PT-2026-38249

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.22 Description A server-side request forgery SSRF issue exists in the Zalo plugin. The sendPhoto function fails to validate outbound photo URLs through the SSRF guard. This allows attackers to bypass protectio...

PT-2026-38240

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.15 Description The software captures resolved bearer-auth configuration during startup, which allows revoked tokens to remain valid after a SecretRef rotation. The Gateway HTTP and WebSocket handlers do not...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.15 contained security vulnerabilities. These vulnerabilities stemmed from capturing a resolved bearer-auth configuration during initialization, which could allow revoked tokens ...

The vulnerability of the MS Teams extension of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) allows a hacker to disclose protected information.

The vulnerability of the MS Teams extension of the AI agent OpenClaw formerly known as ClawdBot or MoltBot relates to the disclosure of information during data transmission. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...

The vulnerability of the `system.run` command in the OpenClaw AI-agent (formerly known as ClawdBot or MoltBot) allows a attacker to execute arbitrary commands.

The vulnerability of the system.run command in the OpenClaw AI-agent formerly known as ClawdBot or MoltBot is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.10 contained security vulnerabilities. These vulnerabilities stemmed from insufficient blacklists for execution environment policy environment variables, which might allow...

PT-2026-38247

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.20 Description OpenClaw fails to properly reserve the OPENCLAW runtime-control environment namespace in workspace dotenv files. This allows attackers to override critical runtime variables. For instance,...

PT-2026-38244

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.15 Description An arbitrary file read issue exists in the QMD backend memory get function. Attackers with access to the memory tool can bypass path restrictions by providing arbitrary workspace Markdown paths,...

The vulnerability of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) arises from an incorrect restriction on the path name to the restricted-access catalog, allowing a violator to read and modify arbitrary files.

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to an incorrect restriction on the path name when accessing a restricted catalog during the processing of parameters sessionId and sessionFile. Exploiting this vulnerability allows an attacker to read and...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw from 2026.4.10 to 2026.4.14 contained a security vulnerability. This vulnerability stemmed from the failure of the media replay delivery queue to persistently maintain session context during...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.10 contained security vulnerabilities. These vulnerabilities were caused by insufficient routing access control in the Nostr plugin’s HTTP configuration file, which might allow...

OpenClaw 输入验证错误漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.5 had a vulnerability related to input validation errors. This vulnerability stemmed from server-side request forgery in the CDP/json/version WebSocket endpoint, which might all...

OpenClaw 代码问题漏洞

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a server-side request forgery vulnerability that can be exploited by an attacker to gain unauthorized access to internal resources by providing a malicious photo URL to the Zalo Bot API to bypass SSRF...

OpenClaw 安全漏洞

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that stems from the failure of the OpenShell file system bridge to properly validate symbolic link exchanges when handling file system operations, which can be exploited by an...

PT-2026-38239

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10 Description An insufficient environment variable denylist in the exec environment policy allows operator-supplied overrides of high-risk interpreter startup variables. Specifically, the variables VIMINIT,...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.10 contained security vulnerabilities. These vulnerabilities were caused by improper binding of the sandbox browser CDP relay network, which may allow attackers to access the...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.22 contained security vulnerabilities. These vulnerabilities stemmed from race conditions between the time of writing and the time of execution in the OpenShell sandbox file...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.10 contained security vulnerabilities. These vulnerabilities were due to browser navigation strategies that involved server-side request forgeing, which potentially allowed...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.15 contained security vulnerabilities. These vulnerabilities stemmed from the QMD backend’s memoryget function, which allowed arbitrary file reading, potentially enabling caller...

OpenClaw 安全漏洞

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that stems from a failure to properly preserve the OPENCLAWRuntime Control Environment namespace in the workspace dotenv file, which can be exploited by an attacker to manipula...