Vendor
OpenClaw
672 known vulnerabilities.
Products
324 results · Clear filters · Feed
-
Medium 5.3
OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism
A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Atta…
-
Medium 5.4
OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present
OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make…
-
Medium 6.5
OpenClaw Windows Node before 2026.7.1 Denial of Service
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation …
-
Medium 6.5
OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers…
-
Medium 5.3
OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket
OpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to execute MCP App tools requiring operator.write scope. Attackers with operator.read tokens can obtain a standalone ticket…
-
Medium 6.3
OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines
OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files fro…
-
Medium 5.4
ClawHub Authentication Bypass via Former Publisher Skill Control
ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historic…
-
Medium 6.5
ClawHub Changelog Preview Information Disclosure via Authorization Bypass
ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous…
-
Medium 5.4
ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports
ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that skill from the catalog…
-
Medium 5.3
ClawHub SSRF via Unchecked DNS Resolution in Profile Image
ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns,…
-
Medium 5.3
ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API
ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests share a single default quota allowance. A remote, unauthenticated caller can drain that shared allo…
-
Medium 6.5
OpenClaw before 2026.7.1 Authorization Bypass via diagnostics
OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive diagnostic details about th…
-
Medium 6.5
OpenClaw before 2026.7.1 Authorization Bypass via trajectory export
OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, …
-
Medium 5.4
OpenClaw before 2026.7.1 Authentication Bypass via activation
OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based …
-
Medium 6.3
OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming
OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dre…
-
Medium 6.3
OpenClaw before 2026.7.1 Authentication Bypass via Active Memory
OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the …
-
Medium 4.3
OpenClaw before 2026.7.1 Authorization Bypass via voice set
OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel senders to persist Gateway voice configuration. Attackers with command access can change the voice used by Talk responses …
-
Medium 4.3
OpenClaw Discord before 2026.7.1 Authorization Bypass
OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-tar…
-
Medium 6.7
OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named execu…
-
Medium 6.5
OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass
OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and re…
-
Medium 5.5
OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension
OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and…
-
Medium 6.3
OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset
OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to inte…
-
Medium 5.4
OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates
OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing br…
-
Medium 5.9
OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS
OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address (0.0.0.0 or ::…
-
Medium 5.3
OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook …
-
Medium 5.3
OpenClaw before 2026.8.1 Denial of Service via Rate Limit
OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and…
-
Medium 5.5
OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override
OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in `_ENDPOINT`, so an untrusted workspace `.env` file could set AZURE_SPEECH_ENDPOINT. Azure Speech p…
-
Medium 6.5
OpenClaw LINE before 2026.8.1 Access Control Inheritance
OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite …
-
Medium 5.4
OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in…
-
Medium 5.4
OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust partic…
-
Medium 5.4
OpenClaw before 2026.8.1 Authorization Bypass via sessions.create
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can …
-
Medium 6.3
OpenClaw before 2026.8.1 Authentication Bypass via Session Reset
OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or owner command authorizati…
-
Medium 4.2
OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept a…
-
Medium 4.3
OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin
OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWi…
-
Medium 5.4
OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames
OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments t…
-
Medium 5.4
OpenClaw before 2026.8.1 Authentication Bypass via Access Group
OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is no…
-
Medium 5.3
OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a differ…
-
Medium 5.5
OpenClaw before 2026.8.1 Authentication Bypass via File URL
OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:` URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative paths and were incorrectly…
-
Medium 6.4
OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript
OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after …
-
Medium 5.3
OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation
OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's poli…