openclaw
npm451 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting openclawpage 5 of 10
- CVE-2026-35659MEDIUMCVSS 4.6EG 4.6✓ Fixed in 2026.3.222026-04-10
OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing…
- CVE-2026-35660HIGHCVSS 8.1EG 8.1✓ Fixed in 2026.3.232026-04-10
OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges can i…
- CVE-2026-35661MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.282026-04-10
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weak…
- CVE-2026-35662MEDIUMCVSS 4.3EG 4.3✓ Fixed in 2026.3.222026-04-10
OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond their authorized scope. Attackers can exploit this by using the send action to com…
- CVE-2026-35663HIGHCVSS 8.8EG 8.82026-04-10
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass pairing requirements to reconnect as operator.admin, gaining…
- CVE-2026-35664MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.282026-04-10
OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can send raw card commands to bypass DM pairing restrictions and…
- CVE-2026-35665MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.242026-04-10
OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout before signature verification. An unauthenticated attacker …
- CVE-2026-35666HIGHCVSS 8.8EG 8.8✓ Fixed in 2026.3.222026-04-10
OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to reuse a…
- CVE-2026-35667MEDIUMCVSS 6.1EG 6.1✓ Fixed in 2026.3.242026-04-10
OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-utils.ts that sends SIGKILL immediately without graceful SIGTERM shutdown. Attackers…
- CVE-2026-35668HIGHCVSS 7.7EG 7.7✓ Fixed in 2026.3.242026-04-10
OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exp…
- CVE-2026-35669HIGHCVSS 8.8EG 8.82026-04-10
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope bo…
- CVE-2026-35670MEDIUMCVSS 5.9EG 5.9✓ Fixed in 2026.3.222026-04-10
OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies to unintended users by exploiting mutable username matching instead of stable numeric user identifiers. Attackers can ma…
- CVE-2026-35673MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.4.292026-05-29
OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers with access to these routes can bypass private-network SSRF policies by reu…
- CVE-2026-35674HIGHCVSS 8.8EG 8.8✓ Fixed in 2026.5.182026-05-29
OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited external r…
- CVE-2026-3689MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.2.212026-04-11
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenClaw. Authentication is required to exploit this vulnerabili…
- CVE-2026-3690HIGHCVSS 7.4EG 7.4✓ Fixed in 2026.2.192026-04-11
OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability. The specific fla…
- CVE-2026-3691MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.2.252026-04-11
OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability…
- CVE-2026-40037MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.4.82026-04-08
OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering redir…
- CVE-2026-40045MEDIUMCVSS 5.7EG 5.7✓ Fixed in 2026.4.22026-04-21
OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attackers can forge discovery results or craft setup codes to redirect clients to malici…
- CVE-2026-41294HIGHCVSS 8.6EG 8.6✓ Fixed in 2026.3.282026-04-21
OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override run…
- CVE-2026-41295HIGHCVSS 7.8EG 7.8✓ Fixed in 2026.4.22026-04-21
OpenClaw before 2026.4.2 contains an improper trust boundary vulnerability allowing untrusted workspace channel shadows to execute during built-in channel setup and login. Attackers can clone a workspace with a malicious plugin claiming a …
- CVE-2026-41296HIGHCVSS 8.2EG 8.2✓ Fixed in 2026.3.312026-04-21
OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape. Attackers can exploit the separate path validation and file read operations to bypa…
- CVE-2026-41297HIGHCVSS 7.6EG 7.6✓ Fixed in 2026.3.312026-04-21
OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access internal resources by following unvalidated redirects. The marketplace.ts modul…
- CVE-2026-41298MEDIUMCVSS 5.4EG 5.4✓ Fixed in 2026.4.22026-04-21
OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes. Read-scoped callers can terminate running subagent sessions by sending requests to this endpoint, bypass…
- CVE-2026-41299HIGHCVSS 7.1EG 7.1✓ Fixed in 2026.3.282026-04-21
OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-declared client metadata from WebSocket handshake rather than verified authorizatio…
- CVE-2026-41300MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.3.312026-04-21
OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote onboarding flows. Attackers can route gateway credentials to malicious endpoints by having their discovered URL survive…
- CVE-2026-41301MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.312026-04-21
OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows pairing challenges to be issued before event signature validation. An unauthenticated remote attack…
- CVE-2026-41302HIGHCVSS 7.6EG 7.6✓ Fixed in 2026.3.312026-04-21
OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests. Attackers can exploit unguarded fetch() calls …
- CVE-2026-41303HIGHCVSS 8.8EG 8.8✓ Fixed in 2026.3.282026-04-21
OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the channels.discord…
- CVE-2026-41329CRITICALCVSS 9.9EG 9.9✓ Fixed in 2026.3.312026-04-21
OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation. Attackers can exploit improper context validation to by…
- CVE-2026-41330MEDIUMCVSS 4.4EG 4.4✓ Fixed in 2026.3.312026-04-21
OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment…
- CVE-2026-41331MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.312026-04-21
OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows unauthorized group senders to trigger transcription processing. Attackers can exploit insufficient allowlist enfo…
- CVE-2026-41332MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.282026-04-23
OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS…
- CVE-2026-41333LOWCVSS 3.7EG 3.7✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authenticatio…
- CVE-2026-41334MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 contains a decompression bomb vulnerability in image processing that fails to properly enforce pixel-limit guards on sips. Attackers can exploit this by uploading oversized images to cause denial of service throug…
- CVE-2026-41335MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Co…
- CVE-2026-41336HIGHCVSS 7.8EG 7.8✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling loading of attacker-controlled hook code. Attackers can replace trusted default-on bundled hooks from untrusted…
- CVE-2026-41337MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback origin before replay rejection. Attackers with captured valid callbacks for live cal…
- CVE-2026-41338MEDIUMCVSS 5.0EG 5.0✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 contains a time-of-check-time-of-use vulnerability in sandbox file operations that allows attackers to bypass fd-based defenses. Attackers can exploit check-then-act patterns in apply_patch, remove, and mkdir oper…
- CVE-2026-41339MEDIUMCVSS 4.3EG 4.3✓ Fixed in 2026.4.22026-04-23
OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. Non-admin clients can recover host-specific filesystem paths and deployment details, enabling host f…
- CVE-2026-41340MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where Telegram legacy allowFrom migration incorrectly fans default-account trust into all named accounts. Attackers can exploit this trust propagation to bypass au…
- CVE-2026-41341MEDIUMCVSS 5.4EG 5.4✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as direct messages in extensions/discord/src/monitor/agent-components-helpers.ts. Attackers can exploit this…
- CVE-2026-41342HIGHCVSS 7.3EG 7.3✓ Fixed in 2026.3.282026-04-23
OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints without explicit trust confirmation. Attackers can spoof discovery endpoints to …
- CVE-2026-41343MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient availability loss. Remote attackers can flood the webhook endpoint with concurrent requests before …
- CVE-2026-41344MEDIUMCVSS 5.4EG 5.4✓ Fixed in 2026.3.282026-04-23
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verboseLevel session overrides. Attackers can exploit the /verbose parameter t…
- CVE-2026-41345MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects. Attackers can exploit this by crafting malicious cross-origin redirec…
- CVE-2026-41346MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.3.312026-04-23
OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to…
- CVE-2026-41347HIGHCVSS 7.1EG 7.1✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a browser…
- CVE-2026-41348MEDIUMCVSS 5.4EG 5.4✓ Fixed in 2026.3.312026-04-23
OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths that fail to enforce group DM channel allowlist restrictions. Authorized Discord users can bypass channel restrictions…
- CVE-2026-41349HIGHCVSS 8.8EG 8.8✓ Fixed in 2026.3.282026-04-23
OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter. Remote attackers can exploit this to bypass security controls and execute una…
Check whether openclaw is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for openclaw CVEs against the assets you own.
Start Free Scan →