DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
OpenClaw: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-03-31
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.
01
beschreibt (52)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-41408US | medium6.5 | — | ||
OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup operations. Attackers c… | ||||
| CVE-2026-41406US | —OT erhöht | — | ||
OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fetched quoted, root, a… | ||||
| CVE-2026-41405US | — | — | ||
OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attacke… | ||||
| CVE-2026-41404US | —OT erhöht | — | ||
OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can ex… | ||||
| CVE-2026-41403US | medium4.0 | — | ||
OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attack… | ||||
| CVE-2026-41402US | medium5.4OT erhöht | — | ||
OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages across sibling targets… | ||||
| CVE-2026-41397US | critical9.6 | — | ||
OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file synchronization opera… | ||||
| CVE-2026-41396US | high7.8 | — | ||
OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with cont… | ||||
| CVE-2026-41394US | —OT erhöht | — | ||
OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access… | ||||
| CVE-2026-41393US | medium4.8 | — | ||
OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-tailnet position and… | ||||
| CVE-2026-41391US | medium6.1 | — | ||
OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to redirect Python package-… | ||||
| CVE-2026-41386US | critical9.8 | — | ||
OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can… | ||||
| CVE-2026-41385US | —OT erhöht | — | ||
OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can r… | ||||
| CVE-2026-41382US | —OT erhöht | — | ||
OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist restrictions. Attacke… | ||||
| CVE-2026-41381US | —OT erhöht | — | ||
OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allowlist restric… | ||||
| CVE-2026-41379US | —OT erhöht | — | ||
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice configuration persi… | ||||
| CVE-2026-41378US | —OT erhöht | — | ||
OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side to… | ||||
| CVE-2026-41377US | — | — | ||
OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan fail… | ||||
| CVE-2026-41376US | medium6.5OT erhöht | — | ||
OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to properly validate message senders. Attackers can… | ||||
| CVE-2026-41375US | —OT erhöht | — | ||
OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin scope checks fo… | ||||
20 von 52 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitHub Security Advisory GHSA-3q42-xmxv-9vfr vom 2026-03-31external
- GitHub Security Advisory GHSA-3qpv-xf3v-mm45 vom 2026-03-31external
- GitHub Security Advisory GHSA-3xv9-89fm-7h4r vom 2026-03-31external
- GitHub Security Advisory GHSA-42mx-vp8m-j7qh vom 2026-03-31external
- GitHub Security Advisory GHSA-4g5x-2jfc-xm98 vom 2026-03-31external
- GitHub Security Advisory GHSA-57gh-m6rq-54cf vom 2026-03-31external
- GitHub Security Advisory GHSA-58q2-7r52-jq62 vom 2026-03-31external
- GitHub Security Advisory GHSA-6336-qqw9-v6x6 vom 2026-03-31external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan