DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
OpenClaw: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-03-26
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte, einschließlich Administratorrechte, zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
01
beschreibt (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-35664US | —OT erhöht | — | ||
OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads. Attackers can s… | ||||
| CVE-2026-35662US | —OT erhöht | — | ||
OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond their authorized scope.… | ||||
| CVE-2026-35661US | —OT erhöht | — | ||
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal… | ||||
| CVE-2026-35657US | —OT erhöht | — | ||
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation. Attackers can ac… | ||||
| CVE-2026-35651US | — | — | ||
OpenClaw versions 2026.2.13 through 2026.3.24 contain an ANSI escape sequence injection vulnerability in approval prompts that allows attackers to spoof terminal output. Untrusted… | ||||
| CVE-2026-35650US | high8.8 | — | ||
OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent s… | ||||
| CVE-2026-35645US | high8.8OT erhöht | — | ||
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime… | ||||
| CVE-2026-35642US | —OT erhöht | — | ||
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism. Attackers can trigger react… | ||||
| CVE-2026-35640US | high7.5 | — | ||
OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote… | ||||
| CVE-2026-35628US | medium6.5 | — | ||
OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerabi… | ||||
| CVE-2026-35625US | —OT erhöht | — | ||
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permis… | ||||
| CVE-2026-35617US | medium5.4OT erhöht | — | ||
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind gr… | ||||
| CVE-2026-34512US | —OT erhöht | — | ||
OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-l… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Openclaw Github vom 2026-03-26external
- Openclaw Github vom 2026-03-26external
- Openclaw Github vom 2026-03-26external
- Openclaw Github vom 2026-03-26external
- Openclaw Github vom 2026-03-26external
- Openclaw Github vom 2026-03-26external
- Openclaw Github vom 2026-03-26external
- Openclaw Github vom 2026-03-26external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan