Advisories · Technology

OpenClaw.

Every CVE that names OpenClaw among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-100533 CVE record

CVSS 6.0 Medium

OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback
- OpenClaw
- Path traversal
Not analysed yet 26 Sept 2026
CVE-2026-100530 CVE record

CVSS 8.5 High

OpenClaw before 2026.8.1 Exec Approval Directory Binding
- OpenClaw
- Broken access control
Not analysed yet 26 Sept 2026
CVE-2026-100529 CVE record

CVSS 7.4 High

OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer
- OpenClaw
- Broken access control
Not analysed yet 26 Sept 2026
CVE-2026-100528 CVE record

CVSS 5.9 Medium

OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint
- OpenClaw
- Information disclosure
Not analysed yet 26 Sept 2026
CVE-2026-100527 CVE record

CVSS 6.9 Medium

OpenClaw before 2026.8.2 Denial of Service via Browser Relay
- OpenClaw
- Denial of service
Not analysed yet 26 Sept 2026
CVE-2026-94094 CVE record

CVSS 5.3 Medium

OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service
- OpenClaw
- Denial of service
Not analysed yet 20 Sept 2026
CVE-2026-62229 CVE record

CVSS 7.7 High

OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching
- OpenClaw
- Path traversal
Not analysed yet 17 Jul 2026
CVE-2026-62228 CVE record

CVSS 7.7 High

OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62227 CVE record

CVSS 4.9 Medium

OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot
- OpenClaw
- Server-side request forgery (SSRF)
Not analysed yet 17 Jul 2026
CVE-2026-62226 CVE record

CVSS 5.1 Medium

OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route
- OpenClaw
- Server-side request forgery (SSRF)
Not analysed yet 17 Jul 2026
CVE-2026-62225 CVE record

CVSS 2.3 Low

OpenClaw < 2026.5.18 Authorization Bypass via Skill Command Dispatch
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62223 CVE record

CVSS 7.7 High

OpenClaw < 2026.5.18 Authorization Bypass via Device-pair
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62222 CVE record

CVSS 7.1 High

OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode
- OpenClaw
- CWE-829
Not analysed yet 17 Jul 2026
CVE-2026-62221 CVE record

CVSS 2.3 Low

OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62220 CVE record

CVSS 6.3 Medium

OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass
- OpenClaw
- Authentication bypass
Not analysed yet 17 Jul 2026
CVE-2026-62219 CVE record

CVSS 6.0 Medium

OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62218 CVE record

CVSS 8.7 High

OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62217 CVE record

CVSS 7.7 High

OpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvals
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62216 CVE record

CVSS 2.3 Low

OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload
- OpenClaw
- Server-side request forgery (SSRF)
Not analysed yet 17 Jul 2026
CVE-2026-62215 CVE record

CVSS 5.1 Medium

OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas
- OpenClaw
- CWE-345
Not analysed yet 17 Jul 2026
CVE-2026-62212 CVE record

CVSS 5.1 Medium

OpenClaw < 2026.5.28 Authentication Bypass via safeFetch
- OpenClaw
- Race condition
Not analysed yet 17 Jul 2026
CVE-2026-62211 CVE record

CVSS 4.1 Medium

OpenClaw < 2026.6.1 Credential Redaction Bypass via Trajectory Export
- OpenClaw
- Information disclosure
Not analysed yet 17 Jul 2026
CVE-2026-62210 CVE record

CVSS 6.0 Medium

OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs
- OpenClaw
- Denial of service
Not analysed yet 17 Jul 2026
CVE-2026-62209 CVE record

CVSS 7.6 High

OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62207 CVE record

CVSS 7.7 High

OpenClaw < 2026.6.5 Authentication Bypass via Admin Tools
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62206 CVE record

CVSS 6.0 Medium

OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62205 CVE record

CVSS 6.0 Medium

OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62203 CVE record

CVSS 7.7 High

OpenClaw < 2026.6.6 Environment Variable Injection via rustup
- OpenClaw
- CWE-184
Not analysed yet 17 Jul 2026
CVE-2026-62202 CVE record

CVSS 7.7 High

OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron
- OpenClaw
- Broken access control
Not analysed yet 17 Jul 2026
CVE-2026-62201 CVE record

CVSS 4.9 Medium

OpenClaw < 2026.6.6 Network Policy Bypass via exec-server
- OpenClaw
- Server-side request forgery (SSRF)
Not analysed yet 17 Jul 2026
CVE-2026-62200 CVE record

CVSS 8.7 High

OpenClaw < 2026.6.6 Authentication Bypass via Git ext transport
- OpenClaw
- CWE-184
Not analysed yet 13 Jul 2026
CVE-2026-62199 CVE record

CVSS 8.7 High

OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering
- OpenClaw
- CWE-184
Not analysed yet 13 Jul 2026
CVE-2026-62198 CVE record

CVSS 5.3 Medium

OpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web Search
- OpenClaw
- Broken access control
Not analysed yet 13 Jul 2026
CVE-2026-62196 CVE record

CVSS 8.7 High

OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs
- OpenClaw
- Broken access control
Not analysed yet 13 Jul 2026
CVE-2026-62195 CVE record

CVSS 8.7 High

OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback
- OpenClaw
- Broken access control
Not analysed yet 13 Jul 2026
CVE-2026-62194 CVE record

CVSS 8.7 High

OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install
- OpenClaw
- Broken access control
Not analysed yet 13 Jul 2026
CVE-2026-62193 CVE record

CVSS 6.9 Medium

OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install
- OpenClaw
- Broken access control
Not analysed yet 13 Jul 2026
CVE-2026-62192 CVE record

CVSS 7.2 High

OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass
- OpenClaw
- Broken access control
Not analysed yet 13 Jul 2026
CVE-2026-62191 CVE record

CVSS 7.1 High

OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations
- OpenClaw
- Broken access control
Not analysed yet 13 Jul 2026
CVE-2026-62190 CVE record

CVSS 8.7 High

OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper
- OpenClaw
- Broken access control
- CWE-706
Not analysed yet 13 Jul 2026
CVE-2026-62189 CVE record

CVSS 7.6 High

OpenClaw < 2026.6.9 Symlink Following via Mirror Sync
- OpenClaw
- Path traversal
- Race condition
Not analysed yet 13 Jul 2026
CVE-2026-62186 CVE record

CVSS 7.2 High

OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override
- OpenClaw
- Broken access control
Not analysed yet 13 Jul 2026
CVE-2026-59261 CVE record

CVSS 8.4 High

OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files
- OpenClaw
- CWE-184
Not analysed yet 8 Jul 2026
CVE-2026-8305 CVE record

CVSS 6.9 Medium

OpenClaw bluebubbles Webhook monitor.ts handleBlueBubblesWebhookRequest improper authentication
- OpenClaw
- Authentication bypass
Not analysed yet 11 May 2026
CVE-2026-44110 CVE record

CVSS 7.7 High

OpenClaw < 2026.4.15 - Authorization Bypass in Matrix Room Control Commands via DM Pairing Store
- OpenClaw
- Broken access control
Not analysed yet 6 May 2026
CVE-2026-28485 CVE record

CVSS 7.5 High

OpenClaw 2026.1.5 < 2026.2.12 - Missing Authentication in Browser Control HTTP Endpoints
- OpenClaw
- Authentication bypass
Not analysed yet 5 Mar 2026