CVE-2026-53325 affecting package kernel for versions less than 6.6.144.1-1

CVE-2026-53325 affecting package kernel for versions less than 6.6.144.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53138 affecting package kernel for versions less than 6.6.144.1-1

CVE-2026-53138 affecting package kernel for versions less than 6.6.144.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53362 affecting package kernel for versions less than 6.6.144.1-1

CVE-2026-53362 affecting package kernel for versions less than 6.6.144.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53163 affecting package kernel for versions less than 6.6.144.1-1

CVE-2026-53163 affecting package kernel for versions less than 6.6.144.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-52928 affecting package kernel for versions less than 6.6.144.1-1

CVE-2026-52928 affecting package kernel for versions less than 6.6.144.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53157 affecting package kernel for versions less than 6.6.144.1-1

CVE-2026-53157 affecting package kernel for versions less than 6.6.144.1-1. An upgraded version of the package is available that resolves this issue...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization in the moderation actions. An attacker can perform unauthorized moderation actions by sending requests as a lower-trust user or through a configured input path...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization in the message actions. An attacker can perform unauthorized actions by sending requests as a lower-trust user or through a configured input path when the feature is...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the cron. An attacker can gain unauthorized access to restricted execution tools and perform actions with elevated privileges by leveraging misconfigured input...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper filtering of environment variables in the host exec. An attacker can gain elevated privileges or execute unauthorized actions by supplyin...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the exec-server. An attacker can access internal network resources that are intended to be restricted by sending crafted HTTP requests through the...

Insertion of Sensitive Information into Log File

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the trajectory export. An attacker can access sensitive credentials and data by exploiting misconfigured input paths or feature...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via insufficient policy checks on configured input paths. An attacker can gain unauthorized access to admin-level tools and perform privileged actions by sending...

Insufficiently Protected Credentials

Overview @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the serviceUrl parameter validation. An attacker can access sensitive authentication data by supplying crafted serviceUrl values...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the media upload. An attacker can access unauthorized network resources by submitting crafted input paths that are processed by the upload feature. Th...

Origin Validation Error

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Origin Validation Error via the HTTP Canvas response. An attacker can gain unauthorized access to actions requiring higher authorization by submitting crafted requests through configured...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the agent-mode dispatch. An attacker can gain unauthorized access to restricted actions by exploiting the lack of proper policy checks when this feature is...

Allocation of Resources Without Limits or Throttling

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the configured input path. An attacker can exhaust gateway worker resources and reduce availability by supplying specially crafted...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the allowedAgentIds validation. An attacker can gain unauthorized access to restricted actions by submitting blank agent IDs, thereby bypassing intended...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the allowFrom feature of ClickClack. An attacker can gain unauthorized access to execute or persist actions beyond their intended authorization, including runni...