Skip to content
OpenAdvisories
Medium WID-SEC-2026-1035 5 CVEs

OpenClaw: Mehrere Schwachstellen

Published Apr 8, 2026 · Updated Jun 30, 2026 · Revision 4 · de-DE

Vendor: Red Hat Product: Enterprise Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen oder andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 5

  • High 8.5
    CVE-2026-41914

    OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths

    OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies.

    OpenClaw OpenClaw openclaw npm
  • High 7.1
    CVE-2026-42429

    OpenClaw < 2026.4.8 - Privilege Escalation via Gateway Plugin HTTP Authentication

    OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.read requests to runtime operator.write permissions. Attackers can exploit this by sending read…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-40037

    OpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects

    OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering redirects to exfiltrate sensitive request data o…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-41911

    OpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image

    OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries. Attackers can exploit upload_file and upload_image endpoints to access files beyond the intended wo…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-41363

    OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter

    OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restrictions. Attackers can exploit improper path resolution during upload_image operatio…

    OpenClaw OpenClaw openclaw npm

Revision history

  1. #4

    Neue Updates von Red Hat aufgenommen

  2. #3

    CVE-Nummern ergänzt

  3. #2

    Referenzen ergänzt

  4. #1

    Initiale Fassung

References