Skip to content
OpenAdvisories
Medium WID-SEC-2026-0472 43 CVEs

OpenClaw: Mehrere Schwachstellen

Published Feb 22, 2026 · Updated Apr 12, 2026 · Revision 10 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 43

  • High 8.5
    CVE-2026-32907 Rejected

    This CVE ID has been rejected.

  • High 8.1
    CVE-2026-32034

    OpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP

    OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is exposed over plaintext HTTP, allowing attackers to bypass device identity and pairing verific…

    OpenClaw OpenClaw openclaw npm
  • High 7.8
    CVE-2026-32032

    OpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variable

    OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject a malicious SHELL vari…

    OpenClaw OpenClaw openclaw npm
  • High 7.7
    CVE-2026-32064

    OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer

    OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the expose…

    OpenClaw OpenClaw openclaw npm
  • High 7.5
    CVE-2026-32030

    OpenClaw < 2026.2.19 - Sensitive File Disclosure via stageSandboxMedia Path Traversal

    OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that accepts arbitrary absolute paths when iMessage remote attachment fetching is enabled. An attacker who can tamper with attachment path metadata c…

    OpenClaw OpenClaw openclaw npm
  • High 7.5
    CVE-2026-32049

    OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass

    OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated memory usage a…

    OpenClaw OpenClaw openclaw npm
  • High 7.5
    CVE-2026-32056

    OpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run

    OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files such as .bas…

    OpenClaw OpenClaw openclaw npm
  • High 7.5
    CVE-2026-32062

    OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream

    OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish c…

    OpenClaw OpenClaw voice-call openclaw npm
  • High 7.4
    CVE-2026-32019

    OpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guard

    OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ranges to bypass SSRF policy checks. Attackers with network reachability to special-use IPv4 ranges ca…

    OpenClaw OpenClaw openclaw npm
  • High 7.4
    CVE-2026-3690

    OpenClaw Canvas Authentication Bypass Vulnerability

    OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability. The specific flaw exists within the i…

    OpenClaw OpenClaw openclaw npm
  • High 7.3
    CVE-2026-32908 Rejected

    This CVE ID has been rejected.

  • High 7.2
    CVE-2026-22179

    OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.run

    OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft sh…

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-27566

    OpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run

    OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads tha…

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-31994

    OpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generation

    OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and expansion-sensitive characters in gateway.cmd files. Local attackers with control…

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-32000

    OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution

    OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in command arguments to ex…

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-32017

    OpenClaw < 2026.2.19 - Arbitrary File Write via Short-Option Bypass in exec Allowlist

    OpenClaw versions prior to 2026.2.19 contain an allowlist bypass vulnerability in the exec safeBins policy that allows attackers to write arbitrary files using short-option payloads. Attackers can bypass argument validation by attaching short options like -o …

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-32063

    OpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit Generation

    OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-controlled environment values are not validated for CR/LF characters, allowing newline injection to break out of Environm…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.8
    CVE-2026-22174

    OpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP Probe

    OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to capture the Gateway authentication token. An attacker controlling a loopback port can intercept CDP…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.8
    CVE-2026-29607

    OpenClaw < 2026.2.22 - Authorization Bypass via allow-always Wrapper Persistence

    OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval checks by persisting wrapper-level allowlist entries instead of validating inner executable intent.…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.7
    CVE-2026-22169

    OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins

    OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option. When sort is explicitly added to tools.exec.safeBins, remote att…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.6
    CVE-2026-32003

    OpenClaw < 2026.2.22 - Remote Code Execution via SHELLOPTS/PS4 Environment Injection in system.run

    OpenClaw versions prior to 2026.2.22 contain an environment variable injection vulnerability in the system.run function that allows attackers to bypass command allowlist restrictions via SHELLOPTS and PS4 environment variables. An attacker who can invoke syst…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-22168

    OpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.run

    OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign command. Attackers …

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-22170

    OpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom Configuration

    OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration causes dmPolicy pairing and allowlist restrictions to be ineffective. Remote attackers can send direct…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-32008

    OpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard

    OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authenticated users with browser-tool access to navigate to file:// URLs. Attackers can exploit this by a…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-32022

    OpenClaw < 2026.2.21 - Arbitrary File Read via grep -e Flag Policy Bypass

    OpenClaw versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the grep tool within tools.exec.safeBins that allows attackers to read arbitrary files by supplying a pattern via the -e flag parameter. Attackers can include a positiona…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-3689

    OpenClaw Canvas Path Traversal Information Disclosure Vulnerability

    OpenClaw Canvas Path Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenClaw. Authentication is required to exploit this vulnerability. The specific fla…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.3
    CVE-2026-32010

    OpenClaw < 2026.2.22 - Allowlist Bypass via sort --compress-program Parameter

    OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safe-bin configuration when sort is manually added to tools.exec.safeBins. Attackers can invoke sort with the --compress-program flag to execute arbitrary external programs …

    OpenClaw OpenClaw openclaw npm
  • Medium 6.3
    CVE-2026-4039

    OpenClaw Skill Env applySkillConfigenvOverrides code injection

    A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely.…

    openclaw npm
  • Medium 6.1
    CVE-2026-22177

    OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars

    OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.9
    CVE-2026-32039

    OpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender

    OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the toolsBySender group policy matching that allows attackers to inherit elevated tool permissions through identifier collision attacks. Attackers can exploit untyped sender…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.9
    CVE-2026-32045

    OpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale Auth

    OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements. Attackers on trusted networks can exploit this misconfiguration to access HTTP gateway…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.8
    CVE-2026-28455 Rejected

    This CVE ID has been rejected.

  • Medium 5.5
    CVE-2026-32024

    OpenClaw < 2026.2.22 - Symlink Traversal in Avatar Handling

    OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the configured workspace boundary. Remote attackers can exploit this by requesting avatar resources through…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.4
    CVE-2026-32900 Rejected

    This CVE ID has been rejected.

  • Medium 5.3
    CVE-2026-31995

    OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension

    OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments. When spawn failures trigge…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-32029

    OpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing

    OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoof client IP addresses. In proxy chains that append or preserve header values, a…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-32046

    OpenClaw < 2026.2.21 - OS-level Sandbox Bypass via --no-sandbox Flag

    OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerabilities without requiring a sandbox escape. Attackers can leverage the disabled OS…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.8
    CVE-2026-32896

    OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin

    The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook auth…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.4
    CVE-2026-32061

    OpenClaw < 2026.2.17 - Arbitrary File Read via $include Directive Path Traversal

    OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outside the config directory boundary. Attackers with config modification capabilities can exploit this …

    OpenClaw OpenClaw openclaw npm
  • Medium 4.3
    CVE-2026-27524

    OpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Path

    OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authorized /debug set callers can inject __proto__, constructor, or prototype keys to manipulate object pro…

    OpenClaw OpenClaw openclaw npm
  • Low 3.7
    CVE-2026-32897

    OpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallback

    OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset, creating dual-use of authentication secrets across secu…

    OpenClaw OpenClaw openclaw npm
  • Low 3.6
    CVE-2026-32018

    OpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operations

    OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers. Attackers can exploit unsynchronized read-modify-write operations without locking …

    OpenClaw OpenClaw openclaw npm
  • Low 3.3
    CVE-2026-32020

    OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler

    OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file reads. Attackers can place symlinks under the Control UI root directory to bypass directory confineme…

    OpenClaw OpenClaw openclaw npm

Revision history

  1. #10

    CVE-2026-3689, CVE-2026-3690 ergänzt

  2. #9

    CVE ergänzt

  3. #8

    Referenz(en) aufgenommen: GHSA-QWMF-95R9-GX9X

  4. #7

    CVE's ergänzt

  5. #6

    CVE's ergänzt

  6. #5

    CVE-Nummern ergänzt

  7. #4

    CVE-Nummern ergänzt

  8. #3

    CVE's ergänzt

  9. #2

    CVE-2026-32061, CVE-2026-32062, CVE-2026-32063 ergänzt

  10. #1

    Initiale Fassung

References