Summary
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder andere, nicht näher spezifizerte Angriffe durchzuführen.
Product
OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.
Vulnerabilities 4
-
Medium 6.3
OpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run
OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execu…
-
Medium 6.2
OpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download
OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archive download and copy operations. A local attacker can rebind the tools-root path …
-
Medium 4.3
OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration
OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom pa…
-
Low 2.3CVE-2026-34509 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Revision history
-
#3
CVE's ergänzt
-
#2
CVE-2026-33574 ergänzt
-
#1
Initiale Fassung
References
-
OpenClaw GitHub vom 2026-03-10
https://github.com/openclaw/openclaw/security/advisories/GHSA-8g75-q649-6pv6
-
OpenClaw GitHub vom 2026-03-10
https://github.com/openclaw/openclaw/security/advisories/GHSA-g7cr-9h7q-4qxq
-
OpenClaw GitHub vom 2026-03-10
https://github.com/openclaw/openclaw/security/advisories/GHSA-vhwf-4x96-vqx2