DeutschShown in its original language — a full translation is planned for a future version.
OpenClaw: Mehrere Schwachstellen
view advisory published 2026-03-15
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen – sogar Administratorrechte – zu erlangen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32988US | — | — | ||
OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and population are not pinned to a verified pare… | ||||
| CVE-2026-32971US | high8.0OT elevated | — | ||
OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the executed argv. Attack… | ||||
| CVE-2026-32917US | — | — | ||
OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configure… | ||||
| CVE-2026-33573US | — | — | ||
OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override wor… | ||||
| CVE-2026-33572US | medium5.5OT elevated | — | ||
OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local acces… | ||||
| CVE-2026-32980US | — | — | ||
OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exha… | ||||
| CVE-2026-32974US | critical9.8 | — | ||
OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance o… | ||||
| CVE-2026-32972US | —OT elevated | — | ||
OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile m… | ||||
| CVE-2026-32915US | —OT elevated | — | ||
OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scop… | ||||
| CVE-2026-32914US | —OT elevated | — | ||
OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner… | ||||
| CVE-2026-22172US | —OT elevated | — | ||
OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to s… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Advisory Database vom 2026-03-15external
- GitHub Advisory Database vom 2026-03-15external
- GitHub Advisory Database vom 2026-03-15external
- GitHub Advisory Database vom 2026-03-15external
- GitHub Advisory Database vom 2026-03-15external
- GitHub Advisory Database vom 2026-03-15external
- GitHub Advisory Database vom 2026-03-15external
- GitHub Advisory Database vom 2026-03-15external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan