Openclaw
Monthly
Arbitrary code execution on OpenClaw Windows Node hosts before version 2026.7.1 is achievable by an attacker who already holds gateway or agent access to a node, because the system.run tool's environment-variable sanitizer maintains an incomplete denylist (CWE-184). The attacker supplies variables such as GIT_CONFIG_*, GIT_PAGER, DOTNET_STARTUP_HOOKS, or JAVA_TOOL_OPTIONS alongside a request that runs an allowlisted tool (git, dotnet, java), causing that otherwise-permitted tool to load and execute attacker-controlled code or commands when it is next invoked; this requires the attacker to pass the tool's own arguments unchanged, which is why the attack-complexity/attack-requirements component is elevated. Exploitation is not remote-unauthenticated-it presumes prior gateway or agent access (PR:L), it is Windows-only, and it depends on at least one of git, dotnet, or java being present and reachable through system.run. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released a fixed build.
OpenClaw Windows Node versions before 2026.7.1 allow an authenticated caller holding a gateway/agent session to escalate to arbitrary command execution on the Windows host by abusing the system.execApprovals.set capability. The rule validator fails to reject allow rules whose executable (first whitespace-delimited token) contains a wildcard, so patterns such as '*.*', '*.exe', '*e*' or 'c*' are accepted and effectively grant blanket approval that the default-deny policy would otherwise block; subsequent system.run calls then execute arbitrary programs - including the LOLBins mshta, rundll32 and certutil - with no operator check or user prompt. Exploitation requires an existing network connection to the gateway/agent interface (CVSS 4.0 PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.7), no public exploit code was identified at time of analysis, and the vendor has released a fixed version.
Memory exhaustion in OpenClaw Windows Node versions before 2026.7.1 lets a connected gateway peer crash the node process by streaming an unbounded sequence of WebSocket continuation frames that never set the EndOfMessage flag, driving limitless growth of the inbound message accumulation buffer until the process dies. The vulnerability is authenticated (CVSS PR:L) because the attacker must already hold a gateway session on the node's gateway WebSocket transport rather than merely reach an exposed port, and the impact is confined to availability - a process crash with no code execution, privilege escalation, or data exposure. No public exploit code has been identified at time of analysis, and the vendor has shipped 2026.7.1, which caps accumulated inbound messages at 32M UTF-16 characters and closes offending sockets with a MessageTooBig status.
Arbitrary command execution on Windows hosts is achievable through OpenClaw Windows Node versions prior to 2026.7.1, where the system.run exec-approval policy can be evaded by an authenticated connected gateway or agent holding the PR:L role. The ExecShellWrapperParser fails to split commands on pipe operators or extract command-substitution/subexpression syntax, so a denied command placed behind an allowed prefix (for example `benign | denied` or `echo $(denied)`) is never surfaced to the allow/deny ruleset and executes anyway; the failure only yields a bypass where a restrictive exec-approval policy is actually configured, and the impact is confined to Windows targets. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch 2026.7.1 is available.
Silent capture of screen contents, webcam images, and device geolocation is possible in OpenClaw Windows Node before 2026.7.1-3 because the NodeService capture handlers performed these operations without the one-time consent gate that screen.record and camera.clip already enforced. An attacker who is, or who controls, a gateway or agent already connected to the node's WebSocket interface can invoke screen.snapshot, camera.snap, and location.get to covertly screenshot the desktop, photograph the user, and read physical location - for camera.snap and location.get without even a user-visible indicator - requiring no interaction from the victim. This is a genuine but moderate-severity privacy vulnerability affecting only pre-2026.7.1-3 builds; authentication is required in the sense that the attacker must already hold node-agent/gateway connectivity (CVSS:4.0 PR:L), and no public exploit code was identified at time of analysis.
Coordinated abuse reporting in the self-hosted ClawHub application/backend lets four distinct ordinary authenticated accounts push any visible skill to moderationStatus: hidden with no moderator in the loop, silently removing it from the catalog - and official/vendor-published skills are not exempt. Because the reporter quota only counts reports filed against currently-visible targets, the same four accounts can recycle the trick against additional skills, so the effect is repeatable catalog suppression rather than a one-off. Exploitation requires only ordinary authenticated users (CVSS vector PR:L, no moderator or admin role) and coordinated multi-account control; no public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis. The vendor CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) is more severe than the independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, which correctly bounds the impact to catalog visibility (no data read, no code execution); affected deployments are self-hosted ClawHub at or before revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, while the npm CLI and OpenClaw runtime are separate products and are not affected.
Missing authorization enforcement in ClawHub's public skills:generateChangelogPreview action lets any signed-in caller preview the prior version of a skill they are not authorized to access, disclosing up to 8,000 characters of quarantined or otherwise restricted skill content per request. The issue is rated 7.1 (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N; independent CVSS 3.1 assessment 7.1 with confidentiality impact only) and requires nothing more than a valid ClawHub account - no user interaction, special network position, or non-default configuration - while impact is limited to reading content, with no integrity or availability effect. No public exploit code has been identified at time of analysis; the hosted clawhub.ai service was remediated by the 2026-09-11 deployment of revision 8c2de6c506bb, so realistic residual exposure is confined to self-hosted deployments built from revisions at or after cbfee7343ddc867316dd9b3de6fa8856730f9f41 and before that fix.
OS command execution on paired Chrome nodes is possible in OpenClaw 2026.5.1 through 2026.7.0 because the googlemeet.chrome node command accepts caller-supplied audio command arrays and runs them on the paired node without passing through the normal system.run exec-approval flow. An authenticated, tool-enabled agent (CVSS vector PR:L) that is permitted to invoke googlemeet.chrome - in a deployment where the Google Meet plugin is enabled, a Chrome node is paired, and googlemeet.chrome is on the allowed node commands list - can launch attacker-chosen processes on that node, with full confidentiality, integrity, and availability impact on the paired node (assessed CVSS 3.1 8.6; vendor CVSS 4.0 base 8.7). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the flaw is fixed in 2026.7.1, and removing googlemeet.chrome from allowed node commands or disabling the Google Meet plugin fully mitigates it.
OpenClaw (npm package openclaw) before 2026.7.1 misbinds Signal approval reactions to the wrong message, so a reaction an approver places on ordinary outbound text can be interpreted as approving or denying a structured host-action request that happens to be pending in the same conversation. Exploitation requires an authenticated participant acting as approver (PR:L), deliberate user interaction via a reaction (UI:P), and precise timing where unrelated outbound messages and a pending approval coexist (AC:H, AT:P), which is why the CVSS 4.0 base score is 7.5 rather than critical. The flaw does not grant any party new authority and does not change the legitimacy of correctly identified approvers; impact is bounded by whatever host actions the OpenClaw process is authorized to perform for the specific pending request. Vendor-released patch: 2026.7.1; no public exploit identified at time of analysis and the issue is not in CISA KEV.
A time-of-check time-of-use race condition in OpenClaw's OpenShell local mirror filesystem mutation operations (remove, mkdir, rename) before 2026.7.1 allows an authenticated local attacker to escape the sandbox and delete, create, or rename host filesystem paths outside the intended mirror root with the permissions of the OpenClaw process user. Exploitation requires winning a narrow timing race between the sandbox path-safety check and the actual operation, which is a non-trivial precondition, but it does not require the operator to have granted host filesystem access outside the sandbox, so default deployments are affected. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released a fix in version 2026.7.1.
Authorization bypass in OpenClaw before 2026.7.1 lets an authenticated but non-owner user run the '/mcp set' and '/mcp unset' commands to persist arbitrary stdio MCP server entries, which OpenClaw then executes with its own process privileges the next time it loads its MCP configuration - giving the attacker full impact on host confidentiality, integrity, and availability (assessed CVSS:3.1 base 8.7, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a missing-authorization issue (CWE-862) exploitable only where more than one principal shares an OpenClaw instance, with execution deferred to the subsequent config-load event. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and impact is confined to versions prior to 2026.7.1.
Information disclosure in OpenClaw before 2026.7.1 allows authenticated non-owner channel senders to retrieve owner-only host diagnostic bundles through the diagnostics export command, exposing host, configuration, runtime, and connected-service details. The flaw is an authorization bypass (CWE-200) that requires low privileges (a connected channel sender) and causes no integrity or availability impact; no public exploit code is identified at time of analysis.
An authorization bypass in the /export-trajectory endpoint of OpenClaw before 2026.7.1 lets a non-owner account retrieve trajectory bundles that should be restricted to the session owner. A remote attacker who holds any valid low-privilege credentials on the instance (PR:L, not anonymous) can request a session they do not own and receive its exported bundle, exposing prompts, model messages, tool schemas, runtime events, and local path metadata; the effect is disclosure only, with no integrity or availability impact (VC:H, VI:N, VA:N). No public exploit code has been identified at time of analysis, and the vulnerability is not listed as actively exploited, though the high EPSS-equivalent exposure of a network-reachable, low-complexity bypass makes prompt remediation to 2026.7.1 advisable.
OpenClaw deployments before 2026.7.1 contain an authorization-bypass flaw in the browser tool that lets a sandboxed session reach a paired host node's browser actions even when allowHostControl=false is set, so an attacker who can steer sandboxed agent input (e.g., via untrusted content or prompt injection) can inspect or manipulate the connected browser profile and its authenticated state. The issue affects remote, low-privilege, unauthenticated-at-the-network sandbox input paths (CVSS 8.7, vector PR:L/UI:N), and there is no public exploit identified at time of analysis; risk is concentrated in deployments that actually pair a host browser and feed untrusted content into the sandbox.
Authorization bypass in OpenClaw (npm package 'openclaw') before 2026.7.1 lets a low-privilege, write-scoped caller reach browser-control functionality through the node.invoke code path even though the equivalent direct browser.request path correctly enforces administrator scope. The issue only affects Gateway deployments that honor caller identity and narrower operator scopes, and it requires the attacker to already hold a valid write-scoped credential plus access to a connected browser-capable node; deployments using OpenClaw's shared-secret token or password trusted-operator model are not affected. A successful exploit allows the caller to inspect pages, navigate tabs, and interact with browser-visible applications without the configured admin requirement, with realized impact bounded by the target browser profile and its signed-in state; no public exploit code or confirmed active exploitation was identified at time of analysis.
Broken authorization in OpenClaw before version 2026.7.1 lets a non-owner channel sender invoke the Codex computer-use installation command to install arbitrary plugins and spawn MCP (Model Context Protocol) processes with the privileges of the OpenClaw service user. The assessed vector (CVSS 4.0 base 8.7; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires only that the attacker be able to send messages into an OpenClaw channel, with no user interaction from the legitimate owner, yielding full confidentiality, integrity, and availability impact on the host. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the risk is nonetheless high because the missing check converts ordinary channel participation into remote code execution in the OpenClaw user's context.
OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization for native conversation bindings, allowing a non-owner channel sender who already holds command access to bind to the Codex runtime and execute host-capable turns with access to files, tools, and processes. This privilege escalation (CWE-269) has a CVSS 4.0 score of 8.7 (High) and is network-reachable with low complexity and low privileges, but it requires the attacker to already have command access on a channel-a fully external attacker cannot trigger it. No public exploit code or active exploitation was identified at time of analysis.
Authorization bypass in the npm package `openclaw` (OpenClaw) before version 2026.7.1 allows an already-authorized non-owner channel sender who holds channel command access to approve or deny Claude Code permission prompts that were meant for the owner, causing the pending action to proceed without owner consent. The severity of any given exploitation is bounded by what the specific Claude Code run requested - the attacker can only green-light capabilities the host run had already queued, so impact ranges from low-risk operations up to high-impact host actions depending on context. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited; the vendor-released fix is version 2026.7.1.
Channel read allowlist bypass in the OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 lets a low-privilege sender or a steered/prompt-injected agent pull messages, reactions, pins, member lists, and related metadata out of channels and rooms that the operator's read policy was intended to exclude. Exploitation is unauthenticated at the network layer but requires an existing low-privilege channel read capability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and it only matters where a restrictive read allowlist is actually configured - default open policies expose nothing new. Exposure is further bounded by the permissions held by the connected bot account, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor fixed the issue in 2026.8.1.
OpenClaw (npm package 'openclaw') before 2026.7.1 lets an actor who can steer a tool-enabled agent create a persistent cron job that runs attacker-chosen commands with the privileges of the OpenClaw process user. A mixed-case payload 'kind' value slips past the agent-facing shell-execution guard and later normalizes into a command job, targeting the model-facing cron tool only. The vendor scores this 8.7 (High) on CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and the vendor-released patch is 2026.7.1; no public exploit identified at time of analysis.
Authorization bypass in OpenClaw before 2026.7.1 allows a write-scoped caller in identity-bearing Gateway deployments to spoof another sender's identifier in message.action requests and invoke a channel action under that requester identity, reaching operations the channel adapter would have denied to the real caller. Exploitation requires a valid low-privilege (write-scoped) credential, an authentication mode that honors caller identity (shared-secret token and password callers are explicitly out of scope), and at least one enabled channel action that relies on requester identity; practical impact is bounded by the enabled channel, the action invoked, and the target account's permissions. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the vendor-released fix is version 2026.7.1.
OpenClaw Gateway before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint, allowing an authenticated write-scoped non-owner caller to cause the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. This privilege escalation (CWE-269) affects Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, and where agent tool policies include the `gateway` and `cron` tools; shared-secret token and password callers are treated as fully trusted and are out of scope. No public exploit code identified at time of analysis; the vendor CVSS 4.0 score is 7.2 with integrity impact dominant.
OpenClaw Slack deployments before 2026.8.1 fail to enforce configured sender allowlists inside multi-person (group) direct messages, allowing an authenticated Slack workspace user who was deliberately excluded from the allowlist to invoke the Slack agent and reach every tool and data source that agent has been granted. Because the bypass is confined to group DMs rather than 1:1 conversations, any excluded participant who shares a multi-person DM with the agent can trigger it without victim-side interaction; the practical blast radius depends entirely on the agent's privileges, ranging from data disclosure on a read-only agent to full command/write capability on a more powerful one. The vendor rates this 8.7 (CVSS 4.0, AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity and availability impact), an assessment our independent review considers broadly defensible for the mechanics; no public exploit code and no confirmed active exploitation were identified at time of analysis, though EPSS and KEV data were not provided.
Server-side request forgery in OpenClaw (npm package 'openclaw') before 2026.8.1 lets an attacker who can influence DNS for an already-allowlisted hostname bypass the trusted-host destination validation and reach a service bound only to loopback, disclosing that service's response. Exploitation is highly conditional and high-complexity: the fetch must go through the trusted-host DNS recheck path, the hostname must already be on the trusted-host allowlist, the attacker must be able to make it resolve to an unspecified address (0.0.0.0 or ::), and a loopback-bound service must actually exist and return useful data - impact is confidentiality-only. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor shipped a fix in 2026.8.1.
OpenClaw npm package versions 2026.3.28 through 2026.8.0 can be coerced into executing attacker-supplied Python code when an operator opens OpenClaw against an untrusted workspace whose .env file sets CLOUDSDK_PYTHON_ARGS and then runs the Gmail setup flow. The poisoned value is inherited by the gcloud launcher, which forwards it as arguments to the trusted Python interpreter, giving the attacker code execution with the OpenClaw host user's permissions - enough to read credentials, modify files, or spawn further processes. The issue is rated 8.5 (CVSS 4.0 AV:L/AC:L/AT:N/PR:N/UI:P; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is fully local and interaction-dependent: the malicious workspace content must already be present and the operator must both launch OpenClaw on it and actively trigger Gmail setup, so it cannot be fired remotely or unattended; no public exploit code was identified at time of analysis. Version 2026.8.1 fixes the flaw.
Improper access control in OpenClaw versions before 2026.8.1 allows a model-visible agent caller to read and force-run operator-authored command cron jobs that lack proper owner binding. By reaching the agent's caller surface with at least low-level access, an attacker can disclose environment variables stored in those jobs and trigger disabled or unscheduled command jobs, exposing embedded secrets and executing commands the operator authored. The flaw carries a vendor CVSS 4.0 score of 8.7 (PR:L, network reachable) and a CWE-200 information-exposure classification; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is elevated but not confirmed as actively exploited.
Server-side request forgery in OpenClaw (npm package 'openclaw') versions 2026.4.5 through before 2026.8.1 lets an attacker who controls an approved remote Chrome DevTools Protocol (CDP) hostname, or its DNS answers, use DNS rebinding to steer the Gateway into connecting to SSRF-denied destinations such as loopback, private, link-local, or cloud metadata addresses. The flaw is a check-then-use (TOCTOU) gap: the Gateway validates and pins DNS at configuration time, but the raw WebSocket and Playwright transports independently re-resolve the hostname when the connection is actually made, discarding the pin. Per the CVSS:3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) exploitation is unauthenticated but requires a non-default, operator-configured hostname-based remote CDP endpoint plus a successful rebinding race, so impact is bounded by the internal services reachable from the Gateway host; no public exploit is identified at time of analysis and CISA KEV does not list this issue.
Command-execution approval bypass in the OpenClaw agent runtime (npm package 'openclaw') versions 2026.3.22 up to but not including 2026.8.1 lets an attacker piggyback on a previously approved command wrapper to run arbitrary commands with the OpenClaw process's host privileges, without triggering a new approval prompt; the vendor rates this 8.6 and our independent assessment places it at CVSS 3.1 8.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation is gated by two preconditions. An authenticated operator must first have allowlisted or permanently approved a specific wrapper invocation, and that wrapper (a transparent shell carrier, or an opaque utility such as a process monitor, tracer, namespace tool, or proxy wrapper) must resolve on the host; a later agent turn can then substitute an arbitrary inner command in the wrapper's arguments and have it executed under the host privileges of the OpenClaw process. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the issue is fully remediated by upgrading to 2026.8.1.
Authorization bypass in OpenClaw before 2026.8.1 lets an attacker reuse an already-approved executable with different arguments, so commands execute without a new approval prompt. The root of the flaw is that 'Allow Always' approvals granted for an exact command are persisted on macOS and Linux as path-only grants, meaning any later invocation of that same binary silently inherits the earlier approval. Exploitation is conditionally gated: an operator must first have granted Allow Always for at least one command, and the attacker must then steer the agent into invoking that binary with attacker-chosen arguments (typically via prompt or content injection), which is reflected in the high attack complexity and user-interaction metrics of the assessed vector rather than a pre-auth internet-facing entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Command injection in OpenClaw versions before 2026.8.1 lets an attacker who can supply command input to an agent turn slip hidden commands past the exec allowlist: escaped newlines desynchronize the allowlist parser, which validates only the visible portion of the input while the appended command executes without the expected authorization prompt. Successful exploitation yields full code execution on the host (VC:H/VI:H/VA:H, CVSS 4.0 base 8.6; independently assessed as CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), though it requires the operator to be actively driving the affected agent turn (UI:P) and the attacker to already hold a low-privilege position on the command-input surface (PR:L). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but the allowlist-bypass nature of the bug means any environment relying on the exec allowlist as its execution boundary should treat this as high priority.
Resource exhaustion in the OpenClaw Gateway listener affects every OpenClaw release before 2026.8.1 and lets unauthenticated remote attackers open WebSocket upgrade requests that retain response sockets without matching connection semantics; repeated malformed upgrade requests drain listener capacity until the service becomes unavailable (CVSS 4.0 8.7, availability-only; independent assessment rates A:H with PR:N/UI:N). Because those requests sidestep the product's WebSocket pre-auth connection budget, the built-in connection limiting does not throttle the flood, and the only prerequisites are network reachability to the Gateway listener - no credentials and no user interaction. No public exploit code has been identified at time of analysis, and impact is confined to availability, with no data disclosure or code execution reported.
Authorization bypass in OpenClaw versions before 2026.8.1 lets an authenticated, low-privileged sender who is permitted to invoke skill commands reach owner-only tools and owner-reserved server credentials, because skill tool dispatch does not propagate the sender's owner status into the tool authorization decision. Exploitation requires only the PR:L prerequisite defined by the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, base 8.7) - no owner credentials and no user interaction - and yields high confidentiality and integrity impact with limited availability impact, so the practical exposure is confined to multi-sender or multi-tenant OpenClaw deployments in which non-owner principals have been granted skill-command access; single-owner or no-external-sender deployments are not exposed. No public exploit identified at time of analysis, and this CVE is not reported as confirmed actively exploited (CISA KEV); a vendor security advisory (GHSA-7cp7-87pj-p32v) and a VulnCheck advisory are available, and the fixed release is 2026.8.1.
Server-side request forgery in OpenClaw Gateway (npm-distributed, versions 2026.7.1 through 2026.8.0) lets an authenticated, write-scoped caller abuse Synology Chat attachment delivery: the Gateway validates a single DNS lookup for a supplied file URL but then hands the original hostname to the Synology NAS, which resolves it independently and can be steered to a private or policy-denied resource whose contents are returned to the addressed conversation. Reaching that outcome requires remote URL attachment forwarding to be enabled, the Gateway to accept a remotely-influenced hostname, and the attacker to win a DNS rebinding race against the NAS's own resolution, so practical impact hinges on NAS routing, resolver behavior, and whether a useful response exists at the private destination; no public exploit code has been identified at time of analysis. The vendor CVSS 4.0 rating is 7.1 (HIGH), but our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, arguing for a lower real-world priority given the non-default feature-specific pathway, the PR:L authentication requirement, and the narrow affected window that is closed by upgrading to 2026.8.1.
OpenClaw before 2026.8.1 fails to enforce per-chat tool policies for Codex app-server runtime tools, allowing an authenticated participant (PR:L) in a lower-trust conversation to bypass a tools.allow allowlist and reach native shell, process, file, and patch tools. The vendor-assigned CVSS 4.0 score is 8.7, and the practical impact depends on the Codex runtime's host permissions and sandbox configuration; the issue is fixed in 2026.8.1. No public exploit identified at time of analysis.
Credential theft in OpenClaw for iOS (versions >= 2026.7.1 and < 2026.8.11) lets a man-in-the-middle attacker who redirects the same Gateway host and port and presents a certificate that passes iOS system trust capture the injected Gateway token or password from the authenticated Terminal and session Dashboard WebViews, which - unlike native connections - failed to enforce the saved Gateway TLS fingerprint. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. No public exploit has been identified at time of analysis, and exploitation requires a prior accepted Gateway fingerprint, a network-adjacent MITM position, a validly trusted certificate for the host, and the victim opening the affected WebView, which substantially limits realistic risk to targeted adversaries despite the vendor's Critical 9.0 CVSS 4.0 rating.
Authorization bypass in the @openclaw/voice-call package before version 2026.8.1 lets a remote caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) drive the agent's owner-only tools, because the caller's identity and non-owner status are not propagated on classic inbound voice calls. The owner-only tool filter therefore fails open, allowing data reads, file modification, command execution, or control of connected services depending on how the agent is provisioned. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 4.0 base 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis. Deployments with inbound calling disabled, or whose allowlist excludes the attacker, are not affected.
OpenClaw (npm package 'openclaw') versions before 2026.8.1 leak deterministic hashes computed over the original, unredacted configuration inside responses to redacted configuration requests, so a caller who can invoke operations such as config.get can perform offline password-candidate testing instead of going through the rate-limited Gateway authentication endpoint. Exploitation is conditional: the attacker must already hold an authenticated, low-privileged session able to retrieve the redacted config, the Gateway password must have low entropy, and the remaining non-redacted configuration values must be reconstructable enough to compute candidate hashes - high-entropy passwords defeat the attack entirely and secret references are not exposed by the flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and recovery of the password would grant the documented shared-secret operator authority, which explains the High confidentiality, integrity and availability impact rating.
Authorization bypass in OpenClaw's Matrix integration (@openclaw/matrix) allows an authenticated Matrix participant to inherit another account's authority when their user identifier collides after case/Unicode folding. Versions 2026.2.2 through 2026.8.0 lowercase the complete Matrix user ID - including the case-sensitive server-name portion and historical localparts - before deriving the OpenClaw authorization identity, so an attacker controlling a protocol-valid, fold-equivalent identifier (display-name matching is not required) can gain allowlist, owner-command, exec-approval, or plugin-approval rights configured for the privileged account. The vendor rates this CVSS 7.7 with high confidentiality, integrity, and availability impact; real-world risk is moderate and gated by the attacker needing a valid authenticated Matrix account plus a registrable colliding identifier, and no public exploit identified at time of analysis.
Incorrect authorization in OpenClaw Feishu before 2026.8.1 allows an authenticated attacker who can already invoke the agent's model tool operations to act through a default account that the operator has disabled, because the account-selection logic never checks the disabled flag before using that account's still-stored Feishu credentials. Successful exploitation lets the attacker read or modify Feishu resources under a revoked identity, yielding high confidentiality and integrity impact (CVSS 4.0 base 7.6; assessed CVSS 3.1 7.6 with AV:N/AC:H/PR:L/UI:N/C:H/I:H/A:N by our analysis). Exploitation is conditional and non-default: it requires a multi-account configuration where the default account is disabled yet its credentials remain valid, plus pre-existing low-privilege access to the OpenClaw agent, so it is not reachable by an anonymous remote attacker against a default install; no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Local file disclosure in OpenClaw (npm package 'openclaw') before 2026.8.1 allows an authenticated, already-admitted requester to read arbitrary known local host files even when that sender's identity has been explicitly denied filesystem read tools through the global or per-agent toolsBySender policy. The bypass occurs because outbound attachment handling - via a final-response media directive or a message attachment - does not re-apply the originating sender's policy, so a denied sender can still have a known local file read and returned to an admitted requester whose agent turn never included the read tool. Exploitation requires the attacker to already be admitted to the agent, to know or derive a useful host path, and to reach a delivery flow that accepts local attachments; impact is read-only disclosure of file contents with no integrity or availability effect, and no public exploit code has been identified at time of analysis.
Sensitive local file disclosure in OpenClaw before 2026.8.1 lets a low-privileged caller (PR:L per the CVSS vector, not fully anonymous) smuggle an unvalidated absolute host path past sandbox path validation by supplying structured message attachments that carry multiple 'source' fields, hiding the disallowed path behind an allowed attachment source. When the Telegram delivery channel is configured and active, the agent then reads the referenced host file and relays it out through that channel, giving the attacker high-confidentiality read access to files that policy would otherwise reject. There is no code execution, file modification, or denial of service; EPSS and KEV data are not provided, and no public exploit code has been identified at time of analysis. The vendor has released a fix, and exploitation requires both a message-submission-capable attacker and an OpenClaw deployment that uses Telegram delivery.
Privilege escalation in the OpenClaw npm package (versions >= 2026.4.5 and < 2026.8.1) allows a restricted external sender to have its session-derived text persisted into shared session memory and later replayed to an unattended background 'dreaming' agent that holds broader file and command privileges, producing actions beyond the authority of the original turn. The flaw is only reachable in deployments where session-memory capture and the dreaming agent are both enabled and the background agent is provisioned with more capability than the originating turn, and the exploit chain additionally depends on the content being selected for later processing and then actually followed by the model. No public exploit identified at time of analysis; vendor has released a fix in OpenClaw 2026.8.1, and the vendor-assigned CVSS 4.0 score is 7.7.
Authenticated non-owner senders can abuse the generic channel-tool path in the @openclaw/whatsapp plugin (npm, versions before 2026.8.1) to force a WhatsApp login for a configured Gateway account, issuing a fresh QR code that disconnects the existing session and causes loss of availability; integrity impact is limited because full account relinking still requires the attacker to physically scan the returned QR code with another phone. The flaw is a missing authorization check on an owner-only tool boundary (CWE-862) rather than a bypass of WhatsApp transport authentication, and it requires PR:L - an attacker who has already been admitted to a channel and can steer the agent. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 2026.8.1.
An authenticated attacker with low privileges can exploit an authorization bypass in the @openclaw/slack npm package (versions before 2026.8.1) to download file contents from Slack conversations outside their permitted scope, resulting in cross-boundary data disclosure. The flaw is an IDOR-class (CWE-639) issue where the conversation-authorization check fails open when a file lacks the share metadata normally used to prove conversation membership. No public exploit code or active exploitation has been identified, and the issue does not bypass Slack's own authentication or allow file enumeration. Vendor patch 2026.8.1 is available.
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'allow-always' exec approval to execute the same command against unreviewed files or repositories, escaping the original approved working directory. Exploitation requires a pre-existing 'allow-always' approval and the ability to influence agent behavior; it is not exploitable on a default installation with no standing approvals. No public exploit identified at time of analysis.
Authorization scope widening in OpenClaw before 2026.8.1 allows an authenticated low-privilege sender to reuse a standing 'allow-always' file-transfer approval and reach file paths or nodes that the operator never reviewed, resulting in unauthorized file read and write (C:H/I:H, no availability impact) within whatever the agent's file-transfer capability can touch. Exploitation is conditional: it requires a previously granted allow-always approval, an already-admitted sender who can steer the agent (PR:L/UI:P), and successful abuse of glob metacharacter interpretation or node display-name reuse to resolve the grant to sibling paths or a different node (AC:H/AT:P), so it is not reliably automatable and there is no prior grant to widen otherwise. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; a vendor patch is available in OpenClaw 2026.8.1.
OpenClaw iOS builds before 2026.8.11 write complete agent deep-link URLs - including persistent bearer keys - into the iOS unified log with public diagnostic visibility, so anyone who obtains a diagnostic archive (sysdiagnose bundle, device backup, or MDM-collected log set) can recover those keys and replay them inside forged deep links to submit agent requests without the normal on-device confirmation prompt. Exploitation is local and conditional rather than remote: the recovered bearer key must still be unrotated and valid at replay time, and the attacker must reconstruct a working forged deep link, which is why the assessed vector carries AV:L/AC:H (CVSS:3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). The status of this issue is that of a genuine but constrained credential-exposure flaw - no public exploit identified at time of analysis, no confirmed actively exploited (CISA KEV) activity, and a vendor patch shipping in 2026.8.11.
Authorization bypass in OpenClaw before 2026.5.18 lets a low-trust, authenticated caller escape the exec allowlist by abusing weak glob matching, executing or persisting actions beyond their intended authorization. Reported by VulnCheck and tracked as a path-traversal-class flaw (CWE-22), it carries a CVSS 4.0 score of 7.7 with high confidentiality, integrity, and availability impact but requires the affected exec feature to be enabled. No public exploit identified at time of analysis; there is a GitHub security advisory and a corresponding VulnCheck advisory.
Authorization bypass in OpenClaw before 2026.6.5 lets a low-trust, authenticated caller execute node exec actions beyond their approved permissions by exploiting mismatched gateway and node environment configurations. The flaw (CWE-863, Incorrect Authorization) enables privilege escalation within the approval workflow and can be used to persist or run unauthorized actions. Reported by VulnCheck with a CVSS 4.0 base of 7.7; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in OpenClaw before 2026.5.18 lets low-privileged, authenticated callers escalate their actions through the device-pair approval feature, executing or persisting operations beyond their intended trust level. The flaw stems from improper authorization checks (CWE-863) on device-pairing input paths, and per the CVSS 4.0 vector it fully compromises confidentiality, integrity, and availability of the affected system. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Untrusted plugin loading in OpenClaw before 2026.5.22 lets an attacker with lower-trust caller access, or control over configured input paths, get malicious workspace plugins loaded through the setup-mode discovery process, executing or persisting actions above their intended authorization level. Exploitation is local and requires active user interaction plus a specific attack precondition (CVSS 4.0 base 7.1), and there is no public exploit identified at time of analysis. The root cause is inclusion of functionality from an untrusted control sphere (CWE-829) during setup-mode plugin discovery.
Authorization bypass in OpenClaw versions 2026.1.20 through 2026.5.26 allows low-trust, authenticated callers to invoke the device.pair.approve feature and perform device-pairing approvals that should require stronger role-management authorization. Because the feature can be reached through configured input paths, an attacker holding only limited privileges can escalate their effective authority over device pairing, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 8.7.
Privilege escalation via authorization bypass in OpenClaw's QQBot exec approvals feature affects builds from 2026.5.14-beta.1 up to (but not including) 2026.5.27, letting a lower-trust or non-allowlisted sender execute or persist actions beyond their intended authorization. The CVSS 4.0 vector requires low existing privileges (PR:L) and a present attack requirement (AT:P), meaning the exec approvals feature must be enabled and reachable for exploitation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a fixed release (2026.5.27) and a vendor security advisory are available.
Authorization bypass in OpenClaw's ClickClack agent-mode dispatch (versions 2026.5.10-beta.1 through 2026.6.4) allows a lower-trust caller to invoke actions that should be blocked by the toolsAllow policy, because that policy check can be skipped during dispatch. With CVSS PR:L, an already low-privileged authenticated caller (or an attacker-controlled input path) can escalate the scope of actions when the agent-mode feature is enabled and reachable. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed in 2026.6.5.
Authorization bypass in OpenClaw before 2026.6.5 lets a low-privileged, authenticated caller reach admin-scoped tools and perform privileged actions they should not be authorized for. The flaw stems from insufficient policy checks on configured input paths (CWE-862, Missing Authorization), so a lower-trust principal can escalate the scope of operations available to it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported by VulnCheck with a CVSS 4.0 base score of 7.7.
Privilege escalation and unauthorized action execution in OpenClaw before 2026.6.6 arises from incomplete environment-variable filtering in its host exec path, which fails to strip rustup startup variables before spawning processes. A low-privilege caller (PR:L) with access to lower-trust invocation paths or configured input paths can influence the child process environment to run or persist actions above their intended authorization level, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in OpenClaw's isolated cron job feature (versions 2026.6.1 through 2026.6.8) lets a lower-trust authenticated caller reclaim execution tools that authorization policy had explicitly denied, enabling actions and persistence beyond their intended trust level. The flaw is an incorrect-authorization (CWE-863) issue rooted in misconfigured input path handling within the cron subsystem, and carries a CVSS 4.0 score of 7.7. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in OpenClaw before 2026.6.1 lets a lower-trust authenticated caller abuse Git 'ext' transport through incomplete host-exec environment filtering to execute or persist actions beyond their intended privileges. VulnCheck reported and characterizes it as an authentication bypass via Git ext transport, and a GitHub Security Advisory (GHSA-9969-8g9h-rxwm) is published; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact reachable over the network with only low privileges.
Authorization bypass in OpenClaw before 2026.6.6 lets a low-privileged caller inject crafted interpreter startup environment variables through the host exec feature, executing or persisting actions beyond their intended authorization. The flaw stems from incomplete environment-variable filtering (CWE-184) that overlooks interpreter startup variables, and per its CVSS 4.0 vector (VC:H/VI:H/VA:H) yields high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; the issue is reported by VulnCheck and fixed in 2026.6.6.
Authorization bypass in OpenClaw (versions 2026.3.22 up to but not including 2026.6.6) lets a lower-trust WhatsApp sender satisfy elevated sender allowlists because WhatsApp group IDs are accepted as if they were privileged individual sender identities. An authenticated but low-privilege attacker can therefore invoke actions gated behind stronger authorization, effectively escalating privilege within the messaging integration. Reported by VulnCheck with a CVSS 4.0 base score of 8.7 (high); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in OpenClaw 2026.5.20 through 2026.6.5 lets a low-privilege caller invoke owner-only tools through the MCP loopback feature, escalating beyond intended permissions to execute or persist privileged actions. The flaw stems from incorrect permission enforcement (CWE-732) on configured input paths reachable over the network. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in OpenClaw 2026.5.20 through 2026.6.8 lets an already-authenticated, lower-trust caller abuse the plugin install command path to execute or persist actions beyond their intended authorization. The root cause is an incorrect permission assignment (CWE-732) on plugin installation, and the CVSS 4.0 vector (PR:L, UI:N, AV:N) shows a low-privileged remote actor can achieve high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the CVE is not in CISA KEV, but a GitHub Security Advisory (GHSA-7vrr-rp4x-4g76) and a VulnCheck advisory document it.
Privilege-boundary bypass in OpenClaw's Discord guild-action handling (versions 2026.6.6 up to but not including 2026.6.9) lets a low-privilege authenticated caller invoke operations that should require stronger authorization. By abusing misconfigured input paths, the attacker skips the cross-provider requester authorization step and executes restricted guild operations. No public exploit identified at time of analysis; the CVSS 4.0 score of 7.2 reflects high integrity and availability impact with no confidentiality exposure.
Privilege escalation via authorization bypass in OpenClaw 2026.6.6 through 2026.6.8 allows a low-privileged, authenticated caller to invoke message-mutation operations that should require stronger authorization, letting them execute privileged actions. The flaw is a missing authorization check (CWE-862) on mutation input paths and requires the affected feature to be enabled and reachable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authorization bypass in OpenClaw before 2026.6.9 lets a lower-trust caller escape the exec-approval trust boundary through the flock wrapper, executing or persisting privileged actions the caller was never authorized to perform. The CVSS 4.0 vector (PR:L) indicates an authenticated but low-privilege actor can achieve high confidentiality, integrity, and availability impact when the affected feature is enabled. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-3fp5-v549-9v66); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass via symlink following in OpenClaw's mirror sync feature (versions before 2026.6.9) lets a lower-privilege caller escalate into actions that should require stronger authorization. By planting or referencing symlink parents on a remote mirror target, an authenticated attacker can trick the sync logic into resolving links that cross policy and trust boundaries, yielding high confidentiality and integrity impact. There is no public exploit identified at time of analysis and no CISA KEV listing; no EPSS score was supplied.
Privilege escalation via broken authorization in the OpenClaw @openclaw/feishu integration (versions 2026.6.6 and earlier) allows a lower-trust, already-authenticated caller to invoke Feishu permission tools that should have been blocked by per-account disablement settings. Because the enforcement gap lets a low-privilege actor perform actions requiring stronger authorization, the flaw carries high confidentiality and integrity impact (CVSS 4.0 base 8.6). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authorization bypass in the @openclaw/feishu npm package (versions <= 2026.6.6) allows a lower-trust caller - or attacker-influenced input reaching a configured input path - to perform Feishu (Lark) actions that should have required stronger authorization, because per-account disablement can be ignored. Authenticated remote attackers can trigger unauthorized operations affecting confidentiality and integrity; no public exploit has been identified at time of analysis, and the flaw is fixed in version 2026.6.9. Real-world impact is gated by the operator's configuration and whether untrusted input can reach the affected feature.
Privilege escalation in OpenClaw before 2026.6.8 lets a lower-trust, already-authenticated caller invoke admin-restricted operations by abusing OpenAI-compatible HTTP model-override input paths, bypassing the authorization checks that should gate those actions. The flaw was reported by VulnCheck and stems from missing authorization (CWE-862) on override-driven request handling. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Credential exposure in OpenClaw before 2026.5.28 lets a lower-trust actor who can write to a workspace's configured input paths plant a dotenv file that overrides trusted provider credentials, causing sensitive secrets to leak across intended trust boundaries. VulnCheck reported the issue and it is fixed in 2026.5.28; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor CVSS 4.0 base score is 8.4 (High), reflecting high confidentiality and integrity impact but requiring local path access and user interaction.
Allowlist bypass in OpenClaw versions prior to 2026.5.12 allows authenticated operators to execute unapproved shell commands by routing requests through inline-command parser cases that skip the expected allowlist enforcement. The flaw, reported by VulnCheck and tracked under GHSA-f397-5vjw-v2c2, effectively neutralizes the operator-approval boundary in OpenClaw's shell command path. No public exploit identified at time of analysis, and the CVSS 4.0 score of 7.6 reflects high confidentiality and integrity impact with a present attack requirement.
Untrusted search path execution in OpenClaw before 2026.5.2 allows a local low-privileged user to coerce maintenance task routines into invoking attacker-controlled executables in place of the intended trash command. By manipulating workspace-derived environment paths consumed during maintenance operations, an authenticated user can hijack command resolution and run arbitrary binaries in the OpenClaw process context. No public exploit identified at time of analysis, but VulnCheck has published a dedicated advisory describing the workspace-derived service path abuse.
Environment variable sanitization weakness in OpenClaw prior to 2026.5.26 lets attackers smuggle Node.js control variables (such as NODE_OPTIONS) past the host environment sanitizer, enabling them to influence child-process behavior and coverage output paths. Affected attackers must have write access to workspace .env files, tool environment overrides, or skill environment blocks, and no public exploit is identified at time of analysis. The flaw was reported by VulnCheck and is tracked under CWE-184 (Incomplete List of Disallowed Inputs).
Untrusted search path in OpenClaw before 2026.5.2 allows local attackers who can influence a workspace .env file to redirect bundled runtime dependency loading to attacker-controlled paths, resulting in arbitrary code execution during dependency resolution. The STATE_DIRECTORY environment variable is not validated before being used to anchor runtime dependency roots, so a poisoned workspace can execute code in the context of a user who opens it. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses intended for other Zalo identities by manipulating their mutable display name to match allowFrom policy entries. The flaw stems from policy enforcement relying on mutable display metadata rather than immutable identifiers, and no public exploit has been identified at time of analysis.
Allowlist bypass in OpenClaw before 2026.4.2 lets authenticated operators smuggle inline-eval content through shell positional parameters, defeating the strict allowlist that is meant to constrain which tools and content the shell carrier executes. Successful abuse yields execution of unapproved shell-provided content with high confidentiality and integrity impact, and no public exploit has been identified at time of analysis.
Allowlist bypass in OpenClaw before 2026.5.12 lets authenticated attackers invoke approved executables with arbitrary arguments on Linux and macOS, defeating the argPattern restrictions intended to constrain each binary's permitted invocations. The flaw enables disallowed file access, network access, or command execution under the privileges of the OpenClaw exec subsystem, with no public exploit identified at time of analysis.
Privilege escalation in OpenClaw before 2026.5.7 allows any user with a Discord account to assume the identity of a privileged Discord user authorized in the agent's allowFrom policy by simply renaming their account, because the access-control check matches on mutable display names rather than immutable Discord user IDs (snowflakes). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but exploitation is trivial for anyone who can read the target policy.
Untrusted search path in OpenClaw versions prior to 2026.4.29 lets workspace-local .env files override the npm_execpath variable consulted by the install helper, redirecting bundled dependency installation to an attacker-controlled package-manager binary. An attacker who can place files in the workspace can hijack the runtime dependency setup step to compromise the build environment under the developer's identity, with no public exploit identified at time of analysis.
Authorization bypass in OpenClaw before 2026.5.26 allows an attacker with a previously paired device to re-establish WebSocket node-level authority after the session has been revoked, effectively defeating the revocation control. The flaw stems from a surviving pairing-scoped device session that can mint new node tokens without renewed approval, letting authenticated attackers retain unauthorized node-level access longer than intended. No public exploit identified at time of analysis, but the issue is acknowledged in a GitHub Security Advisory (GHSA-q99w-vh6v-q3v7) and a VulnCheck advisory.
Arbitrary Python runtime execution in OpenClaw before 2026.5.2 lets an attacker with write access to the workspace plant a malicious .env file that overrides the CLOUDSDK_PYTHON variable used during Gmail setup, redirecting gcloud invocations to an attacker-controlled Python interpreter and leading to code execution. The CVSS 4.0 vector (AV:L/AT:P/UI:A) confirms the attack is local, requires a specific attack condition, and depends on a user/operator action - no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in OpenClaw before 2026.5.12 allows authenticated operators to bypass the PowerShell execution allowlist by submitting encoded-command flag aliases (abbreviated forms) that the allowlist parser fails to recognize. The flaw enables execution of arbitrary PowerShell payloads with full confidentiality, integrity, and availability impact on the host. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authorization bypass in OpenClaw's QQBot component before version 2026.4.27 allows authenticated senders to invoke slash commands before allowFrom policy checks execute, effectively skipping operator-configured access controls. The flaw stems from pre-dispatch command handling that runs prior to policy enforcement, enabling blocked senders to trigger command handlers depending on deployment configuration. No public exploit identified at time of analysis, and CVSS 4.0 scoring of 8.2 reflects high integrity impact with an attack requirement (AT:P) suggesting non-trivial conditions.
Identity header forgery in OpenClaw before 2026.5.18 allows local same-host callers with access to the proxy-facing Gateway port to spoof trusted-proxy identity headers and assume operator identity. The flaw stems from missing validation of headers normally set by an upstream trusted proxy, enabling privilege escalation when the Gateway port is reachable locally. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure in OpenClaw before 2026.5.18 lets authenticated operators abuse shell metacharacter expansion within the system.run safe-bin allowlist to read unintended node-local files on POSIX nodes and exfiltrate sensitive configuration data. The flaw bypasses command-policy enforcement because the allowlist validates a literal command string while the underlying shell re-interprets it at execution time. No public exploit identified at time of analysis.
Command approval bypass in OpenClaw versions prior to 2026.5.18 allows authenticated users to smuggle malicious instructions past human approvers by exploiting how the approval UI truncates oversized exec commands. The flaw (CWE-451, UI misrepresentation) lets an attacker craft a request with a benign-looking prefix while a malicious suffix is hidden from the reviewer's display, resulting in unauthorized execution once the request is approved. No public exploit identified at time of analysis and the CVE is not currently listed in CISA KEV.
Authorization bypass in OpenClaw before 2026.5.6 allows authenticated senders to invoke owner-only native commands without satisfying the configured owner-command policy. Any user with valid credentials can therefore execute privileged operations reserved for the resource owner, undermining the access control model. No public exploit identified at time of analysis, but a GitHub Security Advisory (GHSA-p73f-w79w-jqr5) and a VulnCheck advisory document the flaw.
Arbitrary local file read in OpenClaw before 2026.4.7 lets authenticated Gateway operators holding the operator.write scope coerce the memory-wiki ingest feature into importing the contents of arbitrary local files. The flaw, reported by VulnCheck and tracked as GHSA-p2fh-f5fc-44hr, enables disclosure of sensitive host files (credentials, config, secrets) into wiki memory, but no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in OpenClaw before 2026.5.3 allows attackers with access to a Slack account to spoof identity by changing their mutable Slack display name to match an allowFrom policy entry, gaining agent access intended for another user. The root cause is authentication binding to a mutable identifier (CWE-290) rather than a stable Slack user ID. No public exploit identified at time of analysis, though an upstream advisory (GHSA-c29c-2q9c-pc86) and VulnCheck writeup describe the flaw in detail.
Command injection in OpenClaw before 2026.5.18 allows authenticated attackers to modify shell wrapper argv between approval and execution, bypassing the allowlist enforcement. The TOCTOU-style race against the approval gate lets attackers execute unapproved command shapes with the application's privileges, with no public exploit identified at time of analysis but a vendor advisory published via GHSA.
Arbitrary code execution on OpenClaw Windows Node hosts before version 2026.7.1 is achievable by an attacker who already holds gateway or agent access to a node, because the system.run tool's environment-variable sanitizer maintains an incomplete denylist (CWE-184). The attacker supplies variables such as GIT_CONFIG_*, GIT_PAGER, DOTNET_STARTUP_HOOKS, or JAVA_TOOL_OPTIONS alongside a request that runs an allowlisted tool (git, dotnet, java), causing that otherwise-permitted tool to load and execute attacker-controlled code or commands when it is next invoked; this requires the attacker to pass the tool's own arguments unchanged, which is why the attack-complexity/attack-requirements component is elevated. Exploitation is not remote-unauthenticated-it presumes prior gateway or agent access (PR:L), it is Windows-only, and it depends on at least one of git, dotnet, or java being present and reachable through system.run. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released a fixed build.
OpenClaw Windows Node versions before 2026.7.1 allow an authenticated caller holding a gateway/agent session to escalate to arbitrary command execution on the Windows host by abusing the system.execApprovals.set capability. The rule validator fails to reject allow rules whose executable (first whitespace-delimited token) contains a wildcard, so patterns such as '*.*', '*.exe', '*e*' or 'c*' are accepted and effectively grant blanket approval that the default-deny policy would otherwise block; subsequent system.run calls then execute arbitrary programs - including the LOLBins mshta, rundll32 and certutil - with no operator check or user prompt. Exploitation requires an existing network connection to the gateway/agent interface (CVSS 4.0 PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.7), no public exploit code was identified at time of analysis, and the vendor has released a fixed version.
Memory exhaustion in OpenClaw Windows Node versions before 2026.7.1 lets a connected gateway peer crash the node process by streaming an unbounded sequence of WebSocket continuation frames that never set the EndOfMessage flag, driving limitless growth of the inbound message accumulation buffer until the process dies. The vulnerability is authenticated (CVSS PR:L) because the attacker must already hold a gateway session on the node's gateway WebSocket transport rather than merely reach an exposed port, and the impact is confined to availability - a process crash with no code execution, privilege escalation, or data exposure. No public exploit code has been identified at time of analysis, and the vendor has shipped 2026.7.1, which caps accumulated inbound messages at 32M UTF-16 characters and closes offending sockets with a MessageTooBig status.
Arbitrary command execution on Windows hosts is achievable through OpenClaw Windows Node versions prior to 2026.7.1, where the system.run exec-approval policy can be evaded by an authenticated connected gateway or agent holding the PR:L role. The ExecShellWrapperParser fails to split commands on pipe operators or extract command-substitution/subexpression syntax, so a denied command placed behind an allowed prefix (for example `benign | denied` or `echo $(denied)`) is never surfaced to the allow/deny ruleset and executes anyway; the failure only yields a bypass where a restrictive exec-approval policy is actually configured, and the impact is confined to Windows targets. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch 2026.7.1 is available.
Silent capture of screen contents, webcam images, and device geolocation is possible in OpenClaw Windows Node before 2026.7.1-3 because the NodeService capture handlers performed these operations without the one-time consent gate that screen.record and camera.clip already enforced. An attacker who is, or who controls, a gateway or agent already connected to the node's WebSocket interface can invoke screen.snapshot, camera.snap, and location.get to covertly screenshot the desktop, photograph the user, and read physical location - for camera.snap and location.get without even a user-visible indicator - requiring no interaction from the victim. This is a genuine but moderate-severity privacy vulnerability affecting only pre-2026.7.1-3 builds; authentication is required in the sense that the attacker must already hold node-agent/gateway connectivity (CVSS:4.0 PR:L), and no public exploit code was identified at time of analysis.
Coordinated abuse reporting in the self-hosted ClawHub application/backend lets four distinct ordinary authenticated accounts push any visible skill to moderationStatus: hidden with no moderator in the loop, silently removing it from the catalog - and official/vendor-published skills are not exempt. Because the reporter quota only counts reports filed against currently-visible targets, the same four accounts can recycle the trick against additional skills, so the effect is repeatable catalog suppression rather than a one-off. Exploitation requires only ordinary authenticated users (CVSS vector PR:L, no moderator or admin role) and coordinated multi-account control; no public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis. The vendor CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) is more severe than the independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, which correctly bounds the impact to catalog visibility (no data read, no code execution); affected deployments are self-hosted ClawHub at or before revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, while the npm CLI and OpenClaw runtime are separate products and are not affected.
Missing authorization enforcement in ClawHub's public skills:generateChangelogPreview action lets any signed-in caller preview the prior version of a skill they are not authorized to access, disclosing up to 8,000 characters of quarantined or otherwise restricted skill content per request. The issue is rated 7.1 (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N; independent CVSS 3.1 assessment 7.1 with confidentiality impact only) and requires nothing more than a valid ClawHub account - no user interaction, special network position, or non-default configuration - while impact is limited to reading content, with no integrity or availability effect. No public exploit code has been identified at time of analysis; the hosted clawhub.ai service was remediated by the 2026-09-11 deployment of revision 8c2de6c506bb, so realistic residual exposure is confined to self-hosted deployments built from revisions at or after cbfee7343ddc867316dd9b3de6fa8856730f9f41 and before that fix.
OS command execution on paired Chrome nodes is possible in OpenClaw 2026.5.1 through 2026.7.0 because the googlemeet.chrome node command accepts caller-supplied audio command arrays and runs them on the paired node without passing through the normal system.run exec-approval flow. An authenticated, tool-enabled agent (CVSS vector PR:L) that is permitted to invoke googlemeet.chrome - in a deployment where the Google Meet plugin is enabled, a Chrome node is paired, and googlemeet.chrome is on the allowed node commands list - can launch attacker-chosen processes on that node, with full confidentiality, integrity, and availability impact on the paired node (assessed CVSS 3.1 8.6; vendor CVSS 4.0 base 8.7). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the flaw is fixed in 2026.7.1, and removing googlemeet.chrome from allowed node commands or disabling the Google Meet plugin fully mitigates it.
OpenClaw (npm package openclaw) before 2026.7.1 misbinds Signal approval reactions to the wrong message, so a reaction an approver places on ordinary outbound text can be interpreted as approving or denying a structured host-action request that happens to be pending in the same conversation. Exploitation requires an authenticated participant acting as approver (PR:L), deliberate user interaction via a reaction (UI:P), and precise timing where unrelated outbound messages and a pending approval coexist (AC:H, AT:P), which is why the CVSS 4.0 base score is 7.5 rather than critical. The flaw does not grant any party new authority and does not change the legitimacy of correctly identified approvers; impact is bounded by whatever host actions the OpenClaw process is authorized to perform for the specific pending request. Vendor-released patch: 2026.7.1; no public exploit identified at time of analysis and the issue is not in CISA KEV.
A time-of-check time-of-use race condition in OpenClaw's OpenShell local mirror filesystem mutation operations (remove, mkdir, rename) before 2026.7.1 allows an authenticated local attacker to escape the sandbox and delete, create, or rename host filesystem paths outside the intended mirror root with the permissions of the OpenClaw process user. Exploitation requires winning a narrow timing race between the sandbox path-safety check and the actual operation, which is a non-trivial precondition, but it does not require the operator to have granted host filesystem access outside the sandbox, so default deployments are affected. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released a fix in version 2026.7.1.
Authorization bypass in OpenClaw before 2026.7.1 lets an authenticated but non-owner user run the '/mcp set' and '/mcp unset' commands to persist arbitrary stdio MCP server entries, which OpenClaw then executes with its own process privileges the next time it loads its MCP configuration - giving the attacker full impact on host confidentiality, integrity, and availability (assessed CVSS:3.1 base 8.7, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a missing-authorization issue (CWE-862) exploitable only where more than one principal shares an OpenClaw instance, with execution deferred to the subsequent config-load event. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and impact is confined to versions prior to 2026.7.1.
Information disclosure in OpenClaw before 2026.7.1 allows authenticated non-owner channel senders to retrieve owner-only host diagnostic bundles through the diagnostics export command, exposing host, configuration, runtime, and connected-service details. The flaw is an authorization bypass (CWE-200) that requires low privileges (a connected channel sender) and causes no integrity or availability impact; no public exploit code is identified at time of analysis.
An authorization bypass in the /export-trajectory endpoint of OpenClaw before 2026.7.1 lets a non-owner account retrieve trajectory bundles that should be restricted to the session owner. A remote attacker who holds any valid low-privilege credentials on the instance (PR:L, not anonymous) can request a session they do not own and receive its exported bundle, exposing prompts, model messages, tool schemas, runtime events, and local path metadata; the effect is disclosure only, with no integrity or availability impact (VC:H, VI:N, VA:N). No public exploit code has been identified at time of analysis, and the vulnerability is not listed as actively exploited, though the high EPSS-equivalent exposure of a network-reachable, low-complexity bypass makes prompt remediation to 2026.7.1 advisable.
OpenClaw deployments before 2026.7.1 contain an authorization-bypass flaw in the browser tool that lets a sandboxed session reach a paired host node's browser actions even when allowHostControl=false is set, so an attacker who can steer sandboxed agent input (e.g., via untrusted content or prompt injection) can inspect or manipulate the connected browser profile and its authenticated state. The issue affects remote, low-privilege, unauthenticated-at-the-network sandbox input paths (CVSS 8.7, vector PR:L/UI:N), and there is no public exploit identified at time of analysis; risk is concentrated in deployments that actually pair a host browser and feed untrusted content into the sandbox.
Authorization bypass in OpenClaw (npm package 'openclaw') before 2026.7.1 lets a low-privilege, write-scoped caller reach browser-control functionality through the node.invoke code path even though the equivalent direct browser.request path correctly enforces administrator scope. The issue only affects Gateway deployments that honor caller identity and narrower operator scopes, and it requires the attacker to already hold a valid write-scoped credential plus access to a connected browser-capable node; deployments using OpenClaw's shared-secret token or password trusted-operator model are not affected. A successful exploit allows the caller to inspect pages, navigate tabs, and interact with browser-visible applications without the configured admin requirement, with realized impact bounded by the target browser profile and its signed-in state; no public exploit code or confirmed active exploitation was identified at time of analysis.
Broken authorization in OpenClaw before version 2026.7.1 lets a non-owner channel sender invoke the Codex computer-use installation command to install arbitrary plugins and spawn MCP (Model Context Protocol) processes with the privileges of the OpenClaw service user. The assessed vector (CVSS 4.0 base 8.7; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires only that the attacker be able to send messages into an OpenClaw channel, with no user interaction from the legitimate owner, yielding full confidentiality, integrity, and availability impact on the host. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the risk is nonetheless high because the missing check converts ordinary channel participation into remote code execution in the OpenClaw user's context.
OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization for native conversation bindings, allowing a non-owner channel sender who already holds command access to bind to the Codex runtime and execute host-capable turns with access to files, tools, and processes. This privilege escalation (CWE-269) has a CVSS 4.0 score of 8.7 (High) and is network-reachable with low complexity and low privileges, but it requires the attacker to already have command access on a channel-a fully external attacker cannot trigger it. No public exploit code or active exploitation was identified at time of analysis.
Authorization bypass in the npm package `openclaw` (OpenClaw) before version 2026.7.1 allows an already-authorized non-owner channel sender who holds channel command access to approve or deny Claude Code permission prompts that were meant for the owner, causing the pending action to proceed without owner consent. The severity of any given exploitation is bounded by what the specific Claude Code run requested - the attacker can only green-light capabilities the host run had already queued, so impact ranges from low-risk operations up to high-impact host actions depending on context. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited; the vendor-released fix is version 2026.7.1.
Channel read allowlist bypass in the OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 lets a low-privilege sender or a steered/prompt-injected agent pull messages, reactions, pins, member lists, and related metadata out of channels and rooms that the operator's read policy was intended to exclude. Exploitation is unauthenticated at the network layer but requires an existing low-privilege channel read capability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and it only matters where a restrictive read allowlist is actually configured - default open policies expose nothing new. Exposure is further bounded by the permissions held by the connected bot account, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor fixed the issue in 2026.8.1.
OpenClaw (npm package 'openclaw') before 2026.7.1 lets an actor who can steer a tool-enabled agent create a persistent cron job that runs attacker-chosen commands with the privileges of the OpenClaw process user. A mixed-case payload 'kind' value slips past the agent-facing shell-execution guard and later normalizes into a command job, targeting the model-facing cron tool only. The vendor scores this 8.7 (High) on CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and the vendor-released patch is 2026.7.1; no public exploit identified at time of analysis.
Authorization bypass in OpenClaw before 2026.7.1 allows a write-scoped caller in identity-bearing Gateway deployments to spoof another sender's identifier in message.action requests and invoke a channel action under that requester identity, reaching operations the channel adapter would have denied to the real caller. Exploitation requires a valid low-privilege (write-scoped) credential, an authentication mode that honors caller identity (shared-secret token and password callers are explicitly out of scope), and at least one enabled channel action that relies on requester identity; practical impact is bounded by the enabled channel, the action invoked, and the target account's permissions. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the vendor-released fix is version 2026.7.1.
OpenClaw Gateway before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint, allowing an authenticated write-scoped non-owner caller to cause the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. This privilege escalation (CWE-269) affects Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, and where agent tool policies include the `gateway` and `cron` tools; shared-secret token and password callers are treated as fully trusted and are out of scope. No public exploit code identified at time of analysis; the vendor CVSS 4.0 score is 7.2 with integrity impact dominant.
OpenClaw Slack deployments before 2026.8.1 fail to enforce configured sender allowlists inside multi-person (group) direct messages, allowing an authenticated Slack workspace user who was deliberately excluded from the allowlist to invoke the Slack agent and reach every tool and data source that agent has been granted. Because the bypass is confined to group DMs rather than 1:1 conversations, any excluded participant who shares a multi-person DM with the agent can trigger it without victim-side interaction; the practical blast radius depends entirely on the agent's privileges, ranging from data disclosure on a read-only agent to full command/write capability on a more powerful one. The vendor rates this 8.7 (CVSS 4.0, AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity and availability impact), an assessment our independent review considers broadly defensible for the mechanics; no public exploit code and no confirmed active exploitation were identified at time of analysis, though EPSS and KEV data were not provided.
Server-side request forgery in OpenClaw (npm package 'openclaw') before 2026.8.1 lets an attacker who can influence DNS for an already-allowlisted hostname bypass the trusted-host destination validation and reach a service bound only to loopback, disclosing that service's response. Exploitation is highly conditional and high-complexity: the fetch must go through the trusted-host DNS recheck path, the hostname must already be on the trusted-host allowlist, the attacker must be able to make it resolve to an unspecified address (0.0.0.0 or ::), and a loopback-bound service must actually exist and return useful data - impact is confidentiality-only. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor shipped a fix in 2026.8.1.
OpenClaw npm package versions 2026.3.28 through 2026.8.0 can be coerced into executing attacker-supplied Python code when an operator opens OpenClaw against an untrusted workspace whose .env file sets CLOUDSDK_PYTHON_ARGS and then runs the Gmail setup flow. The poisoned value is inherited by the gcloud launcher, which forwards it as arguments to the trusted Python interpreter, giving the attacker code execution with the OpenClaw host user's permissions - enough to read credentials, modify files, or spawn further processes. The issue is rated 8.5 (CVSS 4.0 AV:L/AC:L/AT:N/PR:N/UI:P; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is fully local and interaction-dependent: the malicious workspace content must already be present and the operator must both launch OpenClaw on it and actively trigger Gmail setup, so it cannot be fired remotely or unattended; no public exploit code was identified at time of analysis. Version 2026.8.1 fixes the flaw.
Improper access control in OpenClaw versions before 2026.8.1 allows a model-visible agent caller to read and force-run operator-authored command cron jobs that lack proper owner binding. By reaching the agent's caller surface with at least low-level access, an attacker can disclose environment variables stored in those jobs and trigger disabled or unscheduled command jobs, exposing embedded secrets and executing commands the operator authored. The flaw carries a vendor CVSS 4.0 score of 8.7 (PR:L, network reachable) and a CWE-200 information-exposure classification; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is elevated but not confirmed as actively exploited.
Server-side request forgery in OpenClaw (npm package 'openclaw') versions 2026.4.5 through before 2026.8.1 lets an attacker who controls an approved remote Chrome DevTools Protocol (CDP) hostname, or its DNS answers, use DNS rebinding to steer the Gateway into connecting to SSRF-denied destinations such as loopback, private, link-local, or cloud metadata addresses. The flaw is a check-then-use (TOCTOU) gap: the Gateway validates and pins DNS at configuration time, but the raw WebSocket and Playwright transports independently re-resolve the hostname when the connection is actually made, discarding the pin. Per the CVSS:3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) exploitation is unauthenticated but requires a non-default, operator-configured hostname-based remote CDP endpoint plus a successful rebinding race, so impact is bounded by the internal services reachable from the Gateway host; no public exploit is identified at time of analysis and CISA KEV does not list this issue.
Command-execution approval bypass in the OpenClaw agent runtime (npm package 'openclaw') versions 2026.3.22 up to but not including 2026.8.1 lets an attacker piggyback on a previously approved command wrapper to run arbitrary commands with the OpenClaw process's host privileges, without triggering a new approval prompt; the vendor rates this 8.6 and our independent assessment places it at CVSS 3.1 8.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation is gated by two preconditions. An authenticated operator must first have allowlisted or permanently approved a specific wrapper invocation, and that wrapper (a transparent shell carrier, or an opaque utility such as a process monitor, tracer, namespace tool, or proxy wrapper) must resolve on the host; a later agent turn can then substitute an arbitrary inner command in the wrapper's arguments and have it executed under the host privileges of the OpenClaw process. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the issue is fully remediated by upgrading to 2026.8.1.
Authorization bypass in OpenClaw before 2026.8.1 lets an attacker reuse an already-approved executable with different arguments, so commands execute without a new approval prompt. The root of the flaw is that 'Allow Always' approvals granted for an exact command are persisted on macOS and Linux as path-only grants, meaning any later invocation of that same binary silently inherits the earlier approval. Exploitation is conditionally gated: an operator must first have granted Allow Always for at least one command, and the attacker must then steer the agent into invoking that binary with attacker-chosen arguments (typically via prompt or content injection), which is reflected in the high attack complexity and user-interaction metrics of the assessed vector rather than a pre-auth internet-facing entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Command injection in OpenClaw versions before 2026.8.1 lets an attacker who can supply command input to an agent turn slip hidden commands past the exec allowlist: escaped newlines desynchronize the allowlist parser, which validates only the visible portion of the input while the appended command executes without the expected authorization prompt. Successful exploitation yields full code execution on the host (VC:H/VI:H/VA:H, CVSS 4.0 base 8.6; independently assessed as CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), though it requires the operator to be actively driving the affected agent turn (UI:P) and the attacker to already hold a low-privilege position on the command-input surface (PR:L). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but the allowlist-bypass nature of the bug means any environment relying on the exec allowlist as its execution boundary should treat this as high priority.
Resource exhaustion in the OpenClaw Gateway listener affects every OpenClaw release before 2026.8.1 and lets unauthenticated remote attackers open WebSocket upgrade requests that retain response sockets without matching connection semantics; repeated malformed upgrade requests drain listener capacity until the service becomes unavailable (CVSS 4.0 8.7, availability-only; independent assessment rates A:H with PR:N/UI:N). Because those requests sidestep the product's WebSocket pre-auth connection budget, the built-in connection limiting does not throttle the flood, and the only prerequisites are network reachability to the Gateway listener - no credentials and no user interaction. No public exploit code has been identified at time of analysis, and impact is confined to availability, with no data disclosure or code execution reported.
Authorization bypass in OpenClaw versions before 2026.8.1 lets an authenticated, low-privileged sender who is permitted to invoke skill commands reach owner-only tools and owner-reserved server credentials, because skill tool dispatch does not propagate the sender's owner status into the tool authorization decision. Exploitation requires only the PR:L prerequisite defined by the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, base 8.7) - no owner credentials and no user interaction - and yields high confidentiality and integrity impact with limited availability impact, so the practical exposure is confined to multi-sender or multi-tenant OpenClaw deployments in which non-owner principals have been granted skill-command access; single-owner or no-external-sender deployments are not exposed. No public exploit identified at time of analysis, and this CVE is not reported as confirmed actively exploited (CISA KEV); a vendor security advisory (GHSA-7cp7-87pj-p32v) and a VulnCheck advisory are available, and the fixed release is 2026.8.1.
Server-side request forgery in OpenClaw Gateway (npm-distributed, versions 2026.7.1 through 2026.8.0) lets an authenticated, write-scoped caller abuse Synology Chat attachment delivery: the Gateway validates a single DNS lookup for a supplied file URL but then hands the original hostname to the Synology NAS, which resolves it independently and can be steered to a private or policy-denied resource whose contents are returned to the addressed conversation. Reaching that outcome requires remote URL attachment forwarding to be enabled, the Gateway to accept a remotely-influenced hostname, and the attacker to win a DNS rebinding race against the NAS's own resolution, so practical impact hinges on NAS routing, resolver behavior, and whether a useful response exists at the private destination; no public exploit code has been identified at time of analysis. The vendor CVSS 4.0 rating is 7.1 (HIGH), but our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, arguing for a lower real-world priority given the non-default feature-specific pathway, the PR:L authentication requirement, and the narrow affected window that is closed by upgrading to 2026.8.1.
OpenClaw before 2026.8.1 fails to enforce per-chat tool policies for Codex app-server runtime tools, allowing an authenticated participant (PR:L) in a lower-trust conversation to bypass a tools.allow allowlist and reach native shell, process, file, and patch tools. The vendor-assigned CVSS 4.0 score is 8.7, and the practical impact depends on the Codex runtime's host permissions and sandbox configuration; the issue is fixed in 2026.8.1. No public exploit identified at time of analysis.
Credential theft in OpenClaw for iOS (versions >= 2026.7.1 and < 2026.8.11) lets a man-in-the-middle attacker who redirects the same Gateway host and port and presents a certificate that passes iOS system trust capture the injected Gateway token or password from the authenticated Terminal and session Dashboard WebViews, which - unlike native connections - failed to enforce the saved Gateway TLS fingerprint. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. No public exploit has been identified at time of analysis, and exploitation requires a prior accepted Gateway fingerprint, a network-adjacent MITM position, a validly trusted certificate for the host, and the victim opening the affected WebView, which substantially limits realistic risk to targeted adversaries despite the vendor's Critical 9.0 CVSS 4.0 rating.
Authorization bypass in the @openclaw/voice-call package before version 2026.8.1 lets a remote caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) drive the agent's owner-only tools, because the caller's identity and non-owner status are not propagated on classic inbound voice calls. The owner-only tool filter therefore fails open, allowing data reads, file modification, command execution, or control of connected services depending on how the agent is provisioned. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 4.0 base 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis. Deployments with inbound calling disabled, or whose allowlist excludes the attacker, are not affected.
OpenClaw (npm package 'openclaw') versions before 2026.8.1 leak deterministic hashes computed over the original, unredacted configuration inside responses to redacted configuration requests, so a caller who can invoke operations such as config.get can perform offline password-candidate testing instead of going through the rate-limited Gateway authentication endpoint. Exploitation is conditional: the attacker must already hold an authenticated, low-privileged session able to retrieve the redacted config, the Gateway password must have low entropy, and the remaining non-redacted configuration values must be reconstructable enough to compute candidate hashes - high-entropy passwords defeat the attack entirely and secret references are not exposed by the flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and recovery of the password would grant the documented shared-secret operator authority, which explains the High confidentiality, integrity and availability impact rating.
Authorization bypass in OpenClaw's Matrix integration (@openclaw/matrix) allows an authenticated Matrix participant to inherit another account's authority when their user identifier collides after case/Unicode folding. Versions 2026.2.2 through 2026.8.0 lowercase the complete Matrix user ID - including the case-sensitive server-name portion and historical localparts - before deriving the OpenClaw authorization identity, so an attacker controlling a protocol-valid, fold-equivalent identifier (display-name matching is not required) can gain allowlist, owner-command, exec-approval, or plugin-approval rights configured for the privileged account. The vendor rates this CVSS 7.7 with high confidentiality, integrity, and availability impact; real-world risk is moderate and gated by the attacker needing a valid authenticated Matrix account plus a registrable colliding identifier, and no public exploit identified at time of analysis.
Incorrect authorization in OpenClaw Feishu before 2026.8.1 allows an authenticated attacker who can already invoke the agent's model tool operations to act through a default account that the operator has disabled, because the account-selection logic never checks the disabled flag before using that account's still-stored Feishu credentials. Successful exploitation lets the attacker read or modify Feishu resources under a revoked identity, yielding high confidentiality and integrity impact (CVSS 4.0 base 7.6; assessed CVSS 3.1 7.6 with AV:N/AC:H/PR:L/UI:N/C:H/I:H/A:N by our analysis). Exploitation is conditional and non-default: it requires a multi-account configuration where the default account is disabled yet its credentials remain valid, plus pre-existing low-privilege access to the OpenClaw agent, so it is not reachable by an anonymous remote attacker against a default install; no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Local file disclosure in OpenClaw (npm package 'openclaw') before 2026.8.1 allows an authenticated, already-admitted requester to read arbitrary known local host files even when that sender's identity has been explicitly denied filesystem read tools through the global or per-agent toolsBySender policy. The bypass occurs because outbound attachment handling - via a final-response media directive or a message attachment - does not re-apply the originating sender's policy, so a denied sender can still have a known local file read and returned to an admitted requester whose agent turn never included the read tool. Exploitation requires the attacker to already be admitted to the agent, to know or derive a useful host path, and to reach a delivery flow that accepts local attachments; impact is read-only disclosure of file contents with no integrity or availability effect, and no public exploit code has been identified at time of analysis.
Sensitive local file disclosure in OpenClaw before 2026.8.1 lets a low-privileged caller (PR:L per the CVSS vector, not fully anonymous) smuggle an unvalidated absolute host path past sandbox path validation by supplying structured message attachments that carry multiple 'source' fields, hiding the disallowed path behind an allowed attachment source. When the Telegram delivery channel is configured and active, the agent then reads the referenced host file and relays it out through that channel, giving the attacker high-confidentiality read access to files that policy would otherwise reject. There is no code execution, file modification, or denial of service; EPSS and KEV data are not provided, and no public exploit code has been identified at time of analysis. The vendor has released a fix, and exploitation requires both a message-submission-capable attacker and an OpenClaw deployment that uses Telegram delivery.
Privilege escalation in the OpenClaw npm package (versions >= 2026.4.5 and < 2026.8.1) allows a restricted external sender to have its session-derived text persisted into shared session memory and later replayed to an unattended background 'dreaming' agent that holds broader file and command privileges, producing actions beyond the authority of the original turn. The flaw is only reachable in deployments where session-memory capture and the dreaming agent are both enabled and the background agent is provisioned with more capability than the originating turn, and the exploit chain additionally depends on the content being selected for later processing and then actually followed by the model. No public exploit identified at time of analysis; vendor has released a fix in OpenClaw 2026.8.1, and the vendor-assigned CVSS 4.0 score is 7.7.
Authenticated non-owner senders can abuse the generic channel-tool path in the @openclaw/whatsapp plugin (npm, versions before 2026.8.1) to force a WhatsApp login for a configured Gateway account, issuing a fresh QR code that disconnects the existing session and causes loss of availability; integrity impact is limited because full account relinking still requires the attacker to physically scan the returned QR code with another phone. The flaw is a missing authorization check on an owner-only tool boundary (CWE-862) rather than a bypass of WhatsApp transport authentication, and it requires PR:L - an attacker who has already been admitted to a channel and can steer the agent. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 2026.8.1.
An authenticated attacker with low privileges can exploit an authorization bypass in the @openclaw/slack npm package (versions before 2026.8.1) to download file contents from Slack conversations outside their permitted scope, resulting in cross-boundary data disclosure. The flaw is an IDOR-class (CWE-639) issue where the conversation-authorization check fails open when a file lacks the share metadata normally used to prove conversation membership. No public exploit code or active exploitation has been identified, and the issue does not bypass Slack's own authentication or allow file enumeration. Vendor patch 2026.8.1 is available.
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'allow-always' exec approval to execute the same command against unreviewed files or repositories, escaping the original approved working directory. Exploitation requires a pre-existing 'allow-always' approval and the ability to influence agent behavior; it is not exploitable on a default installation with no standing approvals. No public exploit identified at time of analysis.
Authorization scope widening in OpenClaw before 2026.8.1 allows an authenticated low-privilege sender to reuse a standing 'allow-always' file-transfer approval and reach file paths or nodes that the operator never reviewed, resulting in unauthorized file read and write (C:H/I:H, no availability impact) within whatever the agent's file-transfer capability can touch. Exploitation is conditional: it requires a previously granted allow-always approval, an already-admitted sender who can steer the agent (PR:L/UI:P), and successful abuse of glob metacharacter interpretation or node display-name reuse to resolve the grant to sibling paths or a different node (AC:H/AT:P), so it is not reliably automatable and there is no prior grant to widen otherwise. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; a vendor patch is available in OpenClaw 2026.8.1.
OpenClaw iOS builds before 2026.8.11 write complete agent deep-link URLs - including persistent bearer keys - into the iOS unified log with public diagnostic visibility, so anyone who obtains a diagnostic archive (sysdiagnose bundle, device backup, or MDM-collected log set) can recover those keys and replay them inside forged deep links to submit agent requests without the normal on-device confirmation prompt. Exploitation is local and conditional rather than remote: the recovered bearer key must still be unrotated and valid at replay time, and the attacker must reconstruct a working forged deep link, which is why the assessed vector carries AV:L/AC:H (CVSS:3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). The status of this issue is that of a genuine but constrained credential-exposure flaw - no public exploit identified at time of analysis, no confirmed actively exploited (CISA KEV) activity, and a vendor patch shipping in 2026.8.11.
Authorization bypass in OpenClaw before 2026.5.18 lets a low-trust, authenticated caller escape the exec allowlist by abusing weak glob matching, executing or persisting actions beyond their intended authorization. Reported by VulnCheck and tracked as a path-traversal-class flaw (CWE-22), it carries a CVSS 4.0 score of 7.7 with high confidentiality, integrity, and availability impact but requires the affected exec feature to be enabled. No public exploit identified at time of analysis; there is a GitHub security advisory and a corresponding VulnCheck advisory.
Authorization bypass in OpenClaw before 2026.6.5 lets a low-trust, authenticated caller execute node exec actions beyond their approved permissions by exploiting mismatched gateway and node environment configurations. The flaw (CWE-863, Incorrect Authorization) enables privilege escalation within the approval workflow and can be used to persist or run unauthorized actions. Reported by VulnCheck with a CVSS 4.0 base of 7.7; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in OpenClaw before 2026.5.18 lets low-privileged, authenticated callers escalate their actions through the device-pair approval feature, executing or persisting operations beyond their intended trust level. The flaw stems from improper authorization checks (CWE-863) on device-pairing input paths, and per the CVSS 4.0 vector it fully compromises confidentiality, integrity, and availability of the affected system. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Untrusted plugin loading in OpenClaw before 2026.5.22 lets an attacker with lower-trust caller access, or control over configured input paths, get malicious workspace plugins loaded through the setup-mode discovery process, executing or persisting actions above their intended authorization level. Exploitation is local and requires active user interaction plus a specific attack precondition (CVSS 4.0 base 7.1), and there is no public exploit identified at time of analysis. The root cause is inclusion of functionality from an untrusted control sphere (CWE-829) during setup-mode plugin discovery.
Authorization bypass in OpenClaw versions 2026.1.20 through 2026.5.26 allows low-trust, authenticated callers to invoke the device.pair.approve feature and perform device-pairing approvals that should require stronger role-management authorization. Because the feature can be reached through configured input paths, an attacker holding only limited privileges can escalate their effective authority over device pairing, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 8.7.
Privilege escalation via authorization bypass in OpenClaw's QQBot exec approvals feature affects builds from 2026.5.14-beta.1 up to (but not including) 2026.5.27, letting a lower-trust or non-allowlisted sender execute or persist actions beyond their intended authorization. The CVSS 4.0 vector requires low existing privileges (PR:L) and a present attack requirement (AT:P), meaning the exec approvals feature must be enabled and reachable for exploitation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a fixed release (2026.5.27) and a vendor security advisory are available.
Authorization bypass in OpenClaw's ClickClack agent-mode dispatch (versions 2026.5.10-beta.1 through 2026.6.4) allows a lower-trust caller to invoke actions that should be blocked by the toolsAllow policy, because that policy check can be skipped during dispatch. With CVSS PR:L, an already low-privileged authenticated caller (or an attacker-controlled input path) can escalate the scope of actions when the agent-mode feature is enabled and reachable. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed in 2026.6.5.
Authorization bypass in OpenClaw before 2026.6.5 lets a low-privileged, authenticated caller reach admin-scoped tools and perform privileged actions they should not be authorized for. The flaw stems from insufficient policy checks on configured input paths (CWE-862, Missing Authorization), so a lower-trust principal can escalate the scope of operations available to it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported by VulnCheck with a CVSS 4.0 base score of 7.7.
Privilege escalation and unauthorized action execution in OpenClaw before 2026.6.6 arises from incomplete environment-variable filtering in its host exec path, which fails to strip rustup startup variables before spawning processes. A low-privilege caller (PR:L) with access to lower-trust invocation paths or configured input paths can influence the child process environment to run or persist actions above their intended authorization level, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in OpenClaw's isolated cron job feature (versions 2026.6.1 through 2026.6.8) lets a lower-trust authenticated caller reclaim execution tools that authorization policy had explicitly denied, enabling actions and persistence beyond their intended trust level. The flaw is an incorrect-authorization (CWE-863) issue rooted in misconfigured input path handling within the cron subsystem, and carries a CVSS 4.0 score of 7.7. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in OpenClaw before 2026.6.1 lets a lower-trust authenticated caller abuse Git 'ext' transport through incomplete host-exec environment filtering to execute or persist actions beyond their intended privileges. VulnCheck reported and characterizes it as an authentication bypass via Git ext transport, and a GitHub Security Advisory (GHSA-9969-8g9h-rxwm) is published; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact reachable over the network with only low privileges.
Authorization bypass in OpenClaw before 2026.6.6 lets a low-privileged caller inject crafted interpreter startup environment variables through the host exec feature, executing or persisting actions beyond their intended authorization. The flaw stems from incomplete environment-variable filtering (CWE-184) that overlooks interpreter startup variables, and per its CVSS 4.0 vector (VC:H/VI:H/VA:H) yields high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; the issue is reported by VulnCheck and fixed in 2026.6.6.
Authorization bypass in OpenClaw (versions 2026.3.22 up to but not including 2026.6.6) lets a lower-trust WhatsApp sender satisfy elevated sender allowlists because WhatsApp group IDs are accepted as if they were privileged individual sender identities. An authenticated but low-privilege attacker can therefore invoke actions gated behind stronger authorization, effectively escalating privilege within the messaging integration. Reported by VulnCheck with a CVSS 4.0 base score of 8.7 (high); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in OpenClaw 2026.5.20 through 2026.6.5 lets a low-privilege caller invoke owner-only tools through the MCP loopback feature, escalating beyond intended permissions to execute or persist privileged actions. The flaw stems from incorrect permission enforcement (CWE-732) on configured input paths reachable over the network. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in OpenClaw 2026.5.20 through 2026.6.8 lets an already-authenticated, lower-trust caller abuse the plugin install command path to execute or persist actions beyond their intended authorization. The root cause is an incorrect permission assignment (CWE-732) on plugin installation, and the CVSS 4.0 vector (PR:L, UI:N, AV:N) shows a low-privileged remote actor can achieve high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the CVE is not in CISA KEV, but a GitHub Security Advisory (GHSA-7vrr-rp4x-4g76) and a VulnCheck advisory document it.
Privilege-boundary bypass in OpenClaw's Discord guild-action handling (versions 2026.6.6 up to but not including 2026.6.9) lets a low-privilege authenticated caller invoke operations that should require stronger authorization. By abusing misconfigured input paths, the attacker skips the cross-provider requester authorization step and executes restricted guild operations. No public exploit identified at time of analysis; the CVSS 4.0 score of 7.2 reflects high integrity and availability impact with no confidentiality exposure.
Privilege escalation via authorization bypass in OpenClaw 2026.6.6 through 2026.6.8 allows a low-privileged, authenticated caller to invoke message-mutation operations that should require stronger authorization, letting them execute privileged actions. The flaw is a missing authorization check (CWE-862) on mutation input paths and requires the affected feature to be enabled and reachable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authorization bypass in OpenClaw before 2026.6.9 lets a lower-trust caller escape the exec-approval trust boundary through the flock wrapper, executing or persisting privileged actions the caller was never authorized to perform. The CVSS 4.0 vector (PR:L) indicates an authenticated but low-privilege actor can achieve high confidentiality, integrity, and availability impact when the affected feature is enabled. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-3fp5-v549-9v66); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass via symlink following in OpenClaw's mirror sync feature (versions before 2026.6.9) lets a lower-privilege caller escalate into actions that should require stronger authorization. By planting or referencing symlink parents on a remote mirror target, an authenticated attacker can trick the sync logic into resolving links that cross policy and trust boundaries, yielding high confidentiality and integrity impact. There is no public exploit identified at time of analysis and no CISA KEV listing; no EPSS score was supplied.
Privilege escalation via broken authorization in the OpenClaw @openclaw/feishu integration (versions 2026.6.6 and earlier) allows a lower-trust, already-authenticated caller to invoke Feishu permission tools that should have been blocked by per-account disablement settings. Because the enforcement gap lets a low-privilege actor perform actions requiring stronger authorization, the flaw carries high confidentiality and integrity impact (CVSS 4.0 base 8.6). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authorization bypass in the @openclaw/feishu npm package (versions <= 2026.6.6) allows a lower-trust caller - or attacker-influenced input reaching a configured input path - to perform Feishu (Lark) actions that should have required stronger authorization, because per-account disablement can be ignored. Authenticated remote attackers can trigger unauthorized operations affecting confidentiality and integrity; no public exploit has been identified at time of analysis, and the flaw is fixed in version 2026.6.9. Real-world impact is gated by the operator's configuration and whether untrusted input can reach the affected feature.
Privilege escalation in OpenClaw before 2026.6.8 lets a lower-trust, already-authenticated caller invoke admin-restricted operations by abusing OpenAI-compatible HTTP model-override input paths, bypassing the authorization checks that should gate those actions. The flaw was reported by VulnCheck and stems from missing authorization (CWE-862) on override-driven request handling. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Credential exposure in OpenClaw before 2026.5.28 lets a lower-trust actor who can write to a workspace's configured input paths plant a dotenv file that overrides trusted provider credentials, causing sensitive secrets to leak across intended trust boundaries. VulnCheck reported the issue and it is fixed in 2026.5.28; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor CVSS 4.0 base score is 8.4 (High), reflecting high confidentiality and integrity impact but requiring local path access and user interaction.
Allowlist bypass in OpenClaw versions prior to 2026.5.12 allows authenticated operators to execute unapproved shell commands by routing requests through inline-command parser cases that skip the expected allowlist enforcement. The flaw, reported by VulnCheck and tracked under GHSA-f397-5vjw-v2c2, effectively neutralizes the operator-approval boundary in OpenClaw's shell command path. No public exploit identified at time of analysis, and the CVSS 4.0 score of 7.6 reflects high confidentiality and integrity impact with a present attack requirement.
Untrusted search path execution in OpenClaw before 2026.5.2 allows a local low-privileged user to coerce maintenance task routines into invoking attacker-controlled executables in place of the intended trash command. By manipulating workspace-derived environment paths consumed during maintenance operations, an authenticated user can hijack command resolution and run arbitrary binaries in the OpenClaw process context. No public exploit identified at time of analysis, but VulnCheck has published a dedicated advisory describing the workspace-derived service path abuse.
Environment variable sanitization weakness in OpenClaw prior to 2026.5.26 lets attackers smuggle Node.js control variables (such as NODE_OPTIONS) past the host environment sanitizer, enabling them to influence child-process behavior and coverage output paths. Affected attackers must have write access to workspace .env files, tool environment overrides, or skill environment blocks, and no public exploit is identified at time of analysis. The flaw was reported by VulnCheck and is tracked under CWE-184 (Incomplete List of Disallowed Inputs).
Untrusted search path in OpenClaw before 2026.5.2 allows local attackers who can influence a workspace .env file to redirect bundled runtime dependency loading to attacker-controlled paths, resulting in arbitrary code execution during dependency resolution. The STATE_DIRECTORY environment variable is not validated before being used to anchor runtime dependency roots, so a poisoned workspace can execute code in the context of a user who opens it. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses intended for other Zalo identities by manipulating their mutable display name to match allowFrom policy entries. The flaw stems from policy enforcement relying on mutable display metadata rather than immutable identifiers, and no public exploit has been identified at time of analysis.
Allowlist bypass in OpenClaw before 2026.4.2 lets authenticated operators smuggle inline-eval content through shell positional parameters, defeating the strict allowlist that is meant to constrain which tools and content the shell carrier executes. Successful abuse yields execution of unapproved shell-provided content with high confidentiality and integrity impact, and no public exploit has been identified at time of analysis.
Allowlist bypass in OpenClaw before 2026.5.12 lets authenticated attackers invoke approved executables with arbitrary arguments on Linux and macOS, defeating the argPattern restrictions intended to constrain each binary's permitted invocations. The flaw enables disallowed file access, network access, or command execution under the privileges of the OpenClaw exec subsystem, with no public exploit identified at time of analysis.
Privilege escalation in OpenClaw before 2026.5.7 allows any user with a Discord account to assume the identity of a privileged Discord user authorized in the agent's allowFrom policy by simply renaming their account, because the access-control check matches on mutable display names rather than immutable Discord user IDs (snowflakes). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but exploitation is trivial for anyone who can read the target policy.
Untrusted search path in OpenClaw versions prior to 2026.4.29 lets workspace-local .env files override the npm_execpath variable consulted by the install helper, redirecting bundled dependency installation to an attacker-controlled package-manager binary. An attacker who can place files in the workspace can hijack the runtime dependency setup step to compromise the build environment under the developer's identity, with no public exploit identified at time of analysis.
Authorization bypass in OpenClaw before 2026.5.26 allows an attacker with a previously paired device to re-establish WebSocket node-level authority after the session has been revoked, effectively defeating the revocation control. The flaw stems from a surviving pairing-scoped device session that can mint new node tokens without renewed approval, letting authenticated attackers retain unauthorized node-level access longer than intended. No public exploit identified at time of analysis, but the issue is acknowledged in a GitHub Security Advisory (GHSA-q99w-vh6v-q3v7) and a VulnCheck advisory.
Arbitrary Python runtime execution in OpenClaw before 2026.5.2 lets an attacker with write access to the workspace plant a malicious .env file that overrides the CLOUDSDK_PYTHON variable used during Gmail setup, redirecting gcloud invocations to an attacker-controlled Python interpreter and leading to code execution. The CVSS 4.0 vector (AV:L/AT:P/UI:A) confirms the attack is local, requires a specific attack condition, and depends on a user/operator action - no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in OpenClaw before 2026.5.12 allows authenticated operators to bypass the PowerShell execution allowlist by submitting encoded-command flag aliases (abbreviated forms) that the allowlist parser fails to recognize. The flaw enables execution of arbitrary PowerShell payloads with full confidentiality, integrity, and availability impact on the host. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authorization bypass in OpenClaw's QQBot component before version 2026.4.27 allows authenticated senders to invoke slash commands before allowFrom policy checks execute, effectively skipping operator-configured access controls. The flaw stems from pre-dispatch command handling that runs prior to policy enforcement, enabling blocked senders to trigger command handlers depending on deployment configuration. No public exploit identified at time of analysis, and CVSS 4.0 scoring of 8.2 reflects high integrity impact with an attack requirement (AT:P) suggesting non-trivial conditions.
Identity header forgery in OpenClaw before 2026.5.18 allows local same-host callers with access to the proxy-facing Gateway port to spoof trusted-proxy identity headers and assume operator identity. The flaw stems from missing validation of headers normally set by an upstream trusted proxy, enabling privilege escalation when the Gateway port is reachable locally. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure in OpenClaw before 2026.5.18 lets authenticated operators abuse shell metacharacter expansion within the system.run safe-bin allowlist to read unintended node-local files on POSIX nodes and exfiltrate sensitive configuration data. The flaw bypasses command-policy enforcement because the allowlist validates a literal command string while the underlying shell re-interprets it at execution time. No public exploit identified at time of analysis.
Command approval bypass in OpenClaw versions prior to 2026.5.18 allows authenticated users to smuggle malicious instructions past human approvers by exploiting how the approval UI truncates oversized exec commands. The flaw (CWE-451, UI misrepresentation) lets an attacker craft a request with a benign-looking prefix while a malicious suffix is hidden from the reviewer's display, resulting in unauthorized execution once the request is approved. No public exploit identified at time of analysis and the CVE is not currently listed in CISA KEV.
Authorization bypass in OpenClaw before 2026.5.6 allows authenticated senders to invoke owner-only native commands without satisfying the configured owner-command policy. Any user with valid credentials can therefore execute privileged operations reserved for the resource owner, undermining the access control model. No public exploit identified at time of analysis, but a GitHub Security Advisory (GHSA-p73f-w79w-jqr5) and a VulnCheck advisory document the flaw.
Arbitrary local file read in OpenClaw before 2026.4.7 lets authenticated Gateway operators holding the operator.write scope coerce the memory-wiki ingest feature into importing the contents of arbitrary local files. The flaw, reported by VulnCheck and tracked as GHSA-p2fh-f5fc-44hr, enables disclosure of sensitive host files (credentials, config, secrets) into wiki memory, but no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in OpenClaw before 2026.5.3 allows attackers with access to a Slack account to spoof identity by changing their mutable Slack display name to match an allowFrom policy entry, gaining agent access intended for another user. The root cause is authentication binding to a mutable identifier (CWE-290) rather than a stable Slack user ID. No public exploit identified at time of analysis, though an upstream advisory (GHSA-c29c-2q9c-pc86) and VulnCheck writeup describe the flaw in detail.
Command injection in OpenClaw before 2026.5.18 allows authenticated attackers to modify shell wrapper argv between approval and execution, bypassing the allowlist enforcement. The TOCTOU-style race against the approval gate lets attackers execute unapproved command shapes with the application's privileges, with no public exploit identified at time of analysis but a vendor advisory published via GHSA.