Skip to content
OpenAdvisories
High WID-SEC-2026-0948 52 CVEs

OpenClaw: Mehrere Schwachstellen

Published Mar 31, 2026 · Updated Apr 28, 2026 · Revision 5 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 52

  • Critical 9.9
    CVE-2026-41329

    OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalation

    OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation. Attackers can exploit improper context validation to bypass sandbox restric…

    OpenClaw OpenClaw openclaw npm
  • Critical 9.1
    CVE-2026-41386

    OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes

    OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond thei…

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-41349

    OpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch

    OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter. Remote attackers can exploit this to bypass security controls and execute unauthorized operations…

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-41378

    OpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch

    OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileg…

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-41404

    OpenClaw < 2026.3.31 - Operator Admin Privilege Escalation via Trusted-Proxy Authentication

    OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can exploit this by declaring operator scopes on non-Control-UI clients, allowing sel…

    OpenClaw OpenClaw openclaw npm
  • High 8.2
    CVE-2026-41296

    OpenClaw < 2026.3.31 - Sandbox Escape via TOCTOU Race in Remote FS Bridge readFile

    OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape. Attackers can exploit the separate path validation and file read operations to bypass sandbox restricti…

    OpenClaw OpenClaw openclaw npm
  • High 8.2
    CVE-2026-41394

    OpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes

    OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions inten…

    OpenClaw OpenClaw openclaw npm
  • High 8.1
    CVE-2026-41353

    OpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection

    OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit thi…

    OpenClaw OpenClaw openclaw npm
  • High 8.1
    CVE-2026-41364

    OpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar Upload

    OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers can exploit this by uploading tar archives containing symlinks to escape the sandbox and overwrite …

    OpenClaw OpenClaw openclaw npm
  • High 7.8
    CVE-2026-41336

    OpenClaw < 2026.3.31 - Arbitrary Hook Code Execution via OPENCLAW_BUNDLED_HOOKS_DIR Environment Variable Override

    OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling loading of attacker-controlled hook code. Attackers can replace trusted default-on bundled hooks from untrusted workspaces to execu…

    OpenClaw OpenClaw openclaw npm
  • High 7.8
    CVE-2026-41396

    OpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust Root

    OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the…

    OpenClaw OpenClaw openclaw npm
  • High 7.6
    CVE-2026-41297

    OpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirect

    OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access internal resources by following unvalidated redirects. The marketplace.ts module fails to restrict …

    OpenClaw OpenClaw openclaw npm
  • High 7.6
    CVE-2026-41302

    OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download

    OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests. Attackers can exploit unguarded fetch() calls to access internal r…

    OpenClaw OpenClaw openclaw npm
  • High 7.5
    CVE-2026-41405

    OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing

    OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server resources by byp…

    OpenClaw OpenClaw openclaw npm
  • High 7.3
    CVE-2026-41355

    OpenClaw < 2026.3.28 - Arbitrary Code Execution via Mirror Mode Sandbox File Conversion

    OpenClaw before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into workspace hooks. Attackers with mirror mode access can execute arbitrary code on the host during gateway startup by exploiti…

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-41347

    OpenClaw < 2026.3.31 - Cross-Site Request Forgery via Missing Browser-Origin Validation in HTTP Operator Endpoints

    OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a browser in trusted-proxy de…

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-41359

    OpenClaw < 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistence

    OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Telegram configuration and cron persistence settings via the send endpoint. Attackers with operator.write cre…

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-41379

    OpenClaw < 2026.3.28 - Privilege Escalation via chat.send to Admin-Class Talk Voice Config

    OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice configuration persistence. Attackers with operator.write privileges can exploit the chat.send endp…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.8
    CVE-2026-41397

    OpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink Traversal

    OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file synchronization operations. Remote attackers can bypass sandbox restrictions by crafting malicious s…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-41300

    OpenClaw < 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboarding

    OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote onboarding flows. Attackers can route gateway credentials to malicious endpoints by having their discovered URL survive the trust decline p…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-41334

    OpenClaw < 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard Bypass

    OpenClaw before 2026.3.31 contains a decompression bomb vulnerability in image processing that fails to properly enforce pixel-limit guards on sips. Attackers can exploit this by uploading oversized images to cause denial of service through excessive memory c…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-41340

    OpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration

    OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where Telegram legacy allowFrom migration incorrectly fans default-account trust into all named accounts. Attackers can exploit this trust propagation to bypass authentication control…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-41369

    OpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host Execution

    OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can exploit this by injecting malicious environment variabl…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-41370

    OpenClaw < 2026.3.31 - Path Traversal via Inbound Channel Attachment Path in ACP Dispatch

    OpenClaw before 2026.3.31 contains a path traversal vulnerability in ACP dispatch that allows attackers to read arbitrary files by manipulating inbound channel attachment paths. Remote attackers can bypass attachment-cache and root directory checks to access …

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-41375

    OpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints

    OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin scope checks for external channels. Attackers can bypass authentication restrictions to arm or…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-41385

    OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass

    OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.1
    CVE-2026-41373

    OpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution Policy

    OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted models to substitute CC, CXX, CARGO_BUILD_RUSTC, and CMAKE_C_COMPILER via environment overrides. At…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.5
    CVE-2026-41366

    OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting

    OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials an…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.4
    CVE-2026-41341

    OpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord Extension

    OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as direct messages in extensions/discord/src/monitor/agent-components-helpers.ts. Attackers can exploit this misclassification t…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.4
    CVE-2026-41356

    OpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotate

    OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.

    OpenClaw OpenClaw openclaw npm
  • Medium 5.4
    CVE-2026-41365

    OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History

    OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.

    OpenClaw OpenClaw openclaw npm
  • Medium 5.4
    CVE-2026-41376

    OpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation

    OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to properly validate message senders. Attackers can fetch thread-root and reply context messages that should be filtered by sender…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.4
    CVE-2026-41381

    OpenClaw < 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist

    OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allowlist restrictions. Attackers can send Discord voice ingress requests before channel allowli…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.4
    CVE-2026-41382

    OpenClaw < 2026.3.31 - Discord Voice Ingress Authorization Bypass via Channel and Role Validation Gaps

    OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist restrictions. Attackers can exploit stale-role validation gaps and improper channel name validation …

    OpenClaw OpenClaw openclaw npm
  • Medium 5.4
    CVE-2026-41406

    OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages

    OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fetched quoted, root, and thread context messages to bypass sender allowlist restrictions and retrieve…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-41331

    OpenClaw < 2026.3.31 - Resource Consumption via Unauthorized Telegram Audio Preflight Transcription

    OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows unauthorized group senders to trigger transcription processing. Attackers can exploit insufficient allowlist enforcement to cause res…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-41335

    OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON

    OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Control UI bootstrap p…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-41337

    OpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay

    OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback origin before replay rejection. Attackers with captured valid callbacks for live calls can exploit this …

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-41343

    OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency

    OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient availability loss. Remote attackers can flood the webhook endpoint with concurrent requests before signature verificati…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-41345

    OpenClaw < 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media Download

    OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects. Attackers can exploit this by crafting malicious cross-origin redirect chains to intercep…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-41374

    OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization

    OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume resources. Remote attackers can trigger audio preflight processing without member allowlist validati…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-41391

    OpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL Handling

    OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate pac…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.0
    CVE-2026-41338

    OpenClaw < 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File Operations

    OpenClaw before 2026.3.31 contains a time-of-check-time-of-use vulnerability in sandbox file operations that allows attackers to bypass fd-based defenses. Attackers can exploit check-then-act patterns in apply_patch, remove, and mkdir operations to manipulate…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.8
    CVE-2026-41393

    OpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery

    OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-tailnet position and CA-trusted endpoint access can exfiltrate operator credentials through DNS stee…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.6
    CVE-2026-41377

    OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation

    OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan w…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.4
    CVE-2026-41330

    OpenClaw < 2026.3.31 - Environment Variable Override via Host Exec Policy

    OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment variables to circum…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.3
    CVE-2026-41350

    OpenClaw < 2026.3.31 - Session Visibility Bypass via session_status in Unsandboxed Invocations

    OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to enforce configured tools.sessions.visibility restrictions for unsandboxed invocations. Attackers can invoke session_status without sandbox …

    OpenClaw OpenClaw openclaw npm
  • Medium 4.3
    CVE-2026-41408

    OpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypass

    OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup operations. Attackers can exhaust disk space by downloading media files without triggering intended sa…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.2
    CVE-2026-41402

    OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass

    OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages across sibling targets using the same messageId. Attackers can exploit overly broad cache keying to by…

    OpenClaw OpenClaw openclaw npm
  • Low 3.7
    CVE-2026-41333

    OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken

    OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authentication flow to bypass rat…

    OpenClaw OpenClaw openclaw npm
  • Low 3.3
    CVE-2026-41357

    OpenClaw < 2026.3.31 - Unsanitized Environment Variable Leakage in SSH Sandbox Backends

    OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes. Attackers can exploit this by leveraging non-default SSH environment forwarding configurations…

    OpenClaw OpenClaw openclaw npm
  • Low 2.9
    CVE-2026-41403

    OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification

    OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly…

    OpenClaw OpenClaw openclaw npm

Revision history

  1. #5

    CVE-Nummern ergänzt

  2. #4

    Referenzen ergänzt

  3. #3

    CVE-Nummern ergänzt

  4. #2

    CVE's ergänzt

  5. #1

    Initiale Fassung

References