DeutschShown in its original language — a full translation is planned for a future version.
OpenClaw: Mehrere Schwachstellen
view advisory published 2026-03-01
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Berechtigungen zu erlangen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32902US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-32066US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-32051US | —OT elevated | — | ||
OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces i… | ||||
| CVE-2026-32048US | critical9.9 | — | ||
OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under un… | ||||
| CVE-2026-32041US | high7.8OT elevated | — | ||
OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessible without authenticat… | ||||
| CVE-2026-31989US | medium6.3 | — | ||
OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy.… | ||||
| CVE-2026-28461US | — | — | ||
OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key acc… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-392f-ggf5-fp3c vom 2026-03-01external
- GitHub Security Advisory GHSA-7xmq-g46g-f8pv vom 2026-03-01external
- GitHub Security Advisory GHSA-8m9v-xpgf-g99m vom 2026-03-01external
- GitHub Security Advisory GHSA-g99v-8hwm-g76g vom 2026-03-01external
- GitHub Security Advisory GHSA-jr6x-2q95-fh2g vom 2026-03-01external
- GitHub Security Advisory GHSA-p7gr-f84w-hqg5 vom 2026-03-01external
- GitHub Security Advisory GHSA-vpj2-69hf-rppw vom 2026-03-01external
- GitHub Security Advisory GHSA-wr6m-jg37-68xh vom 2026-03-01external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan