DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
OpenClaw: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-02-22
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.
01
beschreibt (48)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-3690US | — | — | ||
OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is no… | ||||
| CVE-2026-3689US | — | — | ||
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenC… | ||||
| CVE-2026-32908US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-32907US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-32900US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-28455US | — | — | ||
Rejected reason: This CVE ID has been rejected. | ||||
| CVE-2026-32897US | medium5.3 | — | ||
OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.owner… | ||||
| CVE-2026-32896US | medium6.5OT erhöht | — | ||
The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain r… | ||||
| CVE-2026-32064US | critical9.1OT erhöht | — | ||
OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC inter… | ||||
| CVE-2026-32056US | critical9.8 | — | ||
OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlis… | ||||
| CVE-2026-32049US | — | — | ||
OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote… | ||||
| CVE-2026-32046US | critical9.8OT erhöht | — | ||
OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerabili… | ||||
| CVE-2026-32045US | critical9.1 | — | ||
OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements. Attacke… | ||||
| CVE-2026-32039US | medium6.5OT erhöht | — | ||
OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the toolsBySender group policy matching that allows attackers to inherit elevated tool permiss… | ||||
| CVE-2026-32034US | —OT erhöht | — | ||
OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is exposed over p… | ||||
| CVE-2026-32032US | — | — | ||
OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environme… | ||||
| CVE-2026-32030US | — | — | ||
OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that accepts arbitrary absolute paths when iMessage remote attachment… | ||||
| CVE-2026-32029US | —OT erhöht | — | ||
OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoo… | ||||
| CVE-2026-32024US | high7.5 | — | ||
OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the configured workspace bou… | ||||
| CVE-2026-32022US | — | — | ||
OpenClaw versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the grep tool within tools.exec.safeBins that allows attackers to read arbitrary files by s… | ||||
20 von 48 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- OpenClaw Security Advisories vom 2026-02-22external
- OpenClaw Security Advisories vom 2026-02-22external
- OpenClaw Security Advisories vom 2026-02-22external
- OpenClaw Security Advisories vom 2026-02-22external
- OpenClaw Security Advisories vom 2026-02-22external
- OpenClaw Security Advisories vom 2026-02-22external
- OpenClaw Security Advisories vom 2026-02-22external
- OpenClaw Security Advisories vom 2026-02-22external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan