Skip to content
OpenAdvisories
High WID-SEC-2026-0856 25 CVEs

OpenClaw: Mehrere Schwachstellen

Published Mar 24, 2026 · Updated Apr 12, 2026 · Revision 4 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen – sogar Administratorrechte – zu erlangen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 25

  • High 8.8
    CVE-2026-35638

    OpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UI

    OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain self-declared privileged scopes without device identity verification. Attackers can exploit the device-less allow path in …

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-35639

    OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation

    OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually holds. Attackers can …

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-35643

    OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface

    OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application context.

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-35666

    OpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch Wrapper

    OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to reuse approval state for in…

    OpenClaw OpenClaw openclaw npm
  • High 8.1
    CVE-2026-35660

    OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset

    OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges can invoke /reset or /new…

    OpenClaw OpenClaw openclaw npm
  • High 7.3
    CVE-2026-35637

    OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM

    OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions. Attackers can exploit this timing vulnerability to access or manipulate content bef…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-35618

    OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification

    OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters. The verification path derives replay keys from the full URL including query …

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-35627

    OpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM Handling

    OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attackers can trigger unauthorized pre-authentication computation by sending crafted DM messages, …

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-35631

    OpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat Commands

    OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unauthorized modifications. Attackers without admin privileges can execute mutating control-plane actions by directly invoking affected ACP comman…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-35644

    OpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots

    OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-35649

    OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist

    OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty allowlist handling. The vulnerability treats explicit empty allowlists as unset during reconciliation,…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-35652

    OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch

    OpenClaw before 2026.3.22 contains an authorization bypass vulnerability in interactive callback dispatch that allows non-allowlisted senders to execute action handlers. Attackers can bypass sender authorization checks by dispatching callbacks before normal s…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-35656

    OpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate Limiter

    OpenClaw before 2026.3.22 contains an authentication bypass vulnerability in the X-Forwarded-For header processing when trustedProxies is configured, allowing attackers to spoof loopback hops. Remote attackers can inject forged forwarding headers to bypass ca…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-35658

    OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool

    OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools.fs.workspaceOnly restrictions. Attackers can traverse sandbox bridge mounts outside the workspace to read files that other filesystem tool…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.9
    CVE-2026-35622

    OpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat Webhook

    OpenClaw before 2026.3.22 contains an improper authentication verification vulnerability in Google Chat app-url webhook handling that accepts add-on principals outside intended deployment bindings. Attackers can bypass webhook authentication by providing non-…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.9
    CVE-2026-35670

    OpenClaw < 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology Chat

    OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies to unintended users by exploiting mutable username matching instead of stable numeric user identifiers. Attackers can manipulate username ch…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.7
    CVE-2026-35655

    OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution

    OpenClaw before 2026.3.22 contains an identity spoofing vulnerability in ACP permission resolution that trusts conflicting tool identity hints from rawInput and metadata. Attackers can spoof tool identities through rawInput parameters to suppress dangerous-to…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-34510

    OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders

    OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file targets that are treate…

    OpenClaw OpenClaw
  • Medium 5.3
    CVE-2026-35626

    OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook

    OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resou…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-35633

    OpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responses

    OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with large bodies to remote medi…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.1
    CVE-2026-35634

    OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway

    OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-direct requests without validating bearer tokens or canvas capabilities. Attackers can send unauthentic…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.8
    CVE-2026-35635

    OpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat

    OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook pat…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.6
    CVE-2026-35659

    OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery

    OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to uninte…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.2
    CVE-2026-35624

    OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk

    OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to…

    OpenClaw OpenClaw openclaw npm
  • Low 3.7
    CVE-2026-35648

    OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions

    OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy tightening to execute unau…

    OpenClaw OpenClaw openclaw npm

Revision history

  1. #4

    CVE-Nummern ergänzt

  2. #3

    CVE-Nummern ergänzt

  3. #2

    CVE ergänzt

  4. #1

    Initiale Fassung

References