OpenClaw Denial of Service Vulnerability (CNVD-2026-13800)

OpenClaw is used to handle Webhook events open source framework . A denial of service vulnerability exists in OpenClaw. An attacker can exploit this vulnerability to cause the service to become unavailable by sending an oversized JSON load or slow uploads that trigger memory pressure...

OpenClaw Arbitrary File Read Vulnerability (CNVD-2026-13555)

OpenClaw is a tool for configuration management that supports loading external configuration files via the include directive. An arbitrary file read vulnerability exists in OpenClaw. An attacker can use this vulnerability to read sensitive files, such as API keys and credentials, outside of the...

OpenClaw Encryption Problem Vulnerability

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw suffers from a cryptographic issue vulnerability that stems from the use of SHA-1 hashed Docker and browser sandbox configurations of the sandbox identifier cache key, which can be exploited by an attacker to enable...

OpenClaw Path Traversal Vulnerability

OpenClaw is a tool for installing skills, plugins and hooks. OpenClaw suffers from a path traversal vulnerability. An attacker can exploit this vulnerability to achieve persistence or code execution by constructing a malicious archive file that writes to an arbitrary location file...

OpenClaw Denial of Service Vulnerability (CNVD-2026-13832)

OpenClaw is an open source framework for data acquisition. A denial of service vulnerability exists in OpenClaw. An attacker can exploit this vulnerability by triggering a memory exhaustion via an oversized response with no content-length, resulting in service unavailability...

OpenClaw PRISM: A Zero-Fork, Defense-In-Depth Runtime Security Layer for Tool-Augmented LLM Agents

Tool-augmented LLM agents introduce security risks that extend beyond user-input filtering, including indirect prompt injection through fetched content, unsafe tool execution, credential leakage, and tampering with local control files. We present OpenClaw PRISM, a zero-fork runtime security layer...

OpenClaw Command Injection Vulnerability (CNVD-2026-13801)

OpenClaw is a tool for executing restricted commands that supports controlling command execution through a whitelisting mechanism. A command injection vulnerability exists in OpenClaw. An attacker could use this vulnerability to execute unauthorized commands bypassing command restrictions...

PT-2026-25083

Summary In affected versions of openclaw, browser-originated WebSocket connections could bypass origin validation when gateway.auth.mode was set to trusted-proxy and the request arrived with proxy headers. A page served from an untrusted origin could connect through a trusted reverse proxy, inher...

OpenClaw has an unspecified vulnerability (CNVD-2026-13593)

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw has a security vulnerability that stems from an OAuth stateful authentication bypass issue in the manual Chutes login process, which can be exploited by an attacker to bypass CSRF protections for credential replacement...

OpenClaw 代码注入漏洞

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw suffers from a code injection vulnerability that can be exploited by an attacker to execute arbitrary code on the system...

OpenClaw Access Control Error Vulnerability (CNVD-2026-14395)

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw suffers from an Access Control Error vulnerability that stems from the BlueBubbles Webhook handler authenticating based only on the loopback remoteAddress, which can be exploited by an attacker to cause bypass of the...

PT-2026-24945

A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version...

OpenClaw Denial of Service Vulnerability (CNVD-2026-13552)

OpenClaw is software for processing base64 encoded media input. A denial of service vulnerability exists in OpenClaw. An attacker can exploit this vulnerability to cause a denial of service by constructing an oversized base64 load that triggers a memory exhaustion...

OpenClaw Access Control Error Vulnerability (CNVD-2026-13588)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an Access Control Error vulnerability that stems from the fact that Browser Relay's /cdp WebSocket endpoint does not require an authentication token, which can be exploited by an attacker to connect in...

PT-2026-29237

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.8 Description The software contains a sender allowlist bypass issue in its Microsoft Teams plugin. This allows unauthorized senders to circumvent authorization checks. Specifically, when a team/channel route...

OpenClaw path traversal vulnerability (CNVD-2026-13551)

OpenClaw is an agent tool for managing session logs. OpenClaw suffers from a path traversal vulnerability. An attacker can exploit this vulnerability by... /... /etc/passwd, etc. to read and write arbitrary files outside of the agent's session directory...

OpenClaw File Inclusion Vulnerability

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw suffers from a file inclusion vulnerability. An attacker can exploit this vulnerability to read arbitrary files in the local file system...

PT-2026-29229

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.8 Description The software contains an approval bypass issue in the system.run function where mutable script operands are not properly bound during the approval and execution stages. This allows attackers to...

OpenClaw has an unspecified vulnerability (CNVD-2026-13589)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that stems from the use of non-constant time string comparisons for hook token validation, which can be exploited by an attacker to infer a token via a timed side channel...

OpenClaw Identity Forgery Vulnerability

OpenClaw is an open source framework for Telegram bot rights management. OpenClaw suffers from an identity forgery vulnerability. An attacker can exploit this vulnerability to illegally manipulate bots by recycling usernames to disguise their identities and bypass privilege restrictions...