Skip to content
OpenAdvisories
Medium WID-SEC-2026-3316 75 CVEs

OpenClaw: Mehrere Schwachstellen

Published Sep 10, 2026 · Updated Sep 27, 2026 · Revision 3 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Vulnerabilities 75

  • High 8.8
    CVE-2026-100544

    openclaw voice-call before 2026.8.1 Authorization Bypass

    openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's no…

    OpenClaw voice-call
  • High 8.8
    CVE-2026-100552

    OpenClaw before 2026.8.1 Policy Bypass via Native Tools

    OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tool…

    OpenClaw OpenClaw
  • High 8.8
    CVE-2026-100575

    OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM

    OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.

    OpenClaw slack
  • High 8.8
    CVE-2026-100580

    OpenClaw before 2026.7.1 Remote Code Execution via cron tool

    OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a too…

    OpenClaw OpenClaw
  • High 8.8
    CVE-2026-100586

    OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind

    OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native conversation bindings. Non-owner channel senders with command access can create bindings to the native Codex runtime and execute host-capable turns with access t…

    OpenClaw OpenClaw
  • High 8.8
    CVE-2026-100587

    OpenClaw before 2026.7.1 Authorization Bypass via Codex Install

    OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host con…

    OpenClaw OpenClaw
  • High 8.8
    CVE-2026-100596

    OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration

    OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when co…

    OpenClaw OpenClaw
  • High 8.8
    CVE-2026-100599

    OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome

    OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the n…

    OpenClaw OpenClaw
  • High 8.3
    CVE-2026-100551

    OpenClaw iOS Control UI TLS Pin Enforcement Bypass

    OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had…

    OpenClaw OpenClaw
  • High 8.3
    CVE-2026-100557

    OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch

    OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials rese…

    OpenClaw OpenClaw
  • High 8.3
    CVE-2026-100568

    OpenClaw before 2026.8.1 Unauthorized Command Job Access

    OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or uns…

    OpenClaw OpenClaw
  • High 8.3
    CVE-2026-100588

    OpenClaw before 2026.7.1 Authentication Bypass via node.invoke

    OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke method, although direct browser.request access requires administrator scope. In Gateway deploy…

    OpenClaw OpenClaw
  • High 8.3
    CVE-2026-100589

    OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node

    OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over sandboxed agent input c…

    OpenClaw OpenClaw
  • High 8.2
    CVE-2026-100567

    OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname

    OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but the raw WebSocket and Pla…

    OpenClaw OpenClaw
  • High 8.1
    CVE-2026-100532

    openclaw WhatsApp before 2026.8.1 Authentication Bypass

    @openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to stee…

    OpenClaw whatsapp
  • High 8.0
    CVE-2026-100559

    OpenClaw before 2026.8.1 Command Injection via Escaped Newlines

    OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute add…

    OpenClaw OpenClaw
  • High 8.0
    CVE-2026-100561

    OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper

    OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator all…

    OpenClaw OpenClaw
  • High 8.0
    CVE-2026-100585

    OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel

    OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can app…

    OpenClaw OpenClaw
  • High 7.8
    CVE-2026-100570

    OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS

    OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gma…

    OpenClaw OpenClaw
  • High 7.8
    CVE-2026-100597

    OpenClaw before 2026.7.1 Path Traversal via Filesystem Race

    OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after O…

    OpenClaw OpenClaw
  • High 7.6
    CVE-2026-100578

    OpenClaw before 2026.7.1 Authorization Bypass via chat.send

    OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scop…

    OpenClaw OpenClaw
  • High 7.6
    CVE-2026-100579

    OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester

    OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments (authentication modes that honor caller identity and narrower operator scopes), a write-scoped caller can supp…

    OpenClaw OpenClaw
  • High 7.5
    CVE-2026-100535

    OpenClaw before 2026.8.1 Privilege Escalation via Session Memory

    OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming…

    OpenClaw OpenClaw
  • High 7.5
    CVE-2026-100541

    OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding

    OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identit…

    OpenClaw matrix
  • High 7.5
    CVE-2026-100543

    OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash

    OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were …

    OpenClaw OpenClaw
  • High 7.5
    CVE-2026-100558

    OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade

    OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can rep…

    OpenClaw OpenClaw
  • High 7.5
    CVE-2026-100560

    OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass

    OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute command…

    OpenClaw OpenClaw
  • High 7.3
    CVE-2026-100530

    OpenClaw before 2026.8.1 Exec Approval Directory Binding

    OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewe…

    OpenClaw OpenClaw
  • High 7.1
    CVE-2026-100555

    OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery

    OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to th…

    OpenClaw OpenClaw
  • High 7.1
    CVE-2026-100598

    OpenClaw before 2026.7.1 Approval Binding Logic Error

    OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and…

    OpenClaw OpenClaw
  • Medium 6.8
    CVE-2026-100540

    OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

    OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify…

    OpenClaw feishu
  • Medium 6.7
    CVE-2026-100584

    OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows

    OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named execu…

    OpenClaw OpenClaw
  • Medium 6.5
    CVE-2026-100531

    openclaw Slack before 2026.8.1 Authorization Bypass

    The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An…

    OpenClaw slack
  • Medium 6.5
    CVE-2026-100536

    OpenClaw before 2026.8.1 Path Traversal via Structured Attachments

    OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source fields to bypa…

    OpenClaw OpenClaw
  • Medium 6.5
    CVE-2026-100538

    OpenClaw before 2026.8.1 Local File Read via Outbound Attachments

    OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local…

    OpenClaw OpenClaw
  • Medium 6.5
    CVE-2026-100566

    OpenClaw LINE before 2026.8.1 Access Control Inheritance

    OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite …

    OpenClaw line
  • Medium 6.5
    CVE-2026-100582

    OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass

    OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and re…

    OpenClaw msteams feishu matrix npm
  • Medium 6.5
    CVE-2026-100594

    OpenClaw before 2026.7.1 Authorization Bypass via trajectory export

    OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, …

    OpenClaw OpenClaw
  • Medium 6.5
    CVE-2026-100595

    OpenClaw before 2026.7.1 Authorization Bypass via diagnostics

    OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive diagnostic details about th…

    OpenClaw OpenClaw
  • Medium 6.4
    CVE-2026-100529

    OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

    OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and no…

    OpenClaw OpenClaw
  • Medium 6.4
    CVE-2026-100546

    OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript

    OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after …

    OpenClaw OpenClaw
  • Medium 6.3
    CVE-2026-100556

    OpenClaw before 2026.8.1 Authentication Bypass via Session Reset

    OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or owner command authorizati…

    OpenClaw OpenClaw
  • Medium 6.3
    CVE-2026-100577

    OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset

    OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to inte…

    OpenClaw OpenClaw
  • Medium 6.3
    CVE-2026-100591

    OpenClaw before 2026.7.1 Authentication Bypass via Active Memory

    OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the …

    OpenClaw OpenClaw
  • Medium 6.3
    CVE-2026-100592

    OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming

    OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dre…

    OpenClaw OpenClaw
  • Medium 6.3
    CVE-2026-95815

    OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

    OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit age…

    OpenClaw OpenClaw iOS iOS
  • Medium 5.9
    CVE-2026-100574

    OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS

    OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address (0.0.0.0 or ::…

    OpenClaw OpenClaw
  • Medium 5.5
    CVE-2026-100547

    OpenClaw before 2026.8.1 Authentication Bypass via File URL

    OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:` URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative paths and were incorrectly…

    OpenClaw OpenClaw
  • Medium 5.5
    CVE-2026-100569

    OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override

    OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in `_ENDPOINT`, so an untrusted workspace `.env` file could set AZURE_SPEECH_ENDPOINT. Azure Speech p…

    OpenClaw OpenClaw
  • Medium 5.5
    CVE-2026-100581

    OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension

    OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and…

    OpenClaw OpenClaw
  • Medium 5.4
    CVE-2026-100528

    OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint

    OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a p…

    OpenClaw OpenClaw
  • Medium 5.4
    CVE-2026-100549

    OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames

    OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments t…

    OpenClaw OpenClaw
  • Medium 5.4
    CVE-2026-100550

    OpenClaw before 2026.8.1 Authentication Bypass via Access Group

    OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is no…

    OpenClaw OpenClaw
  • Medium 5.4
    CVE-2026-100562

    OpenClaw before 2026.8.1 Authorization Bypass via sessions.create

    OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can …

    OpenClaw OpenClaw
  • Medium 5.4
    CVE-2026-100563

    OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels

    OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust partic…

    OpenClaw OpenClaw
  • Medium 5.4
    CVE-2026-100564

    OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export

    OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in…

    OpenClaw OpenClaw
  • Medium 5.4
    CVE-2026-100576

    OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates

    OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing br…

    OpenClaw OpenClaw
  • Medium 5.4
    CVE-2026-100593

    OpenClaw before 2026.7.1 Authentication Bypass via activation

    OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based …

    OpenClaw OpenClaw
  • Medium 5.3
    CVE-2026-100526

    Vulnerability in discord

    OpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenCl…

    OpenClaw discord
  • Medium 5.3
    CVE-2026-100527

    OpenClaw before 2026.8.2 Denial of Service via Browser Relay

    OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket up…

    OpenClaw OpenClaw
  • Medium 5.3
    CVE-2026-100533

    OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback

    OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling …

    OpenClaw OpenClaw
  • Medium 5.3
    CVE-2026-100545

    OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation

    OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's poli…

    OpenClaw OpenClaw
  • Medium 5.3
    CVE-2026-100548

    OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback

    OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a differ…

    OpenClaw OpenClaw
  • Medium 5.3
    CVE-2026-100571

    OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

    OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook …

    OpenClaw OpenClaw
  • Medium 5.3
    CVE-2026-100572

    OpenClaw before 2026.8.1 Denial of Service via Rate Limit

    OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and…

    OpenClaw OpenClaw
  • Medium 4.3
    CVE-2026-100525

    OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass

    The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as …

    OpenClaw diagnostics-prometheus
  • Medium 4.3
    CVE-2026-100553

    OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin

    OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWi…

    OpenClaw OpenClaw
  • Medium 4.3
    CVE-2026-100583

    OpenClaw Discord before 2026.7.1 Authorization Bypass

    OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-tar…

    OpenClaw discord
  • Medium 4.3
    CVE-2026-100590

    OpenClaw before 2026.7.1 Authorization Bypass via voice set

    OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel senders to persist Gateway voice configuration. Attackers with command access can change the voice used by Talk responses …

    OpenClaw OpenClaw
  • Medium 4.2
    CVE-2026-100554

    OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass

    OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept a…

    OpenClaw OpenClaw
  • Low 3.3
    CVE-2026-100573

    OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

    OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tool…

    OpenClaw OpenClaw
  • Low 3.1
    CVE-2026-100534

    OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass

    OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel AC…

    OpenClaw OpenClaw
  • Low 3.1
    CVE-2026-100537

    OpenClaw before 2026.8.1 Authentication Bypass via Active Memory

    OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules, deterministic and hidd…

    OpenClaw OpenClaw
  • Low 3.1
    CVE-2026-100542

    OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2

    OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push…

    OpenClaw OpenClaw
  • Low 2.6
    CVE-2026-100539

    OpenClaw before 2026.8.1 Memory Access Control Bypass

    OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory_get tool instances retain the enabled configuration captured at creation time because th…

    OpenClaw OpenClaw

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-100546, EUVD-2026-87504, CVE-2026-100589, EUVD-2026-87462, CVE-2026-100588, EUVD-2026-87463, CVE-2026-100587, EUVD-2026-87464, CVE-2026-100525, EUVD-2026-87525, CVE-2026-100526, EUVD-2026-87524, CVE-2026-100531, EUVD-2026-87519, CVE-2026-100532, EUVD-2026-87518, CVE-2026-100585, EUVD-2026-87466, CVE-2026-100540, EUVD-2026-87510, CVE-2026-100584, EUVD-2026-87467, CVE-2026-100581, EUVD-2026-87470, CVE-2026-100541, EUVD-2026-87509, CVE-2026-100580, EUVD-2026-87471, CVE-2026-100544, EUVD-2026-87506, CVE-2026-100579, EUVD-2026-87472, CVE-2026-100566, EUVD-2026-87485, CVE-2026-100578, EUVD-2026-87473, CVE-2026-100575, EUVD-2026-87476, CVE-2026-100577, EUVD-2026-87474, CVE-2026-100582, EUVD-2026-87469, CVE-2026-100570, EUVD-2026-87481, CVE-2026-100595, EUVD-2026-87456, GHSA-CQ6M-MHGC-VQRG, CVE-2026-100569, EUVD-2026-87482, CVE-2026-100594, EUVD-2026-87457, CVE-2026-100593, EUVD-2026-87458, CVE-2026-100592, EUVD-2026-87459, CVE-2026-100591, EUVD-2026-87460, CVE-2026-100583, EUVD-2026-87468, CVE-2026-100568, EUVD-2026-87483, CVE-2026-100586, EUVD-2026-87465, CVE-2026-100567, EUVD-2026-87484, CVE-2026-100564, EUVD-2026-87486, CVE-2026-100563, EUVD-2026-87487, CVE-2026-100562, EUVD-2026-87488, CVE-2026-100598, EUVD-2026-87380, GHSA-P9CW-VR9C-P446, CVE-2026-100599, EUVD-2026-87381, GHSA-2VM8-MPC3-CH96, CVE-2026-100597, EUVD-2026-87454, CVE-2026-100596, EUVD-2026-87455, GHSA-2GWV-Q898-554M, CVE-2026-100576, EUVD-2026-87475, CVE-2026-100574, EUVD-2026-87477, CVE-2026-100573, EUVD-2026-87478, CVE-2026-100572, EUVD-2026-87479, CVE-2026-100571, EUVD-2026-87480, CVE-2026-100561, EUVD-2026-87489, CVE-2026-100560, EUVD-2026-87490, CVE-2026-100559, EUVD-2026-87491, CVE-2026-100558, EUVD-2026-87492, CVE-2026-100557, EUVD-2026-87493, CVE-2026-100556, EUVD-2026-87494, CVE-2026-100555, EUVD-2026-87495, CVE-2026-100554, EUVD-2026-87496, CVE-2026-100553, EUVD-2026-87497, CVE-2026-100552, EUVD-2026-87498, CVE-2026-100551, EUVD-2026-87499, CVE-2026-100550, EUVD-2026-87500, CVE-2026-100549, EUVD-2026-87501, CVE-2026-100548, EUVD-2026-87502, CVE-2026-100547, EUVD-2026-87503, CVE-2026-100545, EUVD-2026-87505, CVE-2026-100543, EUVD-2026-87507, CVE-2026-100542, EUVD-2026-87508, CVE-2026-100539, EUVD-2026-87511, CVE-2026-100538, EUVD-2026-87512, CVE-2026-100537, EUVD-2026-87513, CVE-2026-100536, EUVD-2026-87514, CVE-2026-100535, EUVD-2026-87515, CVE-2026-100534, EUVD-2026-87516, CVE-2026-100533, EUVD-2026-87517, CVE-2026-100529, EUVD-2026-87521, CVE-2026-100530, EUVD-2026-87520, CVE-2026-100528, EUVD-2026-87522, CVE-2026-100527, EUVD-2026-87523, GHSA-3FP8-R6R3-VJCC, GHSA-6C5G-HRQV-57WR, GHSA-87G7-76GR-73G8, GHSA-CQQJ-25GC-9Q2F, GHSA-MWM7-GR2G-859H, GHSA-W63F-M9C2-9G74, CVE-2026-100590, EUVD-2026-87461

  2. #2

    Referenz(en) aufgenommen: CVE-2026-95815, EUVD-2026-84862

  3. #1

    Initiale Fassung

References