OpenClaw security vulnerabilities

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw suffers from a file inclusion vulnerability. An attacker can exploit this vulnerability to read arbitrary files in the local file system...

Number withdrawal

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. This CVE number has been withdrawn...

OpenClaw path traversal vulnerability

OpenClaw is an agent tool for managing session logs. OpenClaw suffers from a path traversal vulnerability. An attacker can exploit this vulnerability by... /... /etc/passwd, etc. to read and write arbitrary files outside of the agent's session directory...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.13 had security vulnerabilities. These vulnerabilities stemmed from the use of non-constant time string comparisons in hook token verification, which could allow attackers to infer tokens through...

OpenClaw path traversal vulnerability

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw suffers from a directory traversal vulnerability that can be exploited by an attacker to write files outside of the expected temporary directory via path traversal...

OpenClaw security vulnerabilities

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that stems from the use of non-constant time string comparisons for hook token validation, which can be exploited by an attacker to infer a token via a timed side channel...

OpenClaw security vulnerabilities

OpenClaw is used to handle Webhook events open source framework . A denial of service vulnerability exists in OpenClaw. An attacker can exploit this vulnerability to cause the service to become unavailable by sending an oversized JSON load or slow uploads that trigger memory pressure...

OpenClaw parameter injection vulnerability

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw suffers from a parameter injection vulnerability that can be exploited by an attacker to execute arbitrary commands by injecting command substitution syntax...

OpenClaw security vulnerabilities

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an information disclosure vulnerability that originates when the MS Teams attachment downloader, when retrying to download after receiving a 401 or 403 response, sends an authorization bearer token to ...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.14 had security vulnerabilities. These vulnerabilities stemmed from the gateway not clearing the internal approval fields in the node.invoke parameters. This could allow attackers with valid gateway...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw from 2026.1.14 to 2026.2.12 had security vulnerabilities. These vulnerabilities stemmed from improper network binding in the Chrome extension relay servers, which could cause the relay HTTP/WS servers to be bound to...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.1 contained security vulnerabilities. These vulnerabilities stemmed from an authentication bypass in the inbound allowlist policy validation mechanism, which could allow remote attackers to circumven...

OpenClaw code issues and vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.14 had code-related vulnerabilities. These vulnerabilities stemmed from a server-side request forgeing vulnerability in the Feishu extension, which could allow attackers to obtain control of remote...

OpenClaw path traversal vulnerability

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.1 had a path traversal vulnerability. This vulnerability stemmed from path traversal during plugin installation, which could allow attackers to write files outside of the expected installation...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.1 contained security vulnerabilities. These vulnerabilities stemmed from Twitch plugins that did not enforce the allowFrom permission list properly, allowing remote attackers to bypass access control...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.14 contained security vulnerabilities. These vulnerabilities stemmed from the Slack slash command processor’s lack of proper permissions handling, which could lead to bypassing whitelists and access...

OpenClaw security vulnerabilities

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw suffers from a directory traversal vulnerability that can be exploited by an attacker to cause data to be written to an arbitrary location on the host file system...

OpenClaw code issues and vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw from 2.0.0-beta3 up to 2026.2.14 contained code vulnerabilities. These vulnerabilities stemmed from path traversal issues during the loading of the hook transform module, which could allow execution of arbitrary...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.2 contained security vulnerabilities. These vulnerabilities stemmed from the ability to bypass the DM permission list matching in the Matrix plugin, allowing remote Matrix users to impersonate...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.6 contained security vulnerabilities. These vulnerabilities stemmed from a flaw in permission list validation, which allowed equal matches for the variable actor.name field. This could allow attacker...