DeutschShown in its original language — a full translation is planned for a future version.
OpenClaw: Mehrere Schwachstellen
view advisory published 2026-02-26
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder andere nicht näher spezifizierte Angriffe durchzuführen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32895US | —OT elevated | — | ||
OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to be enqueued. Attacker… | ||||
| CVE-2026-32067US | high8.1OT elevated | — | ||
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to re… | ||||
| CVE-2026-32058US | medium6.5OT elevated | — | ||
OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests wit… | ||||
| CVE-2026-32036US | high8.2 | — | ||
OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/c… | ||||
| CVE-2026-32014US | —OT elevated | — | ||
OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client without being bound int… | ||||
| CVE-2026-27545US | medium4.7 | — | ||
OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended filesystem locations… | ||||
| CVE-2026-32059US | —OT elevated | — | ||
OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allowing attackers to bypa… | ||||
| CVE-2026-28363US | high8.8OT high | Exploit | ||
In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to ap… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-7977-C43C-XPWJ vom 2026-02-26external
- GitHub Security Advisory GHSA-7qf6-h84j-8fq4 vom 2026-02-26external
- GitHub Security Advisory GHSA-f7ww-2725-qvw2 vom 2026-02-26external
- GitHub Security Advisory GHSA-hjvp-qhm6-wrh2 vom 2026-02-26external
- GitHub Security Advisory GHSA-mwxv-35wr-4vvj vom 2026-02-26external
- GitHub Security Advisory GHSA-qcc4-p59m-p54m vom 2026-02-26external
- GitHub Security Advisory GHSA-r65x-2hqr-j5hf vom 2026-02-26external
- GitHub Security Advisory GHSA-v8cg-4474-49v8 vom 2026-02-26external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan