DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
OpenClaw: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-06-29
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.
01
beschreibt (44)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-62229US | — | — | ||
OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended authoriza… | ||||
| CVE-2026-62228US | —OT erhöht | — | ||
OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization… | ||||
| CVE-2026-62227US | — | — | ||
OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers wit… | ||||
| CVE-2026-62226US | — | — | ||
OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lo… | ||||
| CVE-2026-62225US | —OT erhöht | — | ||
OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond thei… | ||||
| CVE-2026-62224US | —OT erhöht | — | ||
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can p… | ||||
| CVE-2026-62223US | —OT erhöht | — | ||
OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended… | ||||
| CVE-2026-62222US | — | — | ||
OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control ov… | ||||
| CVE-2026-62221US | —OT erhöht | — | ||
OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature. When the affected feature is enabled and reachable, a lowe… | ||||
| CVE-2026-62220US | — | — | ||
OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected fe… | ||||
| CVE-2026-62219US | —OT erhöht | — | ||
OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass… | ||||
| CVE-2026-62218US | —OT erhöht | — | ||
OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management check… | ||||
| CVE-2026-62217US | —OT erhöht | — | ||
OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or con… | ||||
| CVE-2026-62216US | — | — | ||
OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach n… | ||||
| CVE-2026-62215US | —OT erhöht | — | ||
OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers c… | ||||
| CVE-2026-62214US | — | — | ||
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing… | ||||
| CVE-2026-62213US | — | — | ||
OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can… | ||||
| CVE-2026-62212US | — | — | ||
OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or confi… | ||||
| CVE-2026-62211US | — | — | ||
OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that should re… | ||||
| CVE-2026-62210US | — | — | ||
OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers w… | ||||
20 von 44 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitHub Security Advisory GHSA-2q7j-2vhx-56g8 vom 2026-06-29external
- GitHub Security Advisory GHSA-2x93-h3hg-2xfp vom 2026-06-29external
- GitHub Security Advisory GHSA-34mr-7r3m-gfg7 vom 2026-06-29external
- GitHub Security Advisory GHSA-3fp5-v549-9v66 vom 2026-06-29external
- GitHub Security Advisory GHSA-3pmr-x9g8-m55r vom 2026-06-29external
- GitHub Security Advisory GHSA-3x84-qq85-fj65 vom 2026-06-29external
- GitHub Security Advisory GHSA-4pqj-3c56-5fqq vom 2026-06-29external
- GitHub Security Advisory GHSA-4xwj-mcc7-x7x5 vom 2026-06-29external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan