Vulnerabilities in OpenClaw

581 results
Vexday analysis

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-62194HIGHOpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin InstallEPSS 0.3%CVE-2026-32914HIGHOpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug EndpointsEPSS 0.3%CVE-2026-41372MEDIUMOpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP DiscoveryEPSS 0.3%CVE-2026-43526HIGHOpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL HandlingEPSS 0.3%CVE-2026-53861MEDIUMOpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOSEPSS 0.2%CVE-2026-62205MEDIUMOpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actionsEPSS 0.2%CVE-2026-62206MEDIUMOpenClaw < 2026.6.9 Authentication Bypass via Moderation ActionsEPSS 0.2%CVE-2026-32896MEDIUMOpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles PluginEPSS 0.2%CVE-2026-62228HIGHOpenClaw < 2026.6.5 Authorization Bypass via Node Exec ApprovalsEPSS 0.2%CVE-2026-62218HIGHOpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approveEPSS 0.2%CVE-2026-62223HIGHOpenClaw < 2026.5.18 Authorization Bypass via Device-pairEPSS 0.2%CVE-2026-35637MEDIUMOpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DMEPSS 0.2%CVE-2026-32974HIGHOpenClaw < 2026.3.12 - Forged Event Injection via Feishu Webhook Verification TokenEPSS 0.2%CVE-2026-53812MEDIUMOpenClaw < 2026.5.18 - Private-Network Navigation Bypass via Browser Act InteractionsEPSS 0.2%CVE-2026-53864HIGHOpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control VariablesEPSS 0.2%CVE-2026-45000LOWOpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile CreationEPSS 0.2%CVE-2026-62217HIGHOpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvalsEPSS 0.2%CVE-2026-33575HIGHOpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup CodesEPSS 0.2%CVE-2026-62189HIGHOpenClaw < 2026.6.9 Symlink Following via Mirror SyncEPSS 0.2%CVE-2026-53854MEDIUMOpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat CommandsEPSS 0.2%