DeutschShown in its original language — a full translation is planned for a future version.
OpenClaw: Mehrere Schwachstellen
view advisory published 2026-04-12
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-35669US | —OT elevated | — | ||
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of… | ||||
| CVE-2026-35668US | — | — | ||
OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnorma… | ||||
| CVE-2026-35667US | — | — | ||
OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-utils.ts that sends SIGKI… | ||||
| CVE-2026-35665US | — | — | ||
OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout… | ||||
| CVE-2026-35663US | —OT elevated | — | ||
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass p… | ||||
| CVE-2026-35654US | —OT elevated | — | ||
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Microsoft Teams feedback invokes that allows unauthorized senders to record session feedback. Attackers… | ||||
| CVE-2026-35653US | —OT elevated | — | ||
OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to brow… | ||||
| CVE-2026-35647US | —OT elevated | — | ||
OpenClaw before 2026.3.25 contains an access control vulnerability where verification notices bypass DM policy checks and reply to unpaired peers. Attackers can send verification n… | ||||
| CVE-2026-35641US | high7.8 | — | ||
OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .np… | ||||
| CVE-2026-35621US | —OT elevated | — | ||
OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, allowing opera… | ||||
| CVE-2026-35620US | —OT elevated | — | ||
OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner command-authorized se… | ||||
| CVE-2026-35619US | —OT elevated | — | ||
OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements. Attackers with only… | ||||
| CVE-2026-27486US | medium5.3 | — | ||
OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern matching to terminate… | ||||
02
references
External citations — patches, advisories, analysis.
- EU Vulnerability Database vom 2026-04-12external
- EU Vulnerability Database vom 2026-04-12external
- EU Vulnerability Database vom 2026-04-12external
- EU Vulnerability Database vom 2026-04-12external
- EU Vulnerability Database vom 2026-04-12external
- EU Vulnerability Database vom 2026-04-12external
- EU Vulnerability Database vom 2026-04-12external
- EU Vulnerability Database vom 2026-04-12external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan