Skip to content
OpenAdvisories
High WID-SEC-2026-0542 16 CVEs

OpenClaw: Mehrere Schwachstellen

Published Feb 25, 2026 · Updated Apr 12, 2026 · Revision 8 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 16

  • High 8.8
    CVE-2026-32013 Public exploit

    OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods

    OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and writing files outside the agent workspace. Attackers can exploit symlinked allowlisted files to access …

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-32042

    OpenClaw < 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway Authentication

    OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements and self-assign elevated operator scopes including operator.admin. Attackers with valid sha…

    OpenClaw OpenClaw openclaw npm
  • High 7.5
    CVE-2026-32025

    OpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypass

    OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user into opening a malicious w…

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-32057

    OpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id Parameter

    OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client ca…

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-35632

    OpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update

    OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-co…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.8
    CVE-2026-32005

    OpenClaw < 2026.2.25 - Authorization Bypass in Interactive Callbacks via Sender Check Skip

    OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks including block_action, view_submission, and view_closed in shared workspace deployments. Unauthorized workspace members can bypass allowFrom restrictio…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-28449

    OpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression

    OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger d…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-32043

    OpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter

    OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between …

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-32054

    OpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path Handling

    OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers to escape the managed temp root directory. An attacker with local access can create symlinks to route…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.3
    CVE-2026-32012 Rejected

    This CVE ID has been rejected.

  • Medium 5.4
    CVE-2026-32898

    OpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata

    OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for …

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-32028

    OpenClaw < 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingress

    OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications, allowing non-allowlisted users to enqueue reaction-derived system events. Attackers can exploit this inconsisten…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-3691

    OpenClaw Client PKCE Verifier Information Disclosure Vulnerability

    OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target …

    OpenClaw OpenClaw openclaw npm
  • Medium 4.8
    CVE-2026-32065

    OpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command Execution

    OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a t…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.3
    CVE-2026-32899

    OpenClaw < 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event Handlers

    OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context. Attackers can bypass configured DM policies and channel user allowlists to inject unaut…

    OpenClaw OpenClaw openclaw npm
  • Low 3.7
    CVE-2026-32050

    OpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check Bypass

    OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only ev…

    OpenClaw OpenClaw openclaw npm

Revision history

  1. #8

    CVE-2026-3691 ergänzt

  2. #7

    CVE-2026-35632 ergänzt

  3. #6

    Referenz(en) aufgenommen: GHSA-86JJ-29WC-7Q2W, GHSA-XH9J-MPC9-2M9P, GHSA-G839-VP47-WGH8, GHSA-7XR2-Q9VF-X4R5

  4. #5

    CVE ergänzt

  5. #4

    CVE's ergänzt

  6. #3

    CVE-Nummern ergänzt

  7. #2

    CVE-2026-28449 ergänzt

  8. #1

    Initiale Fassung

References