Vulnerabilidades em openclaw
663 resultadosAnálise Vexday
A OpenClaw apresenta um portfólio de 47 vulnerabilidades, com 10 descobertas nos últimos 90 dias, indicando atividade contínua de risco. Nenhuma vulnerabilidade está sob exploração ativa registrada (KEV), mas a fraqueza dominante em path traversal (CWE-22) é crítica em ambientes com controle de acesso inadequado. Com apenas 1 vulnerabilidade crítica (CVSS), o risco permanece moderado, mas exige monitoramento nas próximas atualizações da plataforma.
CVE-2026-100545MEDIUMOpenClaw before 2026.8.1 Policy Bypass via Session Filename GenerationEPSS 0.2%CVE-2026-100529HIGHOpenClaw before 2026.8.1 Authorization Scope Widening via File-TransferEPSS 0.2%CVE-2026-45004HIGHOpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working DirectoryEPSS 0.2%CVE-2026-100539LOWOpenClaw before 2026.8.1 Memory Access Control BypassEPSS 0.2%CVE-2026-44995MEDIUMOpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment VariablesEPSS 0.2%CVE-2026-100566MEDIUMOpenClaw LINE before 2026.8.1 Access Control InheritanceEPSS 0.2%CVE-2026-28477MEDIUMOpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login FlowEPSS 0.2%CVE-2026-41398LOWOpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI BridgeEPSS 0.2%CVE-2026-41342HIGHOpenClaw < 2026.3.28 - Unauthenticated Discovery Endpoint Credential Exfiltration via Remote OnboardingEPSS 0.2%CVE-2026-22169HIGHOpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBinsEPSS 0.2%CVE-2026-100555HIGHOpenClaw before 2026.8.1 DNS Rebinding via attachment deliveryEPSS 0.2%CVE-2026-53842HIGHOpenClaw < 2026.5.2 - Arbitrary Python Runtime Execution via CLOUDSDK_PYTHON Environment VariableEPSS 0.2%CVE-2026-41295HIGHOpenClaw < 2026.4.2 - Untrusted Workspace Channel Shadow Code Execution during Built-in Channel SetupEPSS 0.2%CVE-2026-41336HIGHOpenClaw < 2026.3.31 - Arbitrary Hook Code Execution via OPENCLAW_BUNDLED_HOOKS_DIR Environment Variable OverrideEPSS 0.2%CVE-2026-28486MEDIUMOpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation CommandsEPSS 0.2%CVE-2026-100585HIGHOpenClaw before 2026.7.1 Authentication Bypass via MCP ChannelEPSS 0.2%CVE-2026-27008MEDIUMOpenClaw hardened the skill download target directory validationEPSS 0.2%CVE-2026-42432HIGHOpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect BypassEPSS 0.2%CVE-2026-32009HIGHOpenClaw < 2026.2.24 - Binary Hijacking via Static Default Trusted Directories in safeBinsEPSS 0.2%CVE-2026-32032HIGHOpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment VariableEPSS 0.2%