Skip to content
OpenAdvisories
Medium WID-SEC-2026-1242 2 CVEs

OpenClaw: Mehrere Schwachstellen

Published Apr 22, 2026 · Updated May 11, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 2

  • Medium 4.2
    CVE-2026-44991

    OpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel Senders

    OpenClaw before 2026.4.21 contains an authorization bypass vulnerability in command-auth.ts that allows non-owner senders to execute owner-enforced slash commands when wildcard inbound senders are configured without explicit owner allowFrom settings. Attacker…

    OpenClaw OpenClaw openclaw npm
  • Low 3.7
    CVE-2026-44996

    OpenClaw < 2026.4.15 - Arbitrary Local File Read via Webchat Audio Embedding

    OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root containment checks. Attackers can influence agent or tool-produced ReplyPayload.mediaUrl parameters to res…

    OpenClaw OpenClaw openclaw npm

Revision history

  1. #2

    CVE-Nummern ergänzt

  2. #1

    Initiale Fassung

References