openclaw (npm)

Duplicate Advisory: Browser CDP discovery could accept blocked WebSocket URLs

OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

EPSS 0.33%

OpenClaw MCP SSE redirects could forward Authorization headers

EPSS 0.36%

Duplicate Advisory: Tool group policy callers could accept unvalidated group IDs

Duplicate Advisory: Workspace-derived service PATH could influence trash command selection

Duplicate Advisory: macOS Swift exec allowlist missed combined POSIX inline flags

Duplicate Advisory: Shell inline-command parsing could miss an allowlist check

Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes

Duplicate Advisory: BlueBubbles sender policy could match mutable conversation identifiers

Duplicate Advisory: Host environment sanitizer missed two Node.js control variables

Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment

Duplicate Advisory: Linux and macOS exec allowlists skipped configured argument patterns

Duplicate Advisory: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots

Duplicate Advisory: Internal/webchat command auth could inherit ownerAllowFrom wildcard state

Duplicate Advisory: Config recovery could restore openclaw.json with broad file permissions

Duplicate Advisory: Hostname checks could treat trailing-dot hosts inconsistently

Duplicate Advisory: Zalo allowFrom could bind to mutable display names

Duplicate Advisory: Shell positional parameters could weaken strict inline-eval checks

Duplicate Advisory: Active Memory write scope could mutate global config

Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers

Duplicate Advisory: Workspace .env npm_execpath could influence bundled runtime dependency install

Duplicate Advisory: Discord allowFrom could bind to mutable display names

Duplicate Advisory: Focus command could miss controlScope enforcement

Duplicate Advisory: Slack reaction events could ignore reaction notification settings

Duplicate Advisory: Skill-command dispatch could skip before-tool-call hooks

Duplicate Advisory: Pairing-scoped device session could restore revoked node token authority

Duplicate Advisory: memory-wiki shared search could miss session visibility checks

Duplicate Advisory: Exported session HTML could keep unsafe markdown links

OpenClaw: Shell inline-command parsing could miss an allowlist check

EPSS 0.27%

OpenClaw: Workspace-derived service PATH could influence trash command selection

EPSS 0.12%

OpenClaw: Host environment sanitizer missed two Node.js control variables

EPSS 0.25%

OpenClaw: Tool group policy callers could accept unvalidated group IDs

EPSS 0.17%

OpenClaw: Bootstrap token replay could widen pending pairing scopes

EPSS 0.09%

OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags

EPSS 0.25%

OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers

EPSS 0.17%

OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently

EPSS 0.21%

OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots

EPSS 0.12%

OpenClaw: Zalo allowFrom could bind to mutable display names

EPSS 0.22%

OpenClaw: Config recovery could restore openclaw.json with broad file permissions

EPSS 0.09%

OpenClaw: Shell positional parameters could weaken strict inline-eval checks

EPSS 0.26%

OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state

EPSS 0.24%

OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns

EPSS 0.35%

OpenClaw: Empty-scope device re-pairing could confuse caller scope containment

EPSS 0.21%

OpenClaw: Slack reaction events could ignore reaction notification settings

EPSS 0.19%

OpenClaw: Focus command could miss controlScope enforcement

EPSS 0.09%

OpenClaw: Discord allowFrom could bind to mutable display names

EPSS 0.27%

OpenClaw: Exec allowlist could miss side effects from transparent command wrappers

EPSS 0.18%

OpenClaw: Active Memory write scope could mutate global config

EPSS 0.18%

OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install

EPSS 0.12%

OpenClaw: Skill-command dispatch could skip before-tool-call hooks

EPSS 0.18%

OpenClaw: memory-wiki shared search could miss session visibility checks

EPSS 0.21%

OpenClaw: Pairing-scoped device session could restore revoked node token authority

EPSS 0.27%

OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

EPSS 0.13%

OpenClaw: Exported session HTML could keep unsafe markdown links

EPSS 0.19%

OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin

EPSS 0.22%

Duplicate Advisory: OpenClaw: Node pairing reconnection could confuse approval scope state

Duplicate Advisory: OpenClaw: Mattermost handlers could fall open when channel type was missing

Duplicate Advisory: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom

Duplicate Advisory: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

Duplicate Advisory: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

Duplicate Advisory: OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks

Duplicate Advisory: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

Duplicate Advisory: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

OpenClaw: Trusted retry endpoint checks could match hostname prefixes

EPSS 0.27%

OpenClaw: Node pairing reconnection could confuse approval scope state

EPSS 0.23%

OpenClaw: Mattermost handlers could fall open when channel type was missing

EPSS 0.19%

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

EPSS 0.45%

OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement

EPSS 0.17%

OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks

EPSS 0.20%

OpenClaw: QQBot streaming command could mutate config without explicit allowFrom

EPSS 0.18%

OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

EPSS 0.10%

OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

EPSS 0.20%

OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

EPSS 0.21%

OpenClaw: Exec approval display truncation could hide the command being approved

EPSS 0.23%

OpenClaw: Native command authorization could skip owner-command enforcement

EPSS 0.27%

OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

EPSS 0.25%

OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts

EPSS 0.19%

OpenClaw: memory-wiki ingest could read local files with operator.write scope

EPSS 0.38%

OpenClaw: Mattermost slash token revocation could lag until monitor refresh

EPSS 0.18%

OpenClaw: Slack allowFrom could bind to mutable display names

EPSS 0.21%

OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

EPSS 0.29%

OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn

EPSS 0.09%

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

EPSS 0.30%

OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

EPSS 0.10%

OpenClaw: Control UI locality spoofing could mint a durable admin device token

EPSS 0.31%

OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

EPSS 0.34%

OpenClaw: Message read actions could skip channel allowlist checks

EPSS 0.21%

OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority

EPSS 0.28%

OpenClaw: Fake package roots could influence memory-core artifact loading

EPSS 0.11%

OpenClaw's browser act interactions could bypass private-network navigation checks

EPSS 0.25%

OpenClaw: Matrix allowFrom could bind to mutable display names

EPSS 0.31%

OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

EPSS 0.42%

OpenClaw: Embedded runner policy could be confused by provider aliases

EPSS 0.09%

OpenClaw: Skill Workshop apply flow could override pending approval

EPSS 0.19%

OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

EPSS 0.31%

OpenClaw: Combined POSIX shell options could confuse exec revalidation

EPSS 0.42%

Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity

OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates

EPSS 0.25%

OpenClaw: Browser debug/export routes could reuse already-open blocked tabs

EPSS 0.15%

OpenClaw: QQBot native approval buttons did not enforce configured approver identity

EPSS 0.21%

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

EPSS 0.15%

OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions

EPSS 0.17%

OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes

EPSS 0.24%

Duplicate Advisory: OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

Duplicate Advisory: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload

Duplicate Advisory: OpenClaw: Hook mapping templates could bypass hook session-key opt-in

Duplicate Advisory: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution

Duplicate Advisory: OpenClaw's ACP child sessions inherit subagent security envelope constraints

Duplicate Advisory: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

Duplicate Advisory: OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests

Duplicate Advisory: OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners

Duplicate Advisory: OpenClaw: Isolated cron awareness events were recorded as trusted system events

Duplicate Advisory: OpenClaw: Feishu webhook and card-action validation now fail closed

Duplicate Advisory: OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets

Duplicate Advisory: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables

Duplicate Advisory: OpenClaw validates Zalo outbound photo URLs through the SSRF guard

Duplicate Advisory: OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay

Duplicate Advisory: OpenClaw: QQBot direct media upload skipped URL SSRF validation

Duplicate Advisory: OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage

Duplicate Advisory: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

Duplicate Advisory: OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

Duplicate Advisory: OpenClaw: Workspace dotenv could override runtime-control environment variables

Duplicate Advisory: OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding

Duplicate Advisory: OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation

Duplicate Advisory: OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root

OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

EPSS 0.49%

OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution

EPSS 0.14%

OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload

EPSS 0.29%

OpenClaw contains a symlink traversal vulnerability

EPSS 0.32%

OpenClaw's Gateway Control UI bootstrap config required Gateway auth

EPSS 0.32%

OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

EPSS 0.25%

OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root

EPSS 7.31%

OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs

EPSS 0.43%

OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

EPSS 0.14%

OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

EPSS 0.10%

OpenClaw's ACP child sessions inherit subagent security envelope constraints

EPSS 0.22%

OpenClaw validates Zalo outbound photo URLs through the SSRF guard

EPSS 0.29%

OpenClaw: Webchat audio embedding could read local files without local-root containment

EPSS 0.30%

OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners

EPSS 0.24%

Duplicate Advisory: OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

Duplicate Advisory: OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image

Duplicate Advisory: OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host

Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API

Duplicate Advisory: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

OpenClaw: Agent gateway config mutations could change protected operator settings

EPSS 0.22%

OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy

EPSS 0.71%

OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests

EPSS 0.12%

OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks

EPSS 0.25%

OpenClaw: QQBot direct media upload skipped URL SSRF validation

EPSS 0.24%

OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

EPSS 0.14%

OpenClaw: Isolated cron awareness events were recorded as trusted system events

EPSS 0.15%

OpenClaw: Workspace dotenv could override runtime-control environment variables

EPSS 0.13%

OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy

EPSS 0.27%

OpenClaw: Hook mapping templates could bypass hook session-key opt-in

EPSS 0.28%

Duplicate Advisory: OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation

Duplicate Advisory: OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding

Duplicate Advisory: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

Duplicate Advisory: OpenClaw: Slack thread context could include messages from non-allowlisted senders

Duplicate Advisory: OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

Duplicate Advisory: OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send

Duplicate Advisory: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

Duplicate Advisory: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

Duplicate Advisory: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection

Duplicate Advisory: OpenClaw: Pairing pending-request caps were enforced per channel instead of per account

Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode

Duplicate Advisory: OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting

Duplicate Advisory: OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability

Duplicate Advisory: OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose`

Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message

Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Duplicate Advisory: OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

Duplicate Advisory: OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md

Duplicate Advisory: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

Duplicate Advisory: OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist

OpenClaw: Slack thread context could include messages from non-allowlisted senders

EPSS 0.14%

Duplicate Advisory: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization

OpenClaw: Paired-device pairing actions were not limited to the caller device

EPSS 0.17%

OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization

EPSS 0.22%

Duplicate Advisory: OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths

EPSS 0.23%

OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

EPSS 0.26%

OpenClaw: Feishu webhook and card-action validation now fail closed

EPSS 0.72%

OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation

EPSS 0.54%

OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets

EPSS 0.27%

OpenClaw: Sender policy bypass in host media attachment reads allows unauthorized local file disclosure

EPSS 0.24%

OpenClaw: QQBot media tags could read arbitrary local files through reply text

EPSS 0.37%

OpenClaw: busybox and toybox applet execution weakened exec approval binding

EPSS 0.36%

OpenClaw: Matrix profile config persistence was reachable from operator.write message tools

EPSS 0.29%

OpenClaw: Sandboxed agents could escape exec routing via host=node override

EPSS 0.35%

OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage

EPSS 0.26%

OpenClaw: Browser interaction routes could pivot into local CDP and regain file reads

EPSS 0.25%

OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins

EPSS 0.38%

OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement

EPSS 0.25%

OpenClaw: Browser tabs action select and close routes bypassed SSRF policy

EPSS 0.24%

OpenClaw: Nostr profile mutation routes allowed operator.write config persistence

EPSS 0.22%

OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0

EPSS 0.21%

OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows

EPSS 0.39%

OpenClaw: screen_record outPath bypassed workspace-only filesystem guard

EPSS 0.22%

OpenClaw: Browser SSRF policy default allowed private-network navigation

EPSS 0.28%

OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding

EPSS 0.20%

OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes

EPSS 0.25%

OpenClaw: Workspace .env could inject OpenClaw runtime-control variables

EPSS 0.20%

OpenClaw: Discord event cover images bypassed sandbox media normalization

EPSS 0.26%

OpenClaw: Empty approver lists could grant explicit approval authorization

EPSS 0.24%

OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input

EPSS 0.19%

OpenClaw: Exec environment denylist missed high-risk interpreter startup variables

EPSS 0.39%

OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms

EPSS 0.41%

OpenClaw: Memory dreaming config persistence was reachable from operator.write commands

EPSS 0.21%

OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks

EPSS 0.23%

OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay

EPSS 0.21%

OpenClaw: Heartbeat owner downgrade missed local async exec completion events

EPSS 0.29%

OpenClaw: Voice-call realtime WebSocket accepted oversized frames

EPSS 0.41%

OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events

EPSS 0.42%

OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation

EPSS 0.27%

OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases

EPSS 0.33%

OpenClaw: Collect-mode queue batches could reuse the last sender authorization context

EPSS 0.22%

OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials

EPSS 0.40%

OpenClaw: TOCTOU read in exec script preflight

EPSS 0.08%

OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts

EPSS 0.42%

Duplicate Advisory: OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication

Duplicate Advisory: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

Duplicate Advisory: OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement

Duplicate Advisory: OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)

Duplicate Advisory: OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling

Duplicate Advisory: OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve

Duplicate Advisory: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure

Duplicate Advisory: OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision

Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete

Duplicate Advisory: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

Duplicate Advisory: OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret

Duplicate Advisory: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token

Duplicate Advisory: OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`

Duplicate Advisory: OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Duplicate Advisory: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing

Duplicate Advisory: OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals

Duplicate Advisory: OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens

Duplicate Advisory: OpenClaw: Plivo V2 verified replay identity drifts on query-only variants

OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)

EPSS 0.11%

OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks

EPSS 0.30%

OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification

EPSS 0.14%

OpenClaw Host-Exec Environment Variable Injection

EPSS 0.39%

OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable

EPSS 0.19%

OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`

EPSS 0.24%

OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation

EPSS 0.21%

OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval

EPSS 0.28%

OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)

EPSS 0.33%

OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths

EPSS 0.22%

OpenClaw: Existing WS sessions survive shared gateway token rotation

EPSS 0.19%

OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths

EPSS 0.21%

OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement

EPSS 0.13%

OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes

EPSS 0.24%

OpenClaw: resolvedAuth closure becomes stale after config reload

EPSS 0.21%

OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard

EPSS 0.26%

OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

EPSS 0.28%

OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration

EPSS 0.18%

OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts

EPSS 0.32%

OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)

EPSS 0.19%

OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel

OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade

Duplicate Advisory: OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

EPSS 0.30%

OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

EPSS 0.12%

OpenClaw: Shared-secret comparison call sites leaked length information through timing

EPSS 0.23%

OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

EPSS 0.28%

OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

EPSS 0.25%

OpenClaw: pnpm dlx approvals did not bind local script operands

EPSS 0.09%

OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

EPSS 0.28%

OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

EPSS 0.13%

OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

EPSS 0.19%

OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch

EPSS 0.11%

OpenClaw: QQ Bot structured payloads could read arbitrary local files

OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped

EPSS 0.37%

OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets

EPSS 0.27%

OpenClaw: Pairing pending-request caps were enforced per channel instead of per account

EPSS 0.42%

OpenClaw: Forged Nostr DMs could create pairing state before signature verification

EPSS 0.25%

OpenClaw: Shell init-file options could satisfy exec allowlist script matching

EPSS 0.12%

OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

EPSS 0.12%

OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send

EPSS 0.23%

OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations

EPSS 0.20%

OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send

EPSS 0.24%

OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

EPSS 0.14%

OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection

EPSS 0.24%

OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk

EPSS 0.34%

OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels

EPSS 0.33%

Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

EPSS 0.25%

OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps

EPSS 0.22%

OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message

EPSS 0.12%

OpenClaw: Endpoint persists after trust decline, leaking gateway credentials

EPSS 0.25%

OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled

EPSS 0.26%

OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist

EPSS 0.18%

OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration

EPSS 0.12%

OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts

EPSS 0.28%

OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config

EPSS 0.31%

OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing

EPSS 0.33%

OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection

EPSS 0.34%

OpenClaw: Discord voice manager bypasses channel-level member access allowlist

EPSS 0.22%

OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders

EPSS 0.30%

OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch

EPSS 0.45%

OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile

EPSS 0.20%

OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)

EPSS 0.53%

OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation

EPSS 0.19%

OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting

EPSS 0.39%

OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

EPSS 0.31%

OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read

EPSS 0.42%

OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode

EPSS 0.34%

OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`

EPSS 0.47%

OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability

EPSS 0.30%

OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses

EPSS 0.09%

OpenClaw: Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS

EPSS 0.32%

OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides

EPSS 0.13%

OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md

EPSS 0.54%

OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding

EPSS 0.33%

OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

EPSS 0.12%

OpenClaw runs Discord audio preflight transcription before member authorization

EPSS 0.47%

OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode

EPSS 0.11%

OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion

EPSS 0.48%

OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration

EPSS 0.18%

OpenClaw: Media download follows cross-origin redirects with Authorization headers intact

EPSS 0.30%

OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal

EPSS 0.47%

OpenClaw: Workspace `.env` can override the bundled plugin trust root

EPSS 0.13%

Duplicate Advisory: OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation

Duplicate Advisory: OpenClaw's complex interpreter pipelines could skip exec script preflight validation

OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open)

EPSS 0.23%

OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host

EPSS 0.53%

OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery

EPSS 0.22%

OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes

EPSS 0.15%

OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API

EPSS 0.18%

OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

EPSS 0.46%

OpenClaw: Matrix thread root and reply context bypass sender allowlist

EPSS 0.16%

OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

EPSS 0.13%

OpenClaw: Feishu thread history and quoted messages bypass sender allowlist

EPSS 0.22%

OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

EPSS 0.30%

OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass

EPSS 0.27%

OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get

EPSS 0.21%

OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

EPSS 0.12%

OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection

EPSS 0.23%

OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

EPSS 0.29%

OpenClaw's complex interpreter pipelines could skip exec script preflight validation

EPSS 0.32%

OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

EPSS 0.13%

OpenClaw gateway exec allow-always over-trusts positional carrier executables

EPSS 0.12%

OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`

EPSS 0.26%

OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper

EPSS 0.12%

OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

EPSS 0.24%

OpenClaw SSRF guard misses four IPv6 special-use ranges

EPSS 0.20%

OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement

EPSS 0.17%

OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing

EPSS 0.20%

OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose`

EPSS 0.21%

OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

EPSS 0.10%

OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure

EPSS 0.24%

OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades

EPSS 0.32%

OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image

EPSS 0.34%

OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals

EPSS 0.41%

OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

EPSS 0.13%

OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering

EPSS 0.15%

Duplicate Advisory: OpenClaw's device removal and token revocation do not terminate active WebSocket sessions

Duplicate Advisory: OpenClaw affected by SSRF via unguarded image download in fal provider

Duplicate Advisory: OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

Duplicate Advisory: OpenClaw's message tool media parameter bypasses tool policy filesystem isolation

Duplicate Advisory: OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication

OpenClaw affected by SSRF via unguarded image download in fal provider

EPSS 0.23%

OpenClaw's device removal and token revocation do not terminate active WebSocket sessions

EPSS 0.34%

OpenClaw's message tool media parameter bypasses tool policy filesystem isolation

EPSS 0.58%

OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication

EPSS 0.37%

OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

EPSS 0.84%

OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade

EPSS 0.30%

OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

EPSS 0.39%

OpenClaw: Zalo channel downloads media before sender authorization

EPSS 0.36%

Duplicate Advisory: OpenClaw: Sandbox `writeFile` commit could race outside the validated path

Duplicate Advisory: OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

Duplicate Advisory: OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty

Duplicate Advisory: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories

Duplicate Advisory: OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv

Duplicate Advisory: OpenClaw's system.run approvals did not bind mutable script operands across approval and execution

Duplicate Advisory: OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes

Duplicate Advisory: OpenClaw has Bypass in Webhook Rate Limiting via Pre-Authentication Secret Validation

OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy

EPSS 0.44%

OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface

EPSS 0.60%

OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement

EPSS 0.44%

OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send

EPSS 0.26%

OpenClaw has an Arbitrary Malicious Code Execution Vulnerability

EPSS 0.14%

OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope

EPSS 0.27%

OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant)

EPSS 0.33%

OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)

EPSS 0.38%

OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`

EPSS 0.15%

OpenClaw has ACP CLI approval prompt ANSI escape sequence injection

EPSS 0.26%

OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

EPSS 0.29%

OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token

EPSS 0.24%

OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback

EPSS 0.23%

OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`

EPSS 0.28%

OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing

EPSS 0.28%

OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

EPSS 0.44%

OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)

EPSS 0.24%

OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

EPSS 0.24%

OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility

EPSS 0.26%

OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope

EPSS 0.23%

Duplicate Advisory: OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path

Duplicate Advisory: OpenClaw session transcript files were created without forced user-only permissions

Duplicate Advisory: OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity

Duplicate Advisory: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

Duplicate Advisory: OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion

Duplicate Advisory: OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured

Duplicate Advisory: OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity

OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret

EPSS 0.29%

OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events

EPSS 0.20%

OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers

EPSS 0.29%

OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing

EPSS 0.36%

OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers

EPSS 0.30%

OpenClaw: Silent privilege escalation via gateway shared-auth reconnect

EPSS 0.19%

OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

EPSS 0.28%

OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding

EPSS 0.35%

OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

EPSS 0.42%

OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts

EPSS 0.29%

OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting

EPSS 0.23%

OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision

EPSS 0.24%

OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions

EPSS 0.20%

OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection

EPSS 0.31%

OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve

EPSS 0.46%

OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals

EPSS 0.29%

OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens

EPSS 0.24%

OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation

EPSS 0.28%

OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete

EPSS 0.25%

OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement

EPSS 0.22%

OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions

EPSS 0.42%

OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status

EPSS 0.19%

OpenClaw may have stale policy enforcement for queued node actions

EPSS 0.22%

OpenClaw has Inconsistent Host Exec Environment Override Sanitization

EPSS 0.49%

OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths

EPSS 0.29%

OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling

EPSS 0.49%

OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

EPSS 0.12%

OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure

EPSS 0.36%

OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface

EPSS 0.36%

OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper

EPSS 0.37%

OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement

EPSS 0.45%

OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.

EPSS 0.24%

OpenClaw: Windows-compatible env override keys could bypass system.run approval binding

EPSS 0.33%

OpenClaw: Windows-compatible env override keys could bypass system.run approval binding

EPSS 0.33%

OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers

EPSS 0.27%

OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication

EPSS 0.14%

OpenClaw: Plivo V2 verified replay identity drifts on query-only variants

EPSS 0.28%

OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read

EPSS 0.70%

OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read

EPSS 0.70%

Duplicate Advisory: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

Duplicate Advisory: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)

Duplicate Advisory: OpenClaw has browser trace/download path symlink escape in temp output handling

Duplicate Advisory: OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers

Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows

Duplicate Advisory: OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf

Duplicate Advisory: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed

Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)

Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication

Duplicate Advisory: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

Duplicate Advisory: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

Duplicate Advisory: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels

Duplicate Advisory: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability

Duplicate Advisory: OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks

Duplicate Advisory: OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host

Duplicate Advisory: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns

Duplicate Advisory: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes

Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

Duplicate Advisory: allowlist exec-guard bypass via env -S

Duplicate Advisory: Command Injection via unescaped environment assignments in Windows Scheduled Task script generation

Duplicate Advisory: Signal group allowlist authorization bypass via DM pairing-store leakage

Duplicate Advisory: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts

Duplicate Advisory: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind

Duplicate Advisory: OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution

Duplicate Advisory: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution

Duplicate Advisory: OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path

Duplicate Advisory: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

Duplicate Advisory: safeBins stdin-only bypass via sort output and recursive grep flags

Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

Duplicate Advisory: OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling

Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains

Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy

Duplicate Advisory: Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch

Duplicate Advisory: ACPX Windows wrapper shell fallback allowed cwd injection in specific paths

Duplicate Advisory: Exec allowlist wrapper analysis did not unwrap env/shell dispatch chains

Duplicate Advisory: OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace

OpenClaw session transcript files were created without forced user-only permissions

EPSS 0.12%

OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection

EPSS 2.01%

OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion

EPSS 0.54%

OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval

EPSS 0.36%

OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs

EPSS 0.43%

OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

EPSS 0.28%

OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured

EPSS 0.25%

OpenClaw: Gateway `agent` calls could override the workspace boundary

EPSS 0.30%

OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

EPSS 0.57%

`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

EPSS 0.10%

OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories

EPSS 0.34%

OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces

EPSS 0.26%

OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths

EPSS 0.41%

OpenClaw: Feishu reaction events could bypass group authorization and mention gating

EPSS 0.32%

OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes

EPSS 0.29%

OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens

EPSS 0.25%

OpenClaw's Zalouser allowlist authorization matched mutable group names by default

EPSS 0.34%

OpenClaw: Discord guild reaction ingress could bypass users and roles allowlists

EPSS 0.15%

OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode

EPSS 0.11%

OpenClaw: Sandbox staged writes could escape the verified parent directory before commit

EPSS 0.08%

OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent`

EPSS 0.10%

OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity

EPSS 0.18%

OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions

EPSS 0.20%

OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv

EPSS 0.28%

OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity

EPSS 0.13%

OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries

EPSS 0.14%

OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE

EPSS 0.73%

OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes

EPSS 0.48%

OpenClaw: Sandbox `writeFile` commit could race outside the validated path

EPSS 0.08%

OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode

EPSS 0.16%

OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch

EPSS 0.20%

OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers

EPSS 0.18%

OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary

OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf

EPSS 0.34%

OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries

OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty

EPSS 0.27%

OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path

EPSS 0.09%

OpenClaw's system.run approvals did not bind mutable script operands across approval and execution

EPSS 0.20%

Duplicate Advisory: OpenClaw safeBins file-existence oracle information disclosure

Duplicate Advisory: OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)

OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions

EPSS 0.11%

OpenClaw: system.run allow-always persistence included shell-commented payload tails

OpenClaw: `operator.write` chat.send could reach admin-only config writes

OpenClaw: system.run wrapper-depth boundary could skip shell approval gating

EPSS 0.11%

OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

EPSS 0.32%

OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping

OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers

OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots

OpenClaw's hooks count non-POST requests toward auth lockout

OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

OpenClaw: BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty

EPSS 0.27%

OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection

OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations

OpenClaw Canvas Authentication Bypass Vulnerability

EPSS 0.67%

OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images

EPSS 0.33%

OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard

EPSS 0.21%

OpenClaw has agent avatar symlink traversal in gateway session metadata

OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization

OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access

EPSS 0.17%

OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP

OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows

EPSS 0.29%

OpenClaw's serialize sandbox registry writes to prevent races and delete-rollback corruption

EPSS 0.14%

OpenClaw's Node role device-identity bypass allows unauthorized node.event injection

EPSS 0.28%

OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From

OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path

EPSS 0.55%

OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch

OpenClaw has Canvas route hardening for mixed-trust deployments

OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains

EPSS 0.43%

OpenClaw's typed sender-key matching for toolsBySender prevents identity-collision policy bypass

EPSS 0.20%

OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks

EPSS 0.22%

OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths

EPSS 0.26%

OpenClaw: Zip extraction symlink traversal could write outside destination

OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

EPSS 0.28%

OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode

OpenClaw's Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch

EPSS 0.33%

OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

EPSS 0.27%

OpenClaw hook transform path containment missed symlink-resolved escapes

In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program

EPSS 0.30%

OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallback

EPSS 0.31%

OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity

OpenClaw has multiple E2E/test Dockerfiles that run all processes as root

OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation

OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model

OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains

EPSS 0.32%

OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions

EPSS 0.20%

OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt

OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)

EPSS 0.58%

OpenClaw's runtime /debug override path accepted prototype-reserved keys

EPSS 0.24%

OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

EPSS 0.35%

OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands

OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering

OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot

OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks

EPSS 0.13%

OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)

EPSS 1.12%

OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

EPSS 0.35%

OpenClaw Loopback CDP probe can leak Gateway token to local listener

EPSS 0.13%

OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation

EPSS 0.66%

OpenClaw has a Discord `allowFrom` slug-collision authorization bypass

OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access

EPSS 0.40%

OpenClaw has a IPv6 multicast SSRF classifier bypass

OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write

EPSS 0.27%

OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint

OpenClaw has a Feishu allowFrom authorization bypass via display-name collision

EPSS 0.21%

OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution

EPSS 0.65%

OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths

OpenClaw plugin runtime command execution is part of trusted plugin boundary

OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth

EPSS 0.45%

OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files

EPSS 0.42%

OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling

EPSS 0.59%

OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)

EPSS 0.38%

OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption

OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows

OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

EPSS 0.13%

OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)

EPSS 0.25%

OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)

OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)

EPSS 0.14%

OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)

EPSS 0.14%

OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels

EPSS 0.14%

OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization

OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification

EPSS 0.31%

OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups

EPSS 0.21%

OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind

EPSS 0.08%

OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows

EPSS 0.14%

OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured

EPSS 0.24%

OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts

EPSS 0.14%

OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots

OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS

EPSS 0.42%

OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace

EPSS 0.14%

OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia

EPSS 0.36%

OpenClaw vulnerable to arbitrary file read via $include directive

EPSS 0.15%

OpenClaw's system.run allowlist bypass via shell line-continuation command substitution

EPSS 0.46%

OpenClaw's config env vars allowed startup env injection into service runtime

EPSS 0.39%

OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment

EPSS 0.13%

OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode

OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

EPSS 0.21%

OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

EPSS 0.95%

OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host

EPSS 0.10%

OpenClaw's andbox browser noVNC observer lacked VNC authentication

EPSS 0.52%

OpenClaw DM pairing-store identities could satisfy group allowlist authorization

EPSS 0.25%

OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode

EPSS 0.29%

OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

EPSS 0.35%