DeutschShown in its original language — a full translation is planned for a future version.
OpenClaw: Mehrere Schwachstellen
view advisory published 2026-03-02
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Code auszuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32903US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-32901US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-28483US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-32044US | — | — | ||
OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other archive formats. Attacke… | ||||
| CVE-2026-32035US | high7.1OT elevated | — | ||
OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true. Non-owner vo… | ||||
| CVE-2026-32011US | — | — | ||
OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Google Chat that parse request bodies before performing authen… | ||||
| CVE-2026-32004US | high8.2OT elevated | — | ||
OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-pat… | ||||
| CVE-2026-31990US | high7.1 | — | ||
OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writ… | ||||
| CVE-2026-29608US | medium6.7 | — | ||
OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local… | ||||
| CVE-2026-27670US | — | — | ||
OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory.… | ||||
| CVE-2026-22181US | — | — | ||
OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when environment proxy vari… | ||||
| CVE-2026-22180US | medium5.3 | — | ||
OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser output handling that allows writes outside intended root directories. Attackers can e… | ||||
02
references
External citations — patches, advisories, analysis.
- OpenClaw GitHub vom 2026-03-02external
- OpenClaw GitHub vom 2026-03-02external
- OpenClaw GitHub vom 2026-03-02external
- OpenClaw GitHub vom 2026-03-02external
- OpenClaw GitHub vom 2026-03-02external
- OpenClaw GitHub vom 2026-03-02external
- OpenClaw GitHub vom 2026-03-02external
- OpenClaw GitHub vom 2026-03-02external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan