EUVD-2026-89106

OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files from sibling session sandboxes or shared...

CVE-2026-102806

OpenClaw versions before 2026.9.5 are affected by an incorrect authorization vulnerability in the Gateway's local media root allowlist. This flaw breaks filesystem isolation between sandboxed sessions, allowing sandboxed sessions or untrusted content to read files from sibling session sandboxes o...

CVE-2026-102806 OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines

OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files from sibling session sandboxes or shared...

CVE-2026-102806 OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines

OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files from sibling session sandboxes or shared...

openclaw_vulnerabilities_and_solutions

OpenClaw — 脆弱性、堅牢化、およびVPSデプロイ VPS上でのOpenClawの安全なデプロイに関するサニタイズ済み公開ドキュメント: アクセスアーキテクチャ、既知の脆弱性、および解決策付きの実践的なインシデント。 実際のOpenClaw運用から得られた公開・サニタイズ済みドキュメント: ゲートウェイを公開せずにVPSへプラットフォームをデプロイする方法、実際に重要となるCVE/問題、そして本番環境で発生した障害（修正策付き）。 現在のバージョン: v1.2 · 変更履歴 · GitHub Releases このリポジトリについて | RU| EN ---|---|---...

CVE-2026-25253

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw 1-Click リモートコード実行 PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e 説明 CVE-2026-25253 : OpenClaw 認証トークン外部流出の脆弱性 説明: OpenClaw（別名 clawdbot または Moltbot）v2026.1.29 より前のバージョンでは、攻撃者が細工した gatewayUrl クエリ文字列値...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

セキュリティアドバイザリ: 未認証の格納型クロスサイトスクリプティングによる管理者アカウント乗っ取り openclaw-dashboard タイトル: OpenClaw Dashboard v3.0.0 におけるログイン失敗時のユーザー名フィールドを介した格納型XSS 割り当てCVE ID: CVE-2026-66418 対象リポジトリ: https://github.com/tugcantopaloglu/openclaw-dashboard 概要...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via reusable exec approvals that fail to bind the working directory context to the approval record. When an operator grants an allow-always approval for a command,...

Missing Authorization

Overview @openclaw/diagnostics-prometheus is an OpenClaw diagnostics Prometheus exporter for runtime metrics. Affected versions of this package are vulnerable to Missing Authorization via the authenticated metrics endpoint, which does not enforce the operator.read scope. An authenticated caller...

Insertion of Sensitive Information into Log File

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the OpenAI-compatible transport layer, when a pinned third-party provider session whose resolved model metadata lacks a concrete base...

Missing Authorization

Overview @openclaw/discord is an OpenClaw Discord channel plugin Affected versions of this package are vulnerable to Missing Authorization via the emoji and sticker upload actions, which drop the sender-scoped media policy before loading a local file. A sender permitted to invoke those actions ca...

Authorization Bypass Through User-Controlled Key

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the download-file handler, which fails open when a file lacks the share metadata used to prove it belongs to the requested conversatio...

Allocation of Resources Without Limits or Throttling

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Browser extension relay, which reserves entries in a single global pending-authentication pool before a client proves possessi...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via glob metacharacter interpretation and node display name reuse in file-transfer allow-always approvals. When an operator approves a file-transfer request, a lat...

Incorrect Behavior Order: Validate Before Canonicalize

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via incorrect classification of alternate file: URL spellings in the Agent Client Protocol ACP handler. Alternate but valid file: UR...

Insertion of Sensitive Information into Log File

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the memory embedding failover logic, where the primary embedding provider's configured API key is reused when a request is redirected ...

Directory Traversal

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via double-decoding of QQBot voice attachment filenames, where encoded traversal segments reappear after sanitization. An attacker who can supply a voice attachment...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the /mcp set and /mcp unset chat commands, which fail to enforce owner-level authorization checks on non-owner external-channel senders. An authenticated non-own...

CVE-2026-100595

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive diagnostic details about the host, configuration, runtime, and...

CVE-2026-100596

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host...