DeutschShown in its original language — a full translation is planned for a future version.
OpenClaw: Mehrere Schwachstellen
view advisory published 2026-02-15
Ein Angreifer kann diese Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder andere, nicht näher bezeichnete Angriffe durchzuführen.
01
describes (44)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-29613US | —OT elevated | — | ||
OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remote… | ||||
| CVE-2026-29612US | high7.5 | — | ||
OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocati… | ||||
| CVE-2026-29611US | — | — | ||
OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling that allows attackers… | ||||
| CVE-2026-29610US | — | — | ||
OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH environment variables throu… | ||||
| CVE-2026-29609US | — | — | ||
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing max… | ||||
| CVE-2026-29606US | medium6.5OT elevated | — | ||
OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFree… | ||||
| CVE-2026-28486US | medium5.5 | — | ||
OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrary file writes outside… | ||||
| CVE-2026-28485US | high7.8OT elevated | — | ||
OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke p… | ||||
| CVE-2026-28482US | — | — | ||
OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory containment. Authentic… | ||||
| CVE-2026-28481US | high7.5 | — | ||
OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional extension must be ena… | ||||
| CVE-2026-28480US | — | — | ||
OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender I… | ||||
| CVE-2026-28478US | — | — | ||
OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits. Remote unauthentic… | ||||
| CVE-2026-28477US | — | — | ||
OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection. An atta… | ||||
| CVE-2026-28476US | medium5.8 | — | ||
OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authenticatio… | ||||
| CVE-2026-28475US | low3.7 | — | ||
OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attac… | ||||
| CVE-2026-28474US | —OT elevated | — | ||
OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to by… | ||||
| CVE-2026-28473US | —OT elevated | — | ||
OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending the… | ||||
| CVE-2026-28472US | critical9.8OT elevated | — | ||
OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when auth.token is present… | ||||
| CVE-2026-28471US | — | — | ||
OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in which DM allowlist matching could be bypassed by exact-matc… | ||||
| CVE-2026-28470US | — | — | ||
OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting comm… | ||||
showing 20 of 44
02
references
External citations — patches, advisories, analysis.
- openclaw GitHub vom 2026-02-15external
- openclaw GitHub vom 2026-02-15external
- openclaw GitHub vom 2026-02-15external
- openclaw GitHub vom 2026-02-15external
- openclaw GitHub vom 2026-02-15external
- openclaw GitHub vom 2026-02-15external
- openclaw GitHub vom 2026-02-15external
- openclaw GitHub vom 2026-02-15external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan