Skip to content
OpenAdvisories
Medium WID-SEC-2026-0441 4 CVEs

OpenClaw: Mehrere Schwachstellen

Published Feb 17, 2026 · Updated Mar 5, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Informationen offenzulegen und Daten zu manipulieren.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 4

  • Critical 9.3
    CVE-2026-28484 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • High 7.5
    CVE-2026-26321

    OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension

    OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. If an attacker can influence t…

    OpenClaw OpenClaw openclaw npm
  • High 7.5
    CVE-2026-28479

    OpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration

    OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vulnerable to collision attacks. An attacker can exploit SHA-1 collisions to cause cache poisoning, all…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.9
    CVE-2026-27004

    OpenClaw session tool visibility hardening and Telegram webhook secret fallback

    OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools (`sessions_list`, `sessions_history`, `sessions_send`) allowed broader session targeting than some operators intended. This is primarily …

    OpenClaw OpenClaw openclaw npm

Revision history

  1. #2

    CVE- und EUVD-Referenzen ergänzt

  2. #1

    Initiale Fassung

References