10621 matches found
CVE-2026-100583
OpenClaw Discord versions before 2026.7.1 are impacted by an authorization bypass vulnerability within guild metadata read actions. The root cause allows lower-trust senders to bypass the configured Discord read-target policy , enabling unauthorized retrieval of guild metadata from servers or cha...
EUVD-2026-87468
OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-target policy to access guild metadata fr...
CVE-2026-100583
OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-target policy to access guild metadata fr...
EUVD-2026-87467
OpenClaw is an npm-distributed agent runtime. In versions = 2026.2.26 and 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory...
CVE-2026-100584 OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
OpenClaw is an npm-distributed agent runtime. In versions = 2026.2.26 and 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory...
CVE-2026-100584 OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
OpenClaw is an npm-distributed agent runtime. In versions = 2026.2.26 and 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory...
CVE-2026-100583 OpenClaw Discord before 2026.7.1 Authorization Bypass
OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-target policy to access guild metadata fr...
CVE-2026-100584 OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
OpenClaw is an npm-distributed agent runtime. In versions = 2026.2.26 and 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory...
@0xwork/connect (>=0.1.8, <=0.1.9), @chrysb/alphaclaw (>=0.8.7, <=0.9.29) +12 more potentially affected by CVE-2026-100584 via openclaw (>=2026.4.5, <=2026.6.33)
openclaw NPM version =2026.4.5, =0.1.8, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =1.1.50, =2.1.8, =0.1.0, =0.0.1-release20260506, =0.1.38, =1.0.0, =1.3.1 Source cves: CVE-2026-100584 Source advisory: MEND:CVE-2026-100584...
CVE-2026-100584
OpenClaw is an npm-distributed agent runtime. In versions = 2026.2.26 and 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory...
CVE-2026-100584
The OpenClaw npm-distributed agent runtime (versions >= 2026.2.26 and
EUVD-2026-87469
OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...
CVE-2026-100582 OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass
OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...
CVE-2026-100582
OpenClaw channel plugins (@openclaw/msteams , @openclaw/feishu , @openclaw/matrix , and @openclaw/googlechat ) versions prior to 2026.8.1 fail to enforce configured channel read allowlists for caller-supplied explicit read targets. This flaw affects actions involving messages, reactions, pins, me...
CVE-2026-100582
OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...
CVE-2026-100582 OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass
OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...
CVE-2026-100582 OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass
OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...
CVE-2026-100581 OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension
OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operat...
CVE-2026-100581 OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension
OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operat...
EUVD-2026-87470
OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operat...