 0.9%CVE-2026-28474CRITICALOpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name SpoofingEPSS 0.8%CVE-2026-35639HIGHOpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope ValidationEPSS 0.8%CVE-2026-41349HIGHOpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patchEPSS 0.8%CVE-2026-41378HIGHOpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent DispatchEPSS 0.8%CVE-2026-53836HIGHOpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command AliasesEPSS 0.8%CVE-2026-29607HIGHOpenClaw < 2026.2.22 - Authorization Bypass via allow-always Wrapper PersistenceEPSS 0.8%CVE-2026-41343MEDIUMOpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth ConcurrencyEPSS 0.8%CVE-2026-32003HIGHOpenClaw < 2026.2.22 - Remote Code Execution via SHELLOPTS/PS4 Environment Injection in system.runEPSS 0.8%CVE-2026-43585CRITICALOpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef ResolutionEPSS 0.8%CVE-2026-31995MEDIUMOpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster ExtensionEPSS 0.8%CVE-2026-35640MEDIUMOpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request ParsingEPSS 0.8%CVE-2026-28478HIGHOpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body BufferingEPSS 0.8%CVE-2026-27566HIGHOpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.runEPSS 0.8%CVE-2026-43575CRITICALOpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper RouteEPSS 0.8%CVE-2026-41346MEDIUMOpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap EnforcementEPSS 0.8%