Vulnerabilities in OpenClaw

581 results
Vexday analysis

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-62215MEDIUMOpenClaw < 2026.6.5 Authentication Bypass via HTTP CanvasEPSS 0.2%CVE-2026-62219MEDIUMOpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDsEPSS 0.2%CVE-2026-32906LOWOpenClaw < 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver GateEPSS 0.2%CVE-2026-32037LOWOpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment HandlingEPSS 0.2%CVE-2026-62212MEDIUMOpenClaw < 2026.5.28 Authentication Bypass via safeFetchEPSS 0.2%CVE-2026-41909MEDIUMOpenClaw < 2026.4.20 - Improper Authorization in Paired-Device Pairing ActionsEPSS 0.2%CVE-2026-53860LOWOpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubblesEPSS 0.2%CVE-2026-53863MEDIUMOpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group PolicyEPSS 0.2%CVE-2026-28463HIGHOpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins AllowlistEPSS 0.2%CVE-2026-27008MEDIUMOpenClaw hardened the skill download target directory validationEPSS 0.2%CVE-2026-53835LOWOpenClaw < 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent BindingsEPSS 0.2%CVE-2026-41367MEDIUMOpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component InteractionsEPSS 0.2%CVE-2026-27576MEDIUMOpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputsEPSS 0.2%CVE-2026-32067LOWOpenClaw < 2026.2.26 - Cross-Account Authorization Bypass in DM Pairing StoreEPSS 0.2%CVE-2026-62198MEDIUMOpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web SearchEPSS 0.2%CVE-2026-41376LOWOpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender ValidationEPSS 0.2%CVE-2026-27007MEDIUMOpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreationEPSS 0.2%CVE-2026-35673MEDIUMOpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export RoutesEPSS 0.2%CVE-2026-62224LOWOpenClaw MS Teams < 2026.5.12 Authorization BypassEPSS 0.2%CVE-2026-32302HIGHOpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy modeEPSS 0.2%