OpenClaw vulnerabilities and CVEs

CVE-2026-35630

OpenClaw: QQBot native approval buttons did not enforce configured approver identity

CVE-2026-53806

OpenClaw: Combined POSIX shell options could confuse exec revalidation

CVE-2026-53809

OpenClaw: Embedded runner policy could be confused by provider aliases

CVE-2026-53810

OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

CVE-2026-53811

OpenClaw: Matrix allowFrom could bind to mutable display names

CVE-2026-53812

OpenClaw's browser act interactions could bypass private-network navigation checks

CVE-2026-53813

OpenClaw: Fake package roots could influence memory-core artifact loading

CVE-2026-53814

OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority

CVE-2026-53815

OpenClaw: Message read actions could skip channel allowlist checks

CVE-2026-53816

OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

CVE-2026-53817

OpenClaw: Control UI locality spoofing could mint a durable admin device token

CVE-2026-53818

OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

CVE-2026-53819

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

CVE-2026-53830

OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

CVE-2026-53831

OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

CVE-2026-53832

OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

CVE-2026-53833

OpenClaw: QQBot streaming command could mutate config without explicit allowFrom

CVE-2026-53834

OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks

CVE-2026-53836

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

CVE-2026-53837

OpenClaw: Mattermost handlers could fall open when channel type was missing

CVE-2026-53838

OpenClaw: Node pairing reconnection could confuse approval scope state

GHSA-2j8v-hwgc-x698

OpenClaw: Shell wrapper argv could change between approval and execution

GHSA-3wqp-prf6-2m72

OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement

GHSA-4m3v-q747-pc6h

OpenClaw: Mattermost slash token revocation could lag until monitor refresh

GHSA-6c4r-g249-wv3c

OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts

GHSA-77q5-rr5v-x43q

OpenClaw: Trusted retry endpoint checks could match hostname prefixes

GHSA-c29c-2q9c-pc86

OpenClaw: Slack allowFrom could bind to mutable display names

GHSA-cqwv-9qjx-vxw2

OpenClaw: Skill Workshop apply flow could override pending approval

GHSA-grc3-2j34-p6gm

OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

GHSA-hcm3-8f6r-6xwg

OpenClaw: Browser debug/export routes could reuse already-open blocked tabs

GHSA-hw9r-h9mr-4jff

OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates

GHSA-p2fh-f5fc-44hr

OpenClaw: memory-wiki ingest could read local files with operator.write scope

GHSA-p73f-w79w-jqr5

OpenClaw: Native command authorization could skip owner-command enforcement

GHSA-qh2f-99mv-mrcf

OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn

GHSA-qjpc-qf9m-xwmr

OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

GHSA-w4v6-g3wm-w36c

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

GHSA-w5ww-7chg-mxcq

OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

GHSA-wv26-j37q-2g7p

OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions

GHSA-xr4f-mjxj-w6w5

OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes

GHSA-xww8-gqvh-92x9

OpenClaw: Exec approval display truncation could hide the command being approved

GHSA-9c3v-684m-579c

OpenClaw MCP SSE redirects could forward Authorization headers

CVE-2026-53841

OpenClaw: Exported session HTML could keep unsafe markdown links

CVE-2026-53842

OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

CVE-2026-53843

OpenClaw: Pairing-scoped device session could restore revoked node token authority

CVE-2026-53844

OpenClaw: memory-wiki shared search could miss session visibility checks

CVE-2026-53845

OpenClaw: Skill-command dispatch could skip before-tool-call hooks

CVE-2026-53846

OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install

CVE-2026-53847

OpenClaw: Active Memory write scope could mutate global config

CVE-2026-53848

OpenClaw: Exec allowlist could miss side effects from transparent command wrappers

CVE-2026-53849

OpenClaw: Discord allowFrom could bind to mutable display names

CVE-2026-53850

OpenClaw: Focus command could miss controlScope enforcement

CVE-2026-53851

OpenClaw: Slack reaction events could ignore reaction notification settings

CVE-2026-53852

OpenClaw: Empty-scope device re-pairing could confuse caller scope containment

CVE-2026-53853

OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns

CVE-2026-53854

OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state

CVE-2026-53855

OpenClaw: Shell positional parameters could weaken strict inline-eval checks

CVE-2026-53856

OpenClaw: Config recovery could restore openclaw.json with broad file permissions

CVE-2026-53857

OpenClaw: Zalo allowFrom could bind to mutable display names

CVE-2026-53858

OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots

CVE-2026-53859

OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently

CVE-2026-53860

OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers

CVE-2026-53861

OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags

CVE-2026-53862

OpenClaw: Bootstrap token replay could widen pending pairing scopes

CVE-2026-53863

OpenClaw: Tool group policy callers could accept unvalidated group IDs

CVE-2026-53864

OpenClaw: Host environment sanitizer missed two Node.js control variables

CVE-2026-53865

OpenClaw: Workspace-derived service PATH could influence trash command selection

CVE-2026-53866

OpenClaw: Shell inline-command parsing could miss an allowlist check

CVE-2026-53840

OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin

CVE-2026-43570

OpenClaw contains a symlink traversal vulnerability

CVE-2026-45004

OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution

CVE-2026-45005

OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload

GHSA-cwj3-vqpp-pmxr

OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

CVE-2026-41358

OpenClaw: Slack thread context could include messages from non-allowlisted senders

CVE-2026-44112

OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root

CVE-2026-44113

OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

CVE-2026-44116

OpenClaw validates Zalo outbound photo URLs through the SSRF guard

CVE-2026-44118

OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

CVE-2026-44997

OpenClaw's ACP child sessions inherit subagent security envelope constraints

CVE-2026-45003

OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

GHSA-93rg-2xm5-2p9v

OpenClaw's Gateway Control UI bootstrap config required Gateway auth

GHSA-x3h8-jrgh-p8jx

OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs

CVE-2026-44991

OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners

GHSA-gfg9-5357-hv4c

OpenClaw: Webchat audio embedding could read local files without local-root containment

CVE-2026-41908

OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization

CVE-2026-44114

OpenClaw: Workspace dotenv could override runtime-control environment variables

CVE-2026-44117

OpenClaw: QQBot direct media upload skipped URL SSRF validation

CVE-2026-44992

OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests

CVE-2026-44995

OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

CVE-2026-44999

OpenClaw: Isolated cron awareness events were recorded as trusted system events

CVE-2026-45002

OpenClaw: Hook mapping templates could bypass hook session-key opt-in

GHSA-72q8-jcmc-97wx

OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy

GHSA-7jm2-g593-4qrc

OpenClaw: Agent gateway config mutations could change protected operator settings

GHSA-j4c5-89f5-f3pm

OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks

GHSA-qrp5-gfw2-gxv4

OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy

GHSA-xrq9-jm7v-g9h7

OpenClaw: Paired-device pairing actions were not limited to the caller device

CVE-2026-41389

OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

CVE-2026-42433

OpenClaw: Matrix profile config persistence was reachable from operator.write message tools

CVE-2026-42434

OpenClaw: Sandboxed agents could escape exec routing via host=node override

CVE-2026-42435

OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms

CVE-2026-42436

OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation

CVE-2026-42437

OpenClaw: Voice-call realtime WebSocket accepted oversized frames

CVE-2026-42438

OpenClaw: Sender policy bypass in host media attachment reads allows unauthorized local file disclosure

CVE-2026-42439

OpenClaw: Browser tabs action select and close routes bypassed SSRF policy

CVE-2026-43526

OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes

CVE-2026-43527

OpenClaw: Browser SSRF policy default allowed private-network navigation

CVE-2026-43528

OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases

CVE-2026-43530

OpenClaw: busybox and toybox applet execution weakened exec approval binding

CVE-2026-43531

OpenClaw: Workspace .env could inject OpenClaw runtime-control variables

CVE-2026-43532

OpenClaw: Discord event cover images bypassed sandbox media normalization

CVE-2026-43533

OpenClaw: QQBot media tags could read arbitrary local files through reply text

CVE-2026-43534

OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input

CVE-2026-43535

OpenClaw: Collect-mode queue batches could reuse the last sender authorization context

CVE-2026-43566

OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events

CVE-2026-43567

OpenClaw: screen_record outPath bypassed workspace-only filesystem guard

CVE-2026-43568

OpenClaw: Memory dreaming config persistence was reachable from operator.write commands

CVE-2026-43569

OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins

CVE-2026-43571

OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows

CVE-2026-43572

OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks

CVE-2026-43573

OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement

CVE-2026-43574

OpenClaw: Empty approver lists could grant explicit approval authorization

CVE-2026-43576

OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets

CVE-2026-43580

OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage

CVE-2026-43582

OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding

CVE-2026-43583

OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay

CVE-2026-43584

OpenClaw: Exec environment denylist missed high-risk interpreter startup variables

CVE-2026-43585

OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation

CVE-2026-44109

OpenClaw: Feishu webhook and card-action validation now fail closed

CVE-2026-44110

OpenClaw: Matrix room control-command authorization no longer trusts DM pairing-store entries

GHSA-525j-hqq2-66r4

OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0

GHSA-92jp-89mq-4374

OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials

GHSA-f3h5-h452-vp3j

OpenClaw: Nostr profile mutation routes allowed operator.write config persistence

GHSA-f934-5rqf-xx47

OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths

GHSA-g375-h3v6-4873

OpenClaw: Heartbeat owner downgrade missed local async exec completion events

GHSA-qmwg-qprg-3j38

OpenClaw: Browser interaction routes could pivot into local CDP and regain file reads

CVE-2026-43529

OpenClaw: TOCTOU read in exec script preflight

CVE-2026-6011

OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts

CVE-2026-40037

OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

CVE-2026-41910

OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes

CVE-2026-41911

OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)

CVE-2026-41912

OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation

CVE-2026-41913

OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths

CVE-2026-41914

OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths

CVE-2026-41915

OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)

CVE-2026-41916

OpenClaw: resolvedAuth closure becomes stale after config reload

CVE-2026-42420

OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks

CVE-2026-42421

OpenClaw: Existing WS sessions survive shared gateway token rotation

CVE-2026-42422

OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

CVE-2026-42423

OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts

CVE-2026-42424

OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration

CVE-2026-42426

OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval

CVE-2026-42427

OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)

CVE-2026-42428

OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification

CVE-2026-42429

OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`

CVE-2026-42430

OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable

CVE-2026-42431

OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard

CVE-2026-42432

OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement

GHSA-gfmx-pph7-g46x

OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade

GHSA-jf56-mccx-5f3f

OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel

GHSA-w9j9-w4cp-6wgr

OpenClaw Host-Exec Environment Variable Injection

CVE-2026-40045

OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

CVE-2026-41295

OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

CVE-2026-41297

OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection

CVE-2026-41298

OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

CVE-2026-41301

OpenClaw: Forged Nostr DMs could create pairing state before signature verification

CVE-2026-41339

OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

CVE-2026-41346

OpenClaw: Pairing pending-request caps were enforced per channel instead of per account

CVE-2026-41354

OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

CVE-2026-41355

OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

CVE-2026-41359

OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send

CVE-2026-41372

OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

CVE-2026-41375

OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels

CVE-2026-41379

OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send

CVE-2026-41383

OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped

CVE-2026-41384

OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

CVE-2026-41392

OpenClaw: Shell init-file options could satisfy exec allowlist script matching

CVE-2026-41398

OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch

CVE-2026-41407

OpenClaw: Shared-secret comparison call sites leaked length information through timing

CVE-2026-41408

OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk

GHSA-846p-hgpv-vphc

OpenClaw: QQ Bot structured payloads could read arbitrary local files

GHSA-98ch-45wp-ch47

OpenClaw: Windows-compatible env override keys could bypass system.run approval binding

GHSA-fqrj-m88p-qf3v

OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets

GHSA-fwjq-xwfj-gv75

OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations

GHSA-w6wx-jq6j-6mcj

OpenClaw: pnpm dlx approvals did not bind local script operands

CVE-2026-34425

OpenClaw's complex interpreter pipelines could skip exec script preflight validation

CVE-2026-34511

OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

CVE-2026-41296

OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile

CVE-2026-41300

OpenClaw: Endpoint persists after trust decline, leaking gateway credentials

CVE-2026-41330

OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

CVE-2026-41331

OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders

CVE-2026-41333

OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting

CVE-2026-41335

OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability

CVE-2026-41341

OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message

CVE-2026-41347

OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode

CVE-2026-41348

OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist

CVE-2026-41351

OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding

CVE-2026-41352

OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md

CVE-2026-41356

OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation

CVE-2026-41369

OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

CVE-2026-41373

OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides

CVE-2026-41374

OpenClaw runs Discord audio preflight transcription before member authorization

CVE-2026-41378

OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch

CVE-2026-41381

OpenClaw: Discord voice manager bypasses channel-level member access allowlist

CVE-2026-41382

OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps

CVE-2026-41386

OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing

CVE-2026-41388

OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config

CVE-2026-41393

OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration

CVE-2026-41396

OpenClaw: Workspace `.env` can override the bundled plugin trust root

CVE-2026-41397

OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal

CVE-2026-41400

OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)

CVE-2026-41403

OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled

CVE-2026-41404

OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode

CVE-2026-41405

OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion

GHSA-57gh-m6rq-54cf

OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration

GHSA-58q2-7r52-jq62

OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read

GHSA-68v4-hmwv-f43h

OpenClaw: Media download follows cross-origin redirects with Authorization headers intact

GHSA-f693-58pc-2gfr

OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts

GHSA-f6pf-4gjx-c94r

OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read

GHSA-h5hg-h7rr-gpf3

OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection

GHSA-rm5c-4rmf-vvhw

OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses

GHSA-v3qc-wrwx-j3pw

OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`

GHSA-w85g-3h6x-4xh2

OpenClaw: Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS

CVE-2026-41302

OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery

CVE-2026-41329

OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

CVE-2026-41336

OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

CVE-2026-41337

OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection

CVE-2026-41343

OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

CVE-2026-41364

OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host

CVE-2026-41365

OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API

CVE-2026-41376

OpenClaw: Matrix thread root and reply context bypass sender allowlist

CVE-2026-41377

OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open)

CVE-2026-41385

OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get

CVE-2026-41391

OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

CVE-2026-41394

OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

CVE-2026-41402

OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass

CVE-2026-41406

OpenClaw: Feishu thread history and quoted messages bypass sender allowlist

GHSA-j9pv-rrcj-6pfx

OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes

CVE-2026-33577

OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

CVE-2026-33578

OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade

CVE-2026-34504

OpenClaw affected by SSRF via unguarded image download in fal provider

CVE-2026-41294

OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

CVE-2026-41380

OpenClaw gateway exec allow-always over-trusts positional carrier executables

GHSA-5r8f-96gm-5j6g

OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`

CVE-2026-33576

OpenClaw: Zalo channel downloads media before sender authorization

CVE-2026-33579

OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

CVE-2026-33580

OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication

CVE-2026-33581

OpenClaw's message tool media parameter bypasses tool policy filesystem isolation

CVE-2026-34503

OpenClaw's device removal and token revocation do not terminate active WebSocket sessions

CVE-2026-41299

OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing

CVE-2026-41303

OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals

CVE-2026-41332

OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

CVE-2026-41342

OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

CVE-2026-41344

OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose`

CVE-2026-41363

OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image

CVE-2026-41387

OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

CVE-2026-41390

OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper

CVE-2026-41395

OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering

CVE-2026-41399

OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades

GHSA-g86v-f9qv-rh6m

OpenClaw SSRF guard misses four IPv6 special-use ranges

GHSA-jccr-rrw2-vc8h

OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure

GHSA-jp4j-q5fc-58gv

OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement

CVE-2026-35619

OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope

CVE-2026-35620

OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy

CVE-2026-35621

OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send

CVE-2026-35641

OpenClaw has an Arbitrary Malicious Code Execution Vulnerability

CVE-2026-35653

OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface

CVE-2026-35665

OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant)

CVE-2026-35667

OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`

CVE-2026-35668

OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)

GHSA-vqvg-86cc-cg83

OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement

CVE-2026-35617

OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

CVE-2026-35629

OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)

CVE-2026-35640

OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

CVE-2026-35645

OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`

CVE-2026-35646

OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token

CVE-2026-35651

OpenClaw has ACP CLI approval prompt ANSI escape sequence injection

CVE-2026-35654

OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback

CVE-2026-35657

OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope

CVE-2026-35661

OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

CVE-2026-35664

OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing

GHSA-q2qc-744p-66r2

OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility

CVE-2026-35623

OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing

CVE-2026-35628

OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret

CVE-2026-35647

OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers

CVE-2026-35663

OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

CVE-2026-35669

OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers

GHSA-9p93-7j67-5pc2

OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding

GHSA-fqw4-mph7-2vr8

OpenClaw: Silent privilege escalation via gateway shared-auth reconnect

GHSA-mw7w-g3mg-xqm7

OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events

CVE-2026-32846

OpenClaw is vulnerable to Path Traversal through path validation bypass

CVE-2026-34426

OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation

CVE-2026-35618

OpenClaw: Plivo V2 verified replay identity drifts on query-only variants

CVE-2026-35622

OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals

CVE-2026-35624

OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens

CVE-2026-35626

OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling

CVE-2026-35627

OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement

CVE-2026-35632

OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

CVE-2026-35633

OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure

CVE-2026-35634

OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication

CVE-2026-35635

OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision

CVE-2026-35637

OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete

CVE-2026-35639

OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve

CVE-2026-35643

OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface

CVE-2026-35648

OpenClaw may have stale policy enforcement for queued node actions

CVE-2026-35649

OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation

CVE-2026-35650

OpenClaw has Inconsistent Host Exec Environment Override Sanitization

CVE-2026-35652

OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions

CVE-2026-35655

OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting

CVE-2026-35656

OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection

CVE-2026-35658

OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts

CVE-2026-35659

OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

CVE-2026-35660

OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers

CVE-2026-35662

OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions

CVE-2026-35666

OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper

CVE-2026-35670

OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.

GHSA-3w6x-gv34-mqpf

OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement

GHSA-48vw-m3qc-wr99

OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths

GHSA-ppwq-6v66-5m6j

OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status

CVE-2026-32980

OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion

CVE-2026-33572

OpenClaw session transcript files were created without forced user-only permissions

GHSA-63f5-hhc7-cx6p

OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval

GHSA-g2f6-pwvx-r275

OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection

GHSA-xwcj-hwhf-h378

OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs

CVE-2026-22172

OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

CVE-2026-32916

OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes

CVE-2026-32918

`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

CVE-2026-32920

OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories

CVE-2026-32970

OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode

CVE-2026-32971

OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv

CVE-2026-32974

OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured

CVE-2026-32977

OpenClaw: Sandbox `writeFile` commit could race outside the validated path

CVE-2026-32978

OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity

CVE-2026-32979

OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity

CVE-2026-34505

OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

GHSA-2rqg-gjgv-84jm

OpenClaw: Gateway `agent` calls could override the workspace boundary

GHSA-4jpw-hj22-2xmc

OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE

GHSA-4w7m-58cg-cmff

OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries

GHSA-7h7g-x2px-94hj

OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens

GHSA-8jhh-jcqg-mj5p

OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions

GHSA-9vvh-2768-c8vp

OpenClaw: Discord guild reaction ingress could bypass users and roles allowlists

GHSA-f5mf-3r52-r83w

OpenClaw's Zalouser allowlist authorization matched mutable group names by default

GHSA-f8r2-vg7x-gh8m

OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths

GHSA-jf6w-m8jw-jfxc

OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent`

GHSA-m69h-jm2f-2pv8

OpenClaw: Feishu reaction events could bypass group authorization and mention gating

GHSA-mj4p-rc52-m843

OpenClaw: Sandbox staged writes could escape the verified parent directory before commit

GHSA-r7vr-gr74-94p8

OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces

GHSA-vmhq-cqm9-6p7q

OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes

CVE-2026-32031

OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch

CVE-2026-32055

OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf

CVE-2026-32302

OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode

CVE-2026-32895

OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers

CVE-2026-32921

OpenClaw's system.run approvals did not bind mutable script operands across approval and execution

CVE-2026-33574

OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path

CVE-2026-34506

OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty

GHSA-gp3q-wpq4-5c5h

OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries

GHSA-qcc4-p59m-p54m

OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary

CVE-2026-27183

OpenClaw: system.run wrapper-depth boundary could skip shell approval gating

CVE-2026-27646

OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions

CVE-2026-32913

OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

GHSA-3h2q-j2v4-6w5r

OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers

GHSA-6rmx-gvvg-vh6j

OpenClaw's hooks count non-POST requests toward auth lockout

GHSA-9q2p-vc84-2rwm

OpenClaw: system.run allow-always persistence included shell-commented payload tails

GHSA-hfpr-jhpq-x4rm

OpenClaw: `operator.write` chat.send could reach admin-only config writes

GHSA-j425-whc4-4jgc

OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots

GHSA-pjvx-rx66-r3fg

OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping

GHSA-rchv-x836-w7xp

OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

CVE-2026-22170

OpenClaw: BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty

CVE-2026-32002

OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images

CVE-2026-32005

OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows

CVE-2026-32019

OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard

CVE-2026-32067

OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access

GHSA-3jx4-q2m7-r496

OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations

GHSA-8cp7-rp8r-mg77

OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP

GHSA-9mph-4f7v-fmvh

OpenClaw has agent avatar symlink traversal in gateway session metadata

GHSA-f6h3-846h-2r8w

OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization

GHSA-jjgj-cpp9-cvpv

OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection

GHSA-vvjh-f6p9-5vcf

OpenClaw Canvas Authentication Bypass Vulnerability

CVE-2026-22169

OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints

CVE-2026-22171

OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()

CVE-2026-22174

OpenClaw Loopback CDP probe can leak Gateway token to local listener

CVE-2026-22176

OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation

CVE-2026-22177

OpenClaw's config env vars allowed startup env injection into service runtime

CVE-2026-22179

OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution

CVE-2026-22180

OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows

CVE-2026-22181

OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured

CVE-2026-22217

OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

CVE-2026-27523

OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths

CVE-2026-27524

OpenClaw's runtime /debug override path accepted prototype-reserved keys

CVE-2026-27566

OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains

CVE-2026-28393

OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading

CVE-2026-28449

OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

CVE-2026-28460

OpenClaw's system.run allowlist bypass via shell line-continuation command substitution

CVE-2026-28483

OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind

CVE-2026-29608

OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts

CVE-2026-31990

OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace

CVE-2026-31992

OpenClaw has allowlist exec-guard bypass via env -S

CVE-2026-31994

OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling

CVE-2026-31995

OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path

CVE-2026-31998

OpenClaw's Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch

CVE-2026-32000

OpenClaw has command injection via Windows shell fallback in Lobster tool execution

CVE-2026-32001

OpenClaw's Node role device-identity bypass allows unauthorized node.event injection

CVE-2026-32003

OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)

CVE-2026-32004

OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification

CVE-2026-32006

OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallback

CVE-2026-32007

OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)

CVE-2026-32008

OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files

CVE-2026-32009

OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)

CVE-2026-32010

In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program

CVE-2026-32011

OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS

CVE-2026-32014

OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy

CVE-2026-32015

OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks

CVE-2026-32016

OpenClaw: macOS optional allowlist basename matching could bypass path-based policy

CVE-2026-32017

OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write

CVE-2026-32018

OpenClaw's serialize sandbox registry writes to prevent races and delete-rollback corruption

CVE-2026-32021

OpenClaw has a Feishu allowFrom authorization bypass via display-name collision

CVE-2026-32022

OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)

CVE-2026-32023

OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode

CVE-2026-32024

OpenClaw's avatar symlink traversal can expose out-of-workspace local files

CVE-2026-32025

OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains

CVE-2026-32026

Temporary path handling could write outside OpenClaw temp boundary

CVE-2026-32027

OpenClaw DM pairing-store identities could satisfy group allowlist authorization

CVE-2026-32028

OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups

CVE-2026-32029

OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions

CVE-2026-32030

OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia

CVE-2026-32032

OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment

CVE-2026-32033

OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

CVE-2026-32034

OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access

CVE-2026-32035

OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels

CVE-2026-32036

OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths

CVE-2026-32037

OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists

CVE-2026-32039

OpenClaw's typed sender-key matching for toolsBySender prevents identity-collision policy bypass

CVE-2026-32040

OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation

CVE-2026-32043

OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host

CVE-2026-32045

OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes

CVE-2026-32046

OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container

CVE-2026-32050

OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks

CVE-2026-32052

OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

CVE-2026-32053

OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

CVE-2026-32056

OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)

CVE-2026-32057

OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

CVE-2026-32059

OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode

CVE-2026-32061

OpenClaw vulnerable to arbitrary file read via $include directive

CVE-2026-32063

OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)

CVE-2026-32064

OpenClaw's andbox browser noVNC observer lacked VNC authentication

CVE-2026-32896

OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)

CVE-2026-32897

OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

CVE-2026-32899

OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

GHSA-2858-xg23-26fp

OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots

GHSA-2ch6-x3g4-7759

OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From

GHSA-2hm8-rqrm-xfjq

OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows

GHSA-2mc2-g238-722j

OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)

GHSA-474h-prjg-mmw3

OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization

GHSA-4cqv-h74h-93j4

OpenClaw has a Discord `allowFrom` slug-collision authorization bypass

GHSA-534w-2vm4-89xr

OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch

GHSA-553v-f69r-656j

OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth

GHSA-5847-rm3g-23mw

OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants

GHSA-5h2c-8v84-qpvr

OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths

GHSA-659f-22xc-98f2

OpenClaw hook transform path containment missed symlink-resolved escapes

GHSA-6g25-pc82-vfwp

OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state

GHSA-77hf-7fqf-f227

OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)

GHSA-796m-2973-wc5q

OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation

GHSA-7ff8-xjh3-mgh6

OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt

GHSA-7qf6-h84j-8fq4

OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model

GHSA-8mf7-vv8w-hjr2

OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode

GHSA-9f72-qcpw-2hxc

OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs

GHSA-cjv3-m589-v3rx

OpenClaw has Canvas route hardening for mixed-trust deployments

GHSA-ff98-w8hj-qrxf

OpenClaw plugin runtime command execution is part of trusted plugin boundary

GHSA-gcj7-r3hg-m7w6

OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity

GHSA-h656-5vcf-cm23

OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check

GHSA-h97f-6pqj-q452

OpenClaw has a IPv6 multicast SSRF classifier bypass

GHSA-j26j-7qc4-3mrf

OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption

GHSA-jxrq-8fm4-9p58

OpenClaw: Zip extraction symlink traversal could write outside destination

GHSA-pfv7-rr5m-qmv6

OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint

GHSA-qhrr-grqp-6x2g

OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode

GHSA-qj22-xqjr-v83v

OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection

GHSA-r294-2894-92j3

OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering

GHSA-w7j5-j98m-w679

OpenClaw has multiple E2E/test Dockerfiles that run all processes as root

GHSA-w9cg-v44m-4qv8

OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands

GHSA-xmv6-r34m-62p4

OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot

CVE-2026-22168

OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments

CVE-2026-22175

OpenClaw's exec allow-always can be bypassed via unrecognized multiplexer shell wrappers (busybox/toybox sh -c)

CVE-2026-22178

OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction

CVE-2026-27522

OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset

CVE-2026-27545

OpenClaw: Node system.run approval bypass via parent-symlink cwd rebind

CVE-2026-28453

OpenClaw has Zip Slip path traversal in tar archive extraction

CVE-2026-28457

OpenClaw's sandbox skill mirroring path traversal vulnerability could write outside the sandbox workspace

CVE-2026-28464

OpenClaw has non-constant-time token comparison in hooks authentication

CVE-2026-28466

OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway

CVE-2026-28475

OpenClaw: Config writes could persist resolved ${VAR} secrets to disk

CVE-2026-28486

OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands

CVE-2026-29607

OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution

CVE-2026-31989

OpenClaw has web_search citation redirect SSRF via private-network-allowing policy

CVE-2026-31991

OpenClaw has Signal group allowlist authorization bypass via DM pairing-store leakage

CVE-2026-31993

OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains

CVE-2026-31997

OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind

CVE-2026-31999

CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths

CVE-2026-32013

OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write

CVE-2026-32020

OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read

CVE-2026-32038

OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>

CVE-2026-32041

OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failure

CVE-2026-32048

OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns

CVE-2026-32049

OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels

CVE-2026-32054

OpenClaw has browser trace/download path symlink escape in temp output handling

CVE-2026-32058

OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows

CVE-2026-32062

OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure

CVE-2026-32065

OpenClaw: system.run approval identity mismatch could execute a different binary than displayed

CVE-2026-32066

OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)

GHSA-392f-ggf5-fp3c

OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists

GHSA-6x2m-hqfw-hvpj

OpenClaw: Node exec approvals could be replayed across nodes

GHSA-7xmq-g46g-f8pv

OpenClaw: Sandbox media TOCTOU could read files outside sandbox root

GHSA-8m9v-xpgf-g99m

OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization

GHSA-943q-mwmv-hhvh

OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval

GHSA-jq4x-98m3-ggq6

OpenClaw Canvas Path Traversal Information Disclosure Vulnerability

GHSA-jr6x-2q95-fh2g

OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools

GHSA-x82f-27x3-q89c

OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries

CVE-2026-28363

OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode

CVE-2026-32898

OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

CVE-2026-4039

OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)

CVE-2026-27484

OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows

CVE-2026-27485

OpenClaw: Reject symlinks in local skill packaging script

CVE-2026-27488

OpenClaw hardened cron webhook delivery against SSRF

CVE-2026-27576

OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs

CVE-2026-28394

OpenClaw has a Web Fetch DoS via unbounded response parsing

CVE-2026-28479

OpenClaw replaced a deprecated sandbox hash algorithm

CVE-2026-31996

OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags

CVE-2026-32060

OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace

CVE-2026-4040

OpenClaw safeBins file-existence oracle information disclosure

CVE-2026-26317

OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints

CVE-2026-26323

OpenClaw has a command injection in maintainer clawtributors updater

CVE-2026-26327

OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning

CVE-2026-26328

OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities

CVE-2026-26329

OpenClaw has a path traversal in browser upload allows local file read

CVE-2026-26972

OpenClaw has a Path Traversal in Browser Download Functionality

CVE-2026-27001

OpenClaw: Unsanitized CWD path injection into LLM prompts

CVE-2026-27002

OpenClaw: Docker container escape via unvalidated bind mount config injection

CVE-2026-27003

OpenClaw: Telegram bot token exposure via logs

CVE-2026-27004

OpenClaw session tool visibility hardening and Telegram webhook secret fallback

CVE-2026-27007

OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation

CVE-2026-27008

OpenClaw hardened the skill download target directory validation

CVE-2026-27009

OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

CVE-2026-27486

OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup

CVE-2026-27487

OpenClaw: Prevent shell injection in macOS keychain credential write

CVE-2026-28392

OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands

CVE-2026-28451

OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension

CVE-2026-28452

OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)

CVE-2026-28456

OpenClaw affected by potential code execution via unsafe hook module path handling in Gateway

CVE-2026-28462

OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes

CVE-2026-28463

OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion

CVE-2026-28468

OpenClaw has an authentication bypass in sandbox browser bridge server

CVE-2026-28469

OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting

CVE-2026-28476

OpenClaw affected by SSRF in optional Tlon (Urbit) extension authentication

CVE-2026-28477

OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution

CVE-2026-28478

OpenClaw affected by denial of service via unbounded webhook request body buffering

CVE-2026-28480

OpenClaw Telegram allowlist authorization accepted mutable usernames

CVE-2026-28482

OpenClaw's unsanitized session ID enables path traversal in transcript file operations

CVE-2026-29606

OpenClaw Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled

CVE-2026-29609

OpenClaw affected by denial of service via unbounded URL-backed media fetch

CVE-2026-29610

OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)

CVE-2026-29611

OpenClaw has a LFI in BlueBubbles media path handling

CVE-2026-29612

OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks

GHSA-w5c7-9qqw-6645

OpenClaw inter-session prompts could be treated as direct user instructions

CVE-2026-24764

OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions

CVE-2026-25474

OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass

CVE-2026-26316

OpenClaw BlueBubbles webhook auth bypass via loopback proxy trust

CVE-2026-26319

OpenClaw is Missing Webhook Authentication in Telnyx Provider Allows Unauthenticated Requests

CVE-2026-26320

OpenClaw macOS deep link confirmation truncation can conceal executed agent message

CVE-2026-26321

OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension

CVE-2026-26322

OpenClaw Gateway tool allowed unrestricted gatewayUrl override

CVE-2026-26324

OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)

CVE-2026-26325

OpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals

CVE-2026-26326

OpenClaw skills.status could leak secrets to operator.read clients

CVE-2026-28391

OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating

CVE-2026-28395

OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback

CVE-2026-28446

OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching)

CVE-2026-28447

OpenClaw has a Path Traversal in Plugin Installation

CVE-2026-28448

OpenClaw Twitch allowFrom is not enforced in optional plugin, unauthorized chat users can trigger agent pipeline

CVE-2026-28450

OpenClaw's unauthenticated Nostr profile HTTP endpoints allow remote profile/config tampering

CVE-2026-28454

OpenClaw has a potential access-group authorization bypass if channel type lookup fails

CVE-2026-28458

OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access

CVE-2026-28459

OpenClaw has an arbitrary transcript path file write via gateway sessionFile

CVE-2026-28467

OpenClaw affected by SSRF via attachment/media URL hydration

CVE-2026-28470

OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes

CVE-2026-28471

OpenClaw has a Matrix allowlist bypass via displayName and cross-homeserver localpart matching

CVE-2026-28472

OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated

CVE-2026-28473

OpenClaw authorization bypass: operator.write can resolve exec approvals via chat.send -> /approve

CVE-2026-28481

OpenClaw MS Teams inbound attachment downloader leaks bearer tokens to allowlisted suffix domains

CVE-2026-29613

OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)

GHSA-56f2-hvwg-5743

OpenClaw affected by SSRF in Image Tool Remote Fetch

GHSA-chm2-m3w2-wcxm

OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch

GHSA-g27f-9qjv-22pm

OpenClaw log poisoning (indirect prompt injection) via WebSocket headers

GHSA-hv93-r4j3-q65f

OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing

CVE-2026-25475

OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction

CVE-2026-25593

OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply