Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Sicherheitsmaßnahmen zu umgehen und so Daten zu manipulieren oder beliebigen Code auszuführen.
Product
OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.
Vulnerabilities 2
-
High 8.8
OpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliases
OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators…
-
Medium 6.5
OpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reload
OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active after secrets.reload. Attackers can exploit the stale-secret window to deliver webhook events after o…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Advisory Database vom 2026-06-14
https://github.com/advisories/GHSA-P68J-Q8J9-JWF5
-
GitHub Advisory Database vom 2026-06-14
https://github.com/advisories/GHSA-FFHM-8FWQ-7Q27
-
VulnCheck Advisory vom 2026-06-14
https://www.vulncheck.com/advisories/openclaw-webhook-secret-revocation-bypass-via-secrets-reload
-
VulnCheck Advisory vom 2026-06-14
https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-powershell-encoded-command-aliases
-
EU Vulnerability Database vom 2026-06-14
https://euvd.enisa.europa.eu/enisa/EUVD-2026-36618
-
EU Vulnerability Database vom 2026-06-14
https://euvd.enisa.europa.eu/enisa/EUVD-2026-36624