Skip to content
OpenAdvisories
Medium WID-SEC-2026-0639 3 CVEs

OpenClaw: Mehrere Schwachstellen

Published Mar 8, 2026 · Updated Mar 23, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode auszuführen.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 3

  • Critical 9.3
    CVE-2026-32913 Public exploit

    OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects

    OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers l…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.1
    CVE-2026-27646

    OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command

    OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime. Attackers can bypass sandbox restrictions by invoking the /acp spawn slash-comm…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-27183

    OpenClaw < 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatch

    OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip shell wrapper approval requirements. The approval classifier and execution planner apply different d…

    OpenClaw OpenClaw openclaw npm

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References