DeutschShown in its original language — a full translation is planned for a future version.
OpenClaw: Mehrere Schwachstellen
view advisory published 2026-03-03
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Code auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.
01
describes (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32047US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-22173US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-32053US | medium6.5OT elevated | — | ||
OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to by… | ||||
| CVE-2026-32052US | critical9.8OT elevated | — | ||
OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands by injecting positio… | ||||
| CVE-2026-32037US | medium6.5 | — | ||
OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads. Attackers can suppl… | ||||
| CVE-2026-32027US | —OT elevated | — | ||
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization chec… | ||||
| CVE-2026-32026US | high8.6 | — | ||
OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temporary directory outsi… | ||||
| CVE-2026-32023US | —OT elevated | — | ||
OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers can suppress shell-wrap… | ||||
| CVE-2026-32021US | —OT elevated | — | ||
OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the Feishu allowFrom allowlist implementation that accepts mutable sender display names instea… | ||||
| CVE-2026-32015US | —OT elevated | — | ||
OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that allows attackers to bypass allowlist checks by controlling process… | ||||
| CVE-2026-32006US | medium4.3OT elevated | — | ||
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist identities when dmPo… | ||||
| CVE-2026-32001US | —OT elevated | — | ||
OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=node without de… | ||||
| CVE-2026-31992US | high8.8 | — | ||
OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /us… | ||||
| CVE-2026-28460US | —OT elevated | — | ||
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by splitting command substitu… | ||||
| CVE-2026-22176US | high7.8 | — | ||
OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd us… | ||||
| CVE-2026-22171US | critical9.1 | — | ||
OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary fi… | ||||
02
references
External citations — patches, advisories, analysis.
- OpenClaw GitHub vom 2026-03-03external
- OpenClaw GitHub vom 2026-03-03external
- OpenClaw GitHub vom 2026-03-03external
- OpenClaw GitHub vom 2026-03-03external
- OpenClaw GitHub vom 2026-03-03external
- OpenClaw GitHub vom 2026-03-03external
- OpenClaw GitHub vom 2026-03-03external
- OpenClaw GitHub vom 2026-03-03external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan