Vulnerabilities in OpenClaw

581 results
Vexday analysis

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-32048HIGHOpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawnEPSS 0.3%CVE-2026-53814HIGHOpenClaw < 2026.5.20 - Privilege Escalation via Hook-Triggered CLI MCP Tool AuthorityEPSS 0.3%CVE-2026-28473HIGHOpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat CommandEPSS 0.3%CVE-2026-35645MEDIUMOpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSessionEPSS 0.3%CVE-2026-43527MEDIUMOpenClaw < 2026.4.14 - Server-Side Request Forgery via Private Network NavigationEPSS 0.3%CVE-2026-45002MEDIUMOpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template MappingEPSS 0.3%CVE-2026-41340MEDIUMOpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom MigrationEPSS 0.3%CVE-2026-41354MEDIUMOpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe KeysEPSS 0.3%CVE-2026-35649MEDIUMOpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty AllowlistEPSS 0.3%CVE-2026-35664MEDIUMOpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card CallbacksEPSS 0.3%CVE-2026-32023MEDIUMOpenClaw < 2026.2.24 - Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in system.runEPSS 0.3%CVE-2026-35663HIGHOpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-ClaimEPSS 0.3%CVE-2026-28451MEDIUMOpenClaw < 2026.2.14 - SSRF via Feishu Extension Media FetchingEPSS 0.3%CVE-2026-53843HIGHOpenClaw < 2026.5.26 - Node Token Revocation Bypass via Pairing-Scoped Device SessionEPSS 0.3%CVE-2026-29612MEDIUMOpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File DecodingEPSS 0.3%CVE-2026-41362LOWOpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared AuthenticationEPSS 0.3%CVE-2026-32971HIGHOpenClaw < 2026.3.11 - Node-Host Approval UI Mismatch Allows Execution of Unintended CommandsEPSS 0.3%CVE-2026-35660HIGHOpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session ResetEPSS 0.3%CVE-2026-35619MEDIUMOpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models EndpointEPSS 0.3%CVE-2026-34505MEDIUMOpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret ValidationEPSS 0.3%