openclaw
npm455 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting openclawpage 9 of 10
- CVE-2026-53813HIGHCVSS 7.8EG 7.8✓ Fixed in 2026.4.252026-06-11
OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution. Attackers with access to affected workspaces can load memory-core artifacts f…
- CVE-2026-53814HIGHCVSS 8.3EG 8.3✓ Fixed in 2026.5.202026-06-11
OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority instead of hook-appropriate scope. Attackers with a valid hook token can exploi…
- CVE-2026-53815MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.5.192026-06-11
OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient v…
- CVE-2026-53816HIGHCVSS 7.2EG 7.2✓ Fixed in 2026.5.182026-06-11
OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node …
- CVE-2026-53817HIGHCVSS 8.8EG 8.8✓ Fixed in 2026.5.222026-06-11
OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens. Attackers can exploit insu…
- CVE-2026-53818MEDIUMCVSS 6.6EG 6.6✓ Fixed in 2026.4.242026-06-11
OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies and before-tool-call hooks. Attackers can invoke owner-only behavior throug…
- CVE-2026-53819HIGHCVSS 8.8EG 8.8✓ Fixed in 2026.5.272026-06-11
OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute…
- CVE-2026-53820MEDIUMCVSS 6.6EG 6.6✓ Fixed in 2026.5.122026-06-12
OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to bypass intended command restrictions. Attackers can reach the affected bundled MCP …
- CVE-2026-53821HIGHCVSS 8.8EG 8.8✓ Fixed in 2026.5.182026-06-12
OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operat…
- CVE-2026-53823HIGHCVSS 8.1EG 8.1✓ Fixed in 2026.5.32026-06-12
OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potent…
- CVE-2026-53824MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.4.242026-06-12
OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash comm…
- CVE-2026-53825MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.5.122026-06-12
OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers w…
- CVE-2026-53826MEDIUMCVSS 4.3EG 4.3✓ Fixed in 2026.4.262026-06-12
OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exploit this by spawning child sessions from sandboxed parents to…
- CVE-2026-53827MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.5.22026-06-12
OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata to forward action payloads with Gateway credentials to attacker-supplied loopback URLs. Remote attacke…
- CVE-2026-53828HIGHCVSS 8.8EG 8.8✓ Fixed in 2026.5.62026-06-12
OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without proper policy enforcement. Attackers can trigger native command han…
- CVE-2026-53829HIGHCVSS 8.0EG 8.0✓ Fixed in 2026.5.182026-06-12
OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes …
- CVE-2026-53830MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.4.222026-06-12
OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active after secrets.reload. Attackers can exploit the stale-secret window to deliver we…
- CVE-2026-53831HIGHCVSS 8.1EG 8.3✓ Fixed in 2026.5.182026-06-12
OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metach…
- CVE-2026-53832HIGHCVSS 7.1EG 7.7✓ Fixed in 2026.5.182026-06-12
OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity head…
- CVE-2026-53833MEDIUMCVSS 6.5EG 7.7✓ Fixed in 2026.4.292026-06-12
OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming…
- CVE-2026-53834MEDIUMCVSS 6.5EG 7.5✓ Fixed in 2026.4.272026-06-12
OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured access c…
- CVE-2026-53835MEDIUMCVSS 4.3EG 4.3✓ Fixed in 2026.5.62026-06-12
OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that allows authenticated senders to create or update bindings without honoring configured config-write controls. Attackers…
- CVE-2026-53836HIGHCVSS 8.8EG 8.8✓ Fixed in 2026.5.122026-06-12
OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote aut…
- CVE-2026-53837MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.5.62026-06-12
OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events mi…
- CVE-2026-53838CRITICALCVSS 9.8EG 9.8✓ Fixed in 2026.5.272026-06-12
OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. Attackers can exploit reconnection logic to restore or present broader node author…
- CVE-2026-53839MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.5.72026-06-12
OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted…
- CVE-2026-53840HIGHCVSS 7.1EG 7.1✓ Fixed in 2026.5.122026-06-16
OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint…
- CVE-2026-53841MEDIUMCVSS 6.1EG 6.1✓ Fixed in 2026.5.122026-06-16
OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens…
- CVE-2026-53842HIGHCVSS 7.1EG 7.1✓ Fixed in 2026.5.22026-06-16
OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository ac…
- CVE-2026-53843HIGHCVSS 8.8EG 8.8✓ Fixed in 2026.5.262026-06-16
OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level…
- CVE-2026-53844MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.4.292026-06-16
OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guard…
- CVE-2026-53845MEDIUMCVSS 4.3EG 4.3✓ Fixed in 2026.5.62026-06-16
OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the vulnerable d…
- CVE-2026-53846HIGHCVSS 7.1EG 7.1✓ Fixed in 2026.4.292026-06-16
OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace …
- CVE-2026-53847MEDIUMCVSS 5.4EG 5.4✓ Fixed in 2026.5.62026-06-16
OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. At…
- CVE-2026-53848MEDIUMCVSS 4.3EG 4.3✓ Fixed in 2026.5.262026-06-16
OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass allowlist…
- CVE-2026-53849HIGHCVSS 8.1EG 8.1✓ Fixed in 2026.5.72026-06-16
OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can…
- CVE-2026-53850MEDIUMCVSS 5.5EG 5.5✓ Fixed in 2026.4.252026-06-16
OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command …
- CVE-2026-53851MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2026.5.122026-06-16
OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reactio…
- CVE-2026-53852MEDIUMCVSS 5.4EG 5.4✓ Fixed in 2026.4.252026-06-16
OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can explo…
- CVE-2026-53853HIGHCVSS 8.3EG 8.3✓ Fixed in 2026.5.122026-06-16
OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables on Linux and macOS systems. Attackers can bypass configured ar…
- CVE-2026-53854MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.4.252026-06-16
OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom state across channel boundaries. Attackers can exploit this by se…
- CVE-2026-53855HIGHCVSS 8.1EG 8.1✓ Fixed in 2026.4.22026-06-16
OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional argumen…
- CVE-2026-53856MEDIUMCVSS 5.5EG 5.5✓ Fixed in 2026.4.242026-06-16
vulnerable: 2026.4.23
OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on shared hosts can read sensitive configuration data by …
- CVE-2026-53857HIGHCVSS 8.1EG 8.1✓ Fixed in 2026.5.32026-06-16
OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive ag…
- CVE-2026-53858HIGHCVSS 7.1EG 7.1✓ Fixed in 2026.5.22026-06-16
OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime …
- CVE-2026-53859MEDIUMCVSS 6.5EG 6.5✓ Fixed in 2026.5.262026-06-16
OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model or workspace-derived URLs. Attackers can exploit inconsistent hostname checks to…
- CVE-2026-53860MEDIUMCVSS 5.4EG 5.4✓ Fixed in 2026.5.72026-06-16
OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather than stable sender identity. Attackers can influence conversatio…
- CVE-2026-53861CRITICALCVSS 9.8EG 9.8✓ Fixed in 2026.5.62026-06-16
OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers can execute shell content outside the intended allowlist check by using combined…
- CVE-2026-53862MEDIUMCVSS 5.4EG 5.4✓ Fixed in 2026.5.122026-06-16
OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing a…
- CVE-2026-53863MEDIUMCVSS 6.5EG 7.1✓ Fixed in 2026.4.252026-06-16
OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a group ID to the policy resolver could trigger incorrect group-policy decisions …
Check whether openclaw is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for openclaw CVEs against the assets you own.
Start Free Scan →