Vulnerabilidades em openclaw
584 resultadosAnálise Vexday
A OpenClaw apresenta um portfólio de 47 vulnerabilidades, com 10 descobertas nos últimos 90 dias, indicando atividade contínua de risco. Nenhuma vulnerabilidade está sob exploração ativa registrada (KEV), mas a fraqueza dominante em path traversal (CWE-22) é crítica em ambientes com controle de acesso inadequado. Com apenas 1 vulnerabilidade crítica (CVSS), o risco permanece moderado, mas exige monitoramento nas próximas atualizações da plataforma.
CVE-2026-41353HIGHOpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime SelectionEPSS 0.6%CVE-2026-44115HIGHOpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec AllowlistEPSS 0.6%CVE-2026-29613HIGHOpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress TrustEPSS 0.6%CVE-2026-53853HIGHOpenClaw < 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOSEPSS 0.6%CVE-2026-43528HIGHOpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig AliasesEPSS 0.6%CVE-2026-32064HIGHOpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC ObserverEPSS 0.6%CVE-2026-41383MEDIUMOpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode PathsEPSS 0.6%CVE-2026-41399HIGHOpenClaw < 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket UpgradesEPSS 0.6%CVE-2026-26316HIGHOpenClaw has BlueBubbles webhook auth bypass via loopback proxy trustEPSS 0.6%CVE-2026-35652MEDIUMOpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback DispatchEPSS 0.6%CVE-2026-42423HIGHOpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout FallbackEPSS 0.6%CVE-2026-28392HIGHOpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct MessagesEPSS 0.6%CVE-2026-32045HIGHOpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale AuthEPSS 0.6%CVE-2026-53825HIGHOpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write ScopeEPSS 0.6%CVE-2026-41386CRITICALOpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup CodesEPSS 0.6%CVE-2026-62207HIGHOpenClaw < 2026.6.5 Authentication Bypass via Admin ToolsEPSS 0.6%CVE-2026-31998HIGHOpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIdsEPSS 0.6%CVE-2026-32975MEDIUMOpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser AllowlistEPSS 0.6%CVE-2026-28394MEDIUMOpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch ToolEPSS 0.6%CVE-2026-22172CRITICALOpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth ConnectionsEPSS 0.6%