Vendor
OpenClaw
672 known vulnerabilities.
Products
672 results · Feed
-
Low 3.3
OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback
OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tool…
-
Medium 5.3
OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook …
-
Medium 5.3
OpenClaw before 2026.8.1 Denial of Service via Rate Limit
OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and…
-
High 7.8
OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gma…
-
Medium 5.5
OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override
OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in `_ENDPOINT`, so an untrusted workspace `.env` file could set AZURE_SPEECH_ENDPOINT. Azure Speech p…
-
High 8.3
OpenClaw before 2026.8.1 Unauthorized Command Job Access
OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or uns…
-
High 8.2
OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname
OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but the raw WebSocket and Pla…
-
Medium 6.5
OpenClaw LINE before 2026.8.1 Access Control Inheritance
OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite …
-
Medium 5.4
OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in…
-
Medium 5.4
OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust partic…
-
Medium 5.4
OpenClaw before 2026.8.1 Authorization Bypass via sessions.create
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can …
-
High 7.5
OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute command…
-
High 8.0
OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator all…
-
High 8.0
OpenClaw before 2026.8.1 Command Injection via Escaped Newlines
OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute add…
-
High 8.3
OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials rese…
-
High 7.5
OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can rep…
-
Medium 6.3
OpenClaw before 2026.8.1 Authentication Bypass via Session Reset
OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or owner command authorizati…
-
Medium 4.2
OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept a…
-
High 7.1
OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to th…
-
Medium 4.3
OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin
OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWi…
-
High 8.8
OpenClaw before 2026.8.1 Policy Bypass via Native Tools
OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tool…
-
High 8.3
OpenClaw iOS Control UI TLS Pin Enforcement Bypass
OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had…
-
Medium 5.4
OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames
OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments t…
-
Medium 5.4
OpenClaw before 2026.8.1 Authentication Bypass via Access Group
OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is no…
-
Medium 5.3
OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a differ…
-
Medium 5.5
OpenClaw before 2026.8.1 Authentication Bypass via File URL
OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:` URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative paths and were incorrectly…
-
Medium 6.4
OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript
OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after …
-
High 8.8
openclaw voice-call before 2026.8.1 Authorization Bypass
openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's no…
-
Medium 5.3
OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation
OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's poli…
-
High 7.5
OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash
OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were …
-
Low 3.1
OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2
OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push…
-
High 7.5
OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding
OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identit…
-
Medium 6.8
OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account
OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify…
-
Medium 6.5
OpenClaw before 2026.8.1 Local File Read via Outbound Attachments
OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local…
-
Low 2.6
OpenClaw before 2026.8.1 Memory Access Control Bypass
OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory_get tool instances retain the enabled configuration captured at creation time because th…
-
Low 3.1
OpenClaw before 2026.8.1 Authentication Bypass via Active Memory
OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules, deterministic and hidd…
-
High 7.5
OpenClaw before 2026.8.1 Privilege Escalation via Session Memory
OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming…
-
Medium 6.5
OpenClaw before 2026.8.1 Path Traversal via Structured Attachments
OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source fields to bypa…
-
Low 3.1
OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel AC…
-
Medium 5.3
OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback
OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling …