DeutschShown in its original language — a full translation is planned for a future version.
OpenClaw: Mehrere Schwachstellen
view advisory published 2026-04-21
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren oder offenzulegen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-45002US | —OT elevated | — | ||
OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restriction. Attackers can re… | ||||
| CVE-2026-45001US | —OT elevated | — | ||
OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trusted settings… | ||||
| CVE-2026-45000US | — | — | ||
OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create store… | ||||
| CVE-2026-44999US | —OT elevated | — | ||
OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be recorded as trusted sys… | ||||
| CVE-2026-44998US | —OT elevated | — | ||
OpenClaw before 2026.4.20 contains a tool policy bypass vulnerability allowing bundled MCP and LSP tools to circumvent configured tool restrictions. Attackers with local agent acce… | ||||
| CVE-2026-44995US | — | — | ||
OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code. Mali… | ||||
| CVE-2026-44993US | —OT elevated | — | ||
OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversations. Attackers can b… | ||||
| CVE-2026-44117US | — | — | ||
OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by send… | ||||
| CVE-2026-41909US | —OT elevated | — | ||
OpenClaw before 2026.4.20 contains an improper authorization vulnerability in paired-device pairing management that allows limited-scope sessions to enumerate and act on pairing re… | ||||
| CVE-2026-41908US | medium6.5OT elevated | — | ||
OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.read scope to access pro… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-2xcp-x87w-q377 vom 2026-04-21external
- GitHub Security Advisory GHSA-57r2-h2wj-g887 vom 2026-04-21external
- GitHub Security Advisory GHSA-72q8-jcmc-97wx vom 2026-04-21external
- GitHub Security Advisory GHSA-7jm2-g593-4qrc vom 2026-04-21external
- GitHub Security Advisory GHSA-c4qg-j8jg-42q5 vom 2026-04-21external
- GitHub Security Advisory GHSA-j4c5-89f5-f3pm vom 2026-04-21external
- GitHub Security Advisory GHSA-mj59-h3q9-ghfh vom 2026-04-21external
- GitHub Security Advisory GHSA-qrp5-gfw2-gxv4 vom 2026-04-21external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan