DeutschShown in its original language — a full translation is planned for a future version.
OpenClaw: Mehrere Schwachstellen
view advisory published 2026-02-24
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen oder andere nicht näher definierte Angriffe durchzuführen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32911US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-32038US | critical9.0 | — | ||
OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace. Attackers can confi… | ||||
| CVE-2026-32033US | — | — | ||
OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validation due to canonicaliz… | ||||
| CVE-2026-32009US | high7.8 | — | ||
OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories including writable package-ma… | ||||
| CVE-2026-31998US | —OT elevated | — | ||
OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserId… | ||||
| CVE-2026-27523US | high7.5 | — | ||
OpenClaw versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing attackers to bypass allowed-root and blocked-path checks via symlinked parent director… | ||||
| CVE-2026-27522US | medium5.5 | — | ||
OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset. Attackers can hyd… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-27cr-4p5m-74rj vom 2026-02-24external
- GitHub Security Advisory GHSA-534w-2vm4-89xr vom 2026-02-24external
- GitHub Security Advisory GHSA-5gj7-jf77-q2q2 vom 2026-02-24external
- GitHub Security Advisory GHSA-9f72-qcpw-2hxc vom 2026-02-24external
- GitHub Security Advisory GHSA-fqcm-97m6-w7rm vom 2026-02-24external
- GitHub Security Advisory GHSA-gw85-xp4q-5gp9 vom 2026-02-24external
- GitHub Security Advisory GHSA-m8v2-6wwh-r4gc vom 2026-02-24external
- GitHub Security Advisory GHSA-ww6v-v748-x7g9 vom 2026-02-24external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan