Skip to content
OpenAdvisories
High WID-SEC-2026-1280 3 CVEs

OpenClaw: Mehrere Schwachstellen

Published Apr 26, 2026 · Updated May 11, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 3

  • High 8.8
    CVE-2026-45006

    OpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypass

    OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configuration changes by bypassing an incomplete denylist protection. Att…

    OpenClaw OpenClaw openclaw npm
  • High 7.8
    CVE-2026-45004

    OpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory

    OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary JavaScript under the curren…

    OpenClaw OpenClaw openclaw npm
  • Medium 6.0
    CVE-2026-45005

    OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation

    OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoki…

    OpenClaw OpenClaw openclaw npm

Revision history

  1. #2

    CVE-Nummern ergänzt

  2. #1

    Initiale Fassung

References