Vulnerabilities in OpenClaw

581 results
Vexday analysis

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-53830MEDIUMOpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reloadEPSS 0.2%CVE-2026-53852LOWOpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairingEPSS 0.2%CVE-2026-32019LOWOpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF GuardEPSS 0.2%CVE-2026-35630HIGHOpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval ButtonsEPSS 0.2%CVE-2026-27001HIGHOpenClaw: Unsanitized CWD path injection into LLM promptsEPSS 0.2%CVE-2026-32021MEDIUMOpenClaw < 2026.2.22 - Authorization Bypass via Display Name Collision in Feishu allowFromEPSS 0.2%CVE-2026-32899MEDIUMOpenClaw < 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event HandlersEPSS 0.2%CVE-2026-43531HIGHOpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env FileEPSS 0.2%CVE-2026-41299HIGHOpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance GuardEPSS 0.2%CVE-2026-41361MEDIUMOpenClaw < 2026.3.28 - SSRF Guard Bypass via IPv6 Special-Use RangesEPSS 0.2%CVE-2026-32921MEDIUMOpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.runEPSS 0.2%CVE-2026-25474HIGHOpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypassEPSS 0.2%CVE-2026-41296HIGHOpenClaw < 2026.3.31 - Sandbox Escape via TOCTOU Race in Remote FS Bridge readFileEPSS 0.2%CVE-2026-35662MEDIUMOpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send ActionEPSS 0.2%CVE-2026-43582MEDIUMOpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation BypassEPSS 0.2%CVE-2026-53834HIGHOpenClaw < 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash CommandsEPSS 0.2%CVE-2026-35642MEDIUMOpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention BypassEPSS 0.2%CVE-2026-62197MEDIUMOpenClaw < 2026.6.6 Policy Bypass via CDP DiscoveryEPSS 0.2%CVE-2026-41350MEDIUMOpenClaw < 2026.3.31 - Session Visibility Bypass via session_status in Unsandboxed InvocationsEPSS 0.2%CVE-2026-26972MEDIUMOpenClaw has a Path Traversal in Browser Download FunctionalityEPSS 0.2%