Vendor
OpenClaw
679 known vulnerabilities in products by OpenClaw, 0 of them actively exploited (CISA KEV).
Key figures
679
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
57
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| High | CVE-2026-25253 | OpenClaw: Incorrect Resource Transfer Between Spheres | 8.8 | |
| Critical | CVE-2026-32917 | OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP | 9.8 | |
| High | CVE-2026-24763 | Authenticated Command Injection in OpenClaw Docker Execution via PATH Environment Variable | 8.8 | |
| High | CVE-2026-26323 | OpenClaw has a command injection in maintainer clawtributors updater | 8.8 | |
| High | CVE-2026-53822 | OpenClaw: Time-of-check Time-of-use (TOCTOU) Race Condition | 8.8 | |
| High | CVE-2026-27487 | OpenClaw: Prevent shell injection in macOS keychain credential write | 7.6 | |
| Critical | CVE-2026-30741 | OpenClaw: Remote Code Execution | 9.8 | |
| Critical | CVE-2026-8305 | OpenClaw bluebubbles Webhook monitor.ts handleBlueBubblesWebhookRequest improper authentication | 7.3 | |
| Critical | CVE-2026-44109 | OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation | 9.8 | |
| Critical | CVE-2026-32056 | OpenClaw: OS Command Injection | 7.5 | |
| Critical | CVE-2026-8634 | Crabbox < v0.12.0 Environment Variable Information Disclosure | 9.1 | |
| Critical | CVE-2026-28446 | OpenClaw: Authentication Bypass | 9.4 | |
| High | CVE-2026-101880 | OpenClaw Windows Node before 2026.7.1 Authorization Bypass | 8.8 | |
| High | CVE-2026-32063 | OpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit Generation | 7.1 | |
| Critical | CVE-2026-32052 | OpenClaw < 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv Carriers | 6.4 | |
| High | CVE-2026-41352 | OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass | 8.8 | |
| High | CVE-2026-32060 | OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths | 8.8 | |
| Critical | CVE-2026-28470 | OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes | 9.8 | |
| Critical | CVE-2026-28391 | OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement | 9.8 | |
| Critical | CVE-2026-28474 | OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing | 9.8 | |
| Critical | CVE-2026-43575 | OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route | 9.8 | |
| High | CVE-2026-45006 | OpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypass | 8.8 | |
| High | CVE-2026-101882 | OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set | 8.8 | |
| High | CVE-2026-53836 | OpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliases | 8.8 | |
| High | CVE-2026-41405 | OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing | 7.5 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 20sans-atrisk,
- CISA Adds Vulnerabilities in Cisco SD-WAN and Microsoft Exchange Server to Known Exploited Vulnerabilities Catalogsans-newsbites-mail,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 19sans-atrisk,
- OpenClaw Vulnerabilities Are “Staggering” in 2026sans-newsbites-mail,
Products
| Product | CVEs | Actively exploited |
|---|---|---|
| OpenClaw | 645 | 0 |
| Openclaw Windows Node | 6 | 0 |
| Clawhub | 5 | 0 |
| Crabbox | 5 | 0 |
| Feishu | 4 | 0 |
| Msteams | 4 | 0 |
| OpenClaw ClawScan | 3 | 0 |
| Voice-call | 3 | 0 |