Vulnerabilities in OpenClaw

581 results
Vexday analysis

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-41331MEDIUMOpenClaw < 2026.3.31 - Resource Consumption via Unauthorized Telegram Audio Preflight TranscriptionEPSS 0.3%CVE-2026-33578MEDIUMOpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser ExtensionsEPSS 0.3%CVE-2026-41345MEDIUMOpenClaw < 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media DownloadEPSS 0.3%CVE-2026-42433HIGHOpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message ToolsEPSS 0.3%CVE-2026-32006LOWOpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Fallback in Group AllowlistEPSS 0.3%CVE-2026-28458HIGHOpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket EndpointEPSS 0.3%CVE-2026-62200HIGHOpenClaw < 2026.6.6 Authentication Bypass via Git ext transportEPSS 0.3%CVE-2026-62199HIGHOpenClaw < 2026.6.6 Authentication Bypass via Environment FilteringEPSS 0.3%CVE-2026-32025HIGHOpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication BypassEPSS 0.3%CVE-2026-62220MEDIUMOpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit BypassEPSS 0.3%CVE-2026-35622MEDIUMOpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat WebhookEPSS 0.3%CVE-2026-27486MEDIUMOpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process CleanupEPSS 0.3%CVE-2026-29611HIGHOpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media HandlingEPSS 0.3%CVE-2026-31993MEDIUMOpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell ChainsEPSS 0.3%CVE-2026-44116MEDIUMOpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL ValidationEPSS 0.3%CVE-2026-29606MEDIUMOpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback CompatibilityEPSS 0.3%CVE-2026-32065MEDIUMOpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command ExecutionEPSS 0.3%CVE-2026-62203HIGHOpenClaw < 2026.6.6 Environment Variable Injection via rustupEPSS 0.3%CVE-2026-45005MEDIUMOpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After RotationEPSS 0.3%CVE-2026-53821HIGHOpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocketEPSS 0.3%