Skip to content
OpenAdvisories
High WID-SEC-2026-0557 7 CVEs

OpenClaw: Mehrere Schwachstellen

Published Mar 1, 2026 · Updated Mar 23, 2026 · Revision 5 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Berechtigungen zu erlangen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 7

  • High 8.8
    CVE-2026-32051

    OpenClaw < 2026.3.1 - Authorization Bypass in Agent Runs via Owner-Only Tool Access

    OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces including gateway and cron through agent runs in scoped-token deployments. Attac…

    OpenClaw OpenClaw openclaw npm
  • High 8.7
    CVE-2026-32066 Rejected

    This CVE ID has been rejected.

  • High 7.5
    CVE-2026-28461

    OpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn

    OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sendin…

    OpenClaw OpenClaw openclaw npm
  • High 7.5
    CVE-2026-32048

    OpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn

    OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit this to spaw…

    OpenClaw OpenClaw openclaw npm
  • High 7.4
    CVE-2026-31989

    OpenClaw < 2026.3.1 - Server-Side Request Forgery via web_search Citation Redirect

    OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy. An attacker who can influence citation redirect targets can trigger internal-n…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.9
    CVE-2026-32041

    OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap

    OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessible without authentication. Local processes or loopback-reachable SSRF paths can exploit this to acces…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.9
    CVE-2026-32902 Rejected

    This CVE ID has been rejected.

Revision history

  1. #5

    CVE's ergänzt

  2. #4

    CVE's ergänzt

  3. #3

    CVE-2026-32041 ergänzt

  4. #2

    CVE-2026-28461, CVE-2026-31989 ergänzt

  5. #1

    Initiale Fassung

References