10621 matches found
CVE-2026-100562 OpenClaw before 2026.8.1 Authorization Bypass via sessions.create
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provide...
@0xwork/connect (>=0.1.8, <=0.1.9), @chrysb/alphaclaw (>=0.8.7, <=0.9.34) +14 more potentially affected by CVE-2026-100562 via openclaw (>=0.0.1, <=2026.7.1)
openclaw NPM version =0.0.1, =0.1.8, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =1.1.50, =2.1.8, =0.1.0, =0.0.1-release20260506, =0.1.38, =0.3.1-next.0, =1.0.0, =1.3.1 and more Source cves: CVE-2026-100562 Source advisory: MEND:CVE-2026-100562...
CVE-2026-100562
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provide...
CVE-2026-100562
OpenClaw versions prior to 2026.8.1 are vulnerable to an authorization bypass in the sessions.create endpoint. This flaw allows callers with operator.write credentials to modify session configurations restricted to the operator.admin scope. Affected parameters include the session model, provider,...
CVE-2026-100561 OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
OpenClaw npm package 'openclaw' versions = 2026.3.22 and 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign...
CVE-2026-100560 OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval...
EUVD-2026-87490
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval...
CVE-2026-100561 OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
OpenClaw npm package 'openclaw' versions = 2026.3.22 and 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign...
EUVD-2026-87489
OpenClaw npm package 'openclaw' versions = 2026.3.22 and 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign...
CVE-2026-100560 OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval...
CVE-2026-100560 OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval...
CVE-2026-100561 OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
OpenClaw npm package 'openclaw' versions = 2026.3.22 and 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign...
@0xwork/connect (>=0.1.8, <=0.1.9), @chrysb/alphaclaw (>=0.8.7, <=0.9.34) +13 more potentially affected by CVE-2026-100561 via openclaw (>=2026.4.5, <=2026.7.1)
openclaw NPM version =2026.4.5, =0.1.8, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =1.1.50, =2.1.8, =0.1.0, =0.0.1-release20260506, =0.1.38, =0.3.1-next.0, =1.0.0, =1.3.1 Source cves: CVE-2026-100561 Source advisory: MEND:CVE-2026-100561...
@0xwork/connect (>=0.1.8, <=0.1.9), @chrysb/alphaclaw (>=0.8.7, <=0.9.34) +14 more potentially affected by CVE-2026-100560 via openclaw (>=0.0.1, <=2026.7.1)
openclaw NPM version =0.0.1, =0.1.8, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =1.1.50, =2.1.8, =0.1.0, =0.0.1-release20260506, =0.1.38, =0.3.1-next.0, =1.0.0, =1.3.1 and more Source cves: CVE-2026-100560 Source advisory: MEND:CVE-2026-100560...
CVE-2026-100561
OpenClaw npm package 'openclaw' versions = 2026.3.22 and 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign...
CVE-2026-100560
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval...
CVE-2026-100560
Versions of OpenClaw before 2026.8.1 on macOS and Linux are vulnerable to an authorization bypass due to how
CVE-2026-100561
The OpenClaw (npm package 'openclaw' ) versions >= 2026.3.22 and
CVE-2026-100559 OpenClaw before 2026.8.1 Command Injection via Escaped Newlines
OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected...
EUVD-2026-87491
OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected...