Vulnerabilities in OpenClaw

581 results
Vexday analysis

Com 495 CVEs catalogadas e nenhuma confirmada em exploração ativa no momento, o perfil do OpenClaw apresenta taxa de exploração confirmada abaixo da média geral do catálogo KEV. O dado que merece atenção imediata é o volume de 323 vulnerabilidades surgidas nos últimos 90 dias, indicando um ritmo elevado de descobertas recentes que ainda pode não ter atraído atenção de agentes maliciosos, mas amplia consideravelmente a superfície de ataque. O tipo de falha mais comum é CWE-863 (autorização incorreta), o que sugere fragilidades estruturais no controle de acesso — categoria com alto potencial de impacto caso explorada. A CVE mais perigosa identificada atualmente, CVE-2026-25253, apresenta EPSS de 0,0802, e embora não haja PoC pública disponível, equipes de segurança devem monitorar sua evolução dado o contexto de crescimento acelerado no volume de vulnerabilidades do vendor.

CVE-2026-43584HIGHOpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec PolicyEPSS 0.4%CVE-2026-26324HIGHOpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)EPSS 0.4%CVE-2026-28394MEDIUMOpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch ToolEPSS 0.4%CVE-2026-41333MEDIUMOpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceTokenEPSS 0.4%CVE-2026-43571HIGHOpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel SetupEPSS 0.4%CVE-2026-28464HIGHOpenClaw < 2026.2.12 - Timing Attack in Hooks Token AuthenticationEPSS 0.4%CVE-2026-35668HIGHOpenClaw < 2026.3.24 - Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl ParametersEPSS 0.4%CVE-2026-45223HIGHCrabbox < 0.9.0 Authentication Bypass via Admin Claim InjectionEPSS 0.4%CVE-2026-43569HIGHOpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider AuthEPSS 0.4%CVE-2026-32034MEDIUMOpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTPEPSS 0.4%CVE-2026-33577HIGHOpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approveEPSS 0.4%CVE-2026-53825HIGHOpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write ScopeEPSS 0.4%CVE-2026-28465HIGHOpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded HeadersEPSS 0.4%CVE-2026-35666HIGHOpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch WrapperEPSS 0.4%CVE-2026-27522HIGHOpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message ActionsEPSS 0.4%CVE-2026-22177MEDIUMOpenClaw < 2026.2.21 - Environment Variable Injection via Config env.varsEPSS 0.4%CVE-2026-41383MEDIUMOpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode PathsEPSS 0.4%CVE-2026-43533HIGHOpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media TagsEPSS 0.4%CVE-2026-35643HIGHOpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterfaceEPSS 0.4%CVE-2026-32059HIGHOpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBinsEPSS 0.4%