Skip to content
OpenAdvisories
High WID-SEC-2026-1161 40 CVEs

OpenClaw: Mehrere Schwachstellen

Published Apr 16, 2026 · Updated May 6, 2026 · Revision 4 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 40

  • Critical 9.8
    CVE-2026-43575

    OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route

    OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials. Attackers can access the noVNC helper route without bridge authentication to ga…

    OpenClaw OpenClaw openclaw npm
  • Critical 9.8
    CVE-2026-44109

    OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation

    OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command dispatch. Missing encryptKey configuration and blank callback tokens fail open instead…

    OpenClaw OpenClaw openclaw npm
  • Critical 9.6
    CVE-2026-44112

    OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes

    OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to …

    OpenClaw OpenClaw openclaw npm
  • Critical 9.1
    CVE-2026-43534

    OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events

    OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.

    OpenClaw OpenClaw openclaw npm
  • Critical 9.1
    CVE-2026-43566

    OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events

    OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content. Attackers can exploit this by sending untrusted webhook wake events to preserv…

    OpenClaw OpenClaw openclaw npm
  • Critical 9.1
    CVE-2026-43578

    OpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner Downgrade

    OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to l…

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-42434

    OpenClaw 2026.4.5 < 2026.4.10 - Sandbox Escape via host Parameter Override in Exec Routing

    OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node. Attackers can bypass sandbox boundaries and route execution to remote nodes instead of intended sand…

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-42435

    OpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment Injection

    OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at the argv level. Attackers can bypass exec preflight handling to manipulate high-ri…

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-43530

    OpenClaw 2026.2.23 < 2026.4.12 - Weakened Exec Approval Binding via busybox and toybox Applet Execution

    OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obscure which applet would actually run. Attackers can exploit opaque multi-call binaries to by…

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-43569

    OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider Auth

    OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider auth choices are shadowed. Attackers can exploit this by crafting malicious worksp…

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-43571

    OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup

    OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins. Attackers can exploit this by crafting malicious workspace plugins that bypass…

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-43584

    OpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec Policy

    OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-risk interpreter startup variables including VIMINIT, EXINIT, LUA_INIT, and HOSTALIAS…

    OpenClaw OpenClaw openclaw npm
  • High 8.8
    CVE-2026-44110

    OpenClaw < 2026.4.15 - Authorization Bypass in Matrix Room Control Commands via DM Pairing Store

    OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing-store entries. Attackers with DM-paired sender IDs can execute room control commands without being in configured allow…

    OpenClaw OpenClaw
  • High 8.6
    CVE-2026-43533

    OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags

    OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storage boundary. Attackers can craft malicious reply text containing media tags to disc…

    OpenClaw OpenClaw openclaw npm
  • High 8.5
    CVE-2026-42439

    OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes

    OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured browser SSRF policy protections by exploiting the /tabs/action endpoint to perform…

    OpenClaw OpenClaw openclaw npm
  • High 8.2
    CVE-2026-43526

    OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling

    OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fe…

    OpenClaw OpenClaw openclaw npm
  • High 8.1
    CVE-2026-43585

    OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution

    OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket handlers fail to re-resolve authentication per-request, enabling attackers to use ro…

    OpenClaw OpenClaw openclaw npm
  • High 7.7
    CVE-2026-42436

    OpenClaw < 2026.4.14 - Internal Page Content Exposure via Browser Snapshot and Screenshot Routes

    OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the final browser target after navigation. Authenticated callers can bypass SSRF restrictions to exp…

    OpenClaw OpenClaw openclaw npm
  • High 7.7
    CVE-2026-42438

    OpenClaw 2026.4.9 < 2026.4.10 - Sender Policy Bypass in Host Media Attachment Reads

    OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized local file disclosure. Attackers with denied read access via toolsBySender or group policy can …

    OpenClaw OpenClaw openclaw npm
  • High 7.7
    CVE-2026-43527

    OpenClaw < 2026.4.14 - Server-Side Request Forgery via Private Network Navigation

    OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration to access internal services or metadata endpoints through brow…

    OpenClaw OpenClaw openclaw npm
  • High 7.7
    CVE-2026-43532

    OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image

    OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media.

    OpenClaw OpenClaw openclaw npm
  • High 7.7
    CVE-2026-43573

    OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes

    OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforc…

    OpenClaw OpenClaw openclaw npm
  • High 7.7
    CVE-2026-43576

    OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL

    OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted second-hop targets. The webSocketDebuggerUrl response field is not properly validated, enabli…

    OpenClaw OpenClaw openclaw npm
  • High 7.7
    CVE-2026-43580

    OpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions

    OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type submit flows, can bypass p…

    OpenClaw OpenClaw openclaw npm
  • High 7.5
    CVE-2026-42437

    OpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime Path

    OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unav…

    OpenClaw OpenClaw openclaw npm
  • High 7.3
    CVE-2026-43531

    OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File

    OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser …

    OpenClaw OpenClaw openclaw npm
  • Medium 6.8
    CVE-2026-43535

    OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches

    OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final sender's authorization context. Attackers can exploit this by sending multiple queue…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-42433

    OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

    OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent p…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-43528

    OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases

    OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provi…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-43567

    OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter

    OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files t…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-43568

    OpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint

    OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming settings. Attackers with write-scoped gateway access can toggle admin-class configuration mutations t…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-43570

    OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling

    OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing crafted symlink paths to…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-43577

    OpenClaw < 2026.4.9 - Arbitrary File Read via Browser Interaction Routes

    OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers can pivot into the local CDP origin and create or read disallowed file:// pages despite direct navi…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.5
    CVE-2026-43579

    OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes

    OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write …

    OpenClaw OpenClaw openclaw npm
  • Medium 6.3
    CVE-2026-43582

    OpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass

    OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between valid…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.8
    CVE-2026-41389

    OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths

    OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side file reads or Windows …

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-43572

    OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler

    OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks. Attackers can bypass sender authorization by sending SSO invoke requests that are…

    OpenClaw OpenClaw openclaw npm
  • Medium 5.3
    CVE-2026-43583

    OpenClaw 2026.4.10 < 2026.4.14 - Loss of Group Tool-Policy Context in Delivery Queue Recovery

    OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered queued outbound media to bypass group tool policy enforcement and weaken channel media restrictions a…

    OpenClaw OpenClaw openclaw npm
  • Medium 4.3
    CVE-2026-44111

    OpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_get

    OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read any Markdown files within the workspace root. Attackers with access to the memory tool can bypass path restrictions by p…

    OpenClaw OpenClaw openclaw npm
  • Low 2.5
    CVE-2026-43529

    OpenClaw < 2026.4.10 - Time-of-Check-Time-of-Use (TOCTOU) Race Condition in exec Script Preflight Validator

    OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boundary checks. An attacker with workspace write access can race-condition swap the t…

    OpenClaw OpenClaw openclaw npm

Revision history

  1. #4

    CVE's ergänzt

  2. #3

    CVE's ergänzt

  3. #2

    CVE ergänzt

  4. #1

    Initiale Fassung

References