Vulnerabilities in OpenClaw

581 results
Vexday analysis

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-53815HIGHOpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read ActionsEPSS 0.2%CVE-2026-41916LOWOpenClaw < 2026.4.8 - Stale Authentication State via Config ReloadEPSS 0.2%CVE-2026-43583MEDIUMOpenClaw 2026.4.10 < 2026.4.14 - Loss of Group Tool-Policy Context in Delivery Queue RecoveryEPSS 0.2%CVE-2026-43581CRITICALOpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay BindingEPSS 0.2%CVE-2026-62188HIGHOpenClaw < 2026.6.9 Feishu Authorization BypassEPSS 0.2%CVE-2026-62187HIGHOpenClaw < 2026.6.9 Feishu tools Authorization BypassEPSS 0.2%CVE-2026-43568HIGHOpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming EndpointEPSS 0.2%CVE-2026-41913MEDIUMOpenClaw < 2026.4.4 - Rate-Limit Bypass via Concurrent Async Authentication AttemptsEPSS 0.2%CVE-2026-62216LOWOpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media UploadEPSS 0.2%CVE-2026-32050MEDIUMOpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check BypassEPSS 0.2%CVE-2026-28480MEDIUMOpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist AuthorizationEPSS 0.2%CVE-2026-53844MEDIUMOpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory SearchEPSS 0.2%CVE-2026-53859MEDIUMOpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot InconsistencyEPSS 0.2%CVE-2026-41912MEDIUMOpenClaw < 2026.4.8 - Server-Side Request Forgery Policy Bypass via Interaction-Triggered NavigationEPSS 0.2%CVE-2026-62209HIGHOpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatchEPSS 0.2%CVE-2026-53823HIGHOpenClaw < 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFromEPSS 0.2%CVE-2026-41344MEDIUMOpenClaw < 2026.3.28 - Privilege Escalation via chat.send /verbose ParameterEPSS 0.2%CVE-2026-44113HIGHOpenClaw < 2026.4.22 - Time-of-Check/Time-of-Use Race Condition in OpenShell FS BridgeEPSS 0.2%CVE-2026-41385HIGHOpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction BypassEPSS 0.2%CVE-2026-62191HIGHOpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message MutationsEPSS 0.2%