1. Conduid
  2. Security
  3. OpenClawCVEs
MCP server · Security

OpenClawCVEs

· github.com/jgamblin/OpenClawCVEs

Tracking OpenClaw CVEs

Unclaimed security
InstallView source
52Fair

Scored 5 months ago · breakdown

About OpenClawCVEs

OpenClawCVEs is an MCP server in the Security category: tracking OpenClaw CVEs.

Install

From source
git clone https://github.com/jgamblin/OpenClawCVEs

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about OpenClawCVEs

Powered by Claude · Grounded in docs

I know everything about OpenClawCVEs. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

  • ✓README presentThe repository ships documentation.

5 checks have not been run yet.

README

🛡️ OpenClaw CVE & Security Advisory Tracker

An automated tracker that continuously monitors OpenClaw security advisories across the GitHub Advisory Database, repo-level security advisories, and the CVE V5 (cvelistV5) registry. Every hour it pulls the latest data, reconciles GHSA → CVE publication state, and regenerates this dashboard so you always have an up-to-date picture of the project's vulnerability landscape.

🏗️ Project Identity

Field Value
Current Name OpenClaw
Previous Names Moltbot (second name), Clawdbot (original name)
Repository openclaw/openclaw
npm Package openclaw (formerly clawdbot)
Author Peter Steinberger (steipete)

To find all CVEs, search for: openclaw, clawdbot, moltbot, clawhub, pkg:npm/clawdbot, pkg:npm/openclaw

🚀 CVEs Published in cvelistV5 (40)

These CVEs have full records in the CVEProject/cvelistV5 repository:

CVE ID Severity CVSS Title CWE Published
CVE-2026-43534 Critical 9.3 OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events CWE-345 2026-05-05
CVE-2026-43566 Critical 9.1 OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events CWE-184 2026-05-05
CVE-2026-43533 High 8.9 OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags CWE-23 2026-05-05
CVE-2026-25253 High 8.8 OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CWE-669 2026-02-01
CVE-2026-24763 High 8.8 OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable CWE-78 2026-02-02
CVE-2026-28478 High 8.7 OpenClaw affected by denial of service via unbounded webhook request body buffering CWE-770 2026-03-05
CVE-2026-42435 High 8.7 OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms CWE-184 2026-05-05
CVE-2026-42434 High 8.7 OpenClaw: Sandboxed agents could escape exec routing via host=node override CWE-863 2026-05-05
CVE-2026-43530 High 8.7 OpenClaw: busybox and toybox applet execution weakened exec approval binding CWE-863 2026-05-05
CVE-2026-43526 High 8.3 OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes CWE-918 2026-05-05
CVE-2026-28469 High 8.2 OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting CWE-639 2026-03-05
CVE-2026-42437 High 8.2 OpenClaw: Voice-call realtime WebSocket accepted oversized frames CWE-770 2026-05-05
CVE-2026-25157 High 7.8 OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand CWE-78 2026-02-04
CVE-2026-43571 High 7.7 OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows CWE-829 2026-05-05
CVE-2026-43569 High 7.7 OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins CWE-829 2026-05-05
CVE-2026-43535 High 7.6 OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches CWE-266 2026-05-05
CVE-2026-28458 High 7.4 OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access CWE-306 2026-03-05
CVE-2026-26317 High 7.1 OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints CWE-352 2026-02-19
CVE-2026-42433 High 7.1 OpenClaw: Matrix profile config persistence was reachable from operator.write message tools CWE-862 2026-05-05
CVE-2026-43528 High 7.1 OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases CWE-212 2026-05-05
CVE-2026-43567 High 7.1 OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter CWE-862 2026-05-05
CVE-2026-43568 High 7.1 OpenClaw: Memory dreaming config persistence was reachable from operator.write commands CWE-862 2026-05-05
CVE-2026-43531 High 7 OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File CWE-15 2026-05-05
CVE-2026-28480 Medium 6.9 OpenClaw Telegram allowlist authorization accepted mutable usernames CWE-290 2026-03-05
CVE-2026-29612 Medium 6.8 OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding CWE-770 2026-03-05
CVE-2026-28452 Medium 6.7 OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR) CWE-770 2026-03-05
CVE-2026-26328 Medium 6.5 OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities CWE-284, CWE-863 2026-02-19
CVE-2026-41389 Medium 6.3 OpenClaw: Webchat media embedding enforces local-root containment for tool-result files CWE-73 2026-04-20
CVE-2026-43527 Medium 6.3 OpenClaw: Browser SSRF policy default allowed private-network navigation CWE-918, CWE-1188 2026-05-05
CVE-2026-43572 Medium 6.3 OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks CWE-862 2026-05-05
CVE-2026-43574 Medium 6 OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists CWE-183 2026-05-05
CVE-2026-42439 Medium 4.9 OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes CWE-862 2026-05-05
CVE-2026-42436 Medium 4.9 OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation CWE-862 2026-05-05
CVE-2026-42438 Medium 4.9 OpenClaw: Sender policy bypass in host media attachment reads allows unauthorized local file disclosure CWE-863 2026-05-05
CVE-2026-43532 Medium 4.9 OpenClaw: Discord event cover images bypassed sandbox media normalization CWE-184 2026-05-05
CVE-2026-43573 Medium 4.9 OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement CWE-862, CWE-918 2026-05-05
CVE-2026-41358 Low 2.3 OpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Context CWE-346 2026-04-23
CVE-2026-41908 Low 2.3 OpenClaw < 2026.4.20 - Scope Enforcement Bypass in Assistant-Media Route CWE-863 2026-04-23
CVE-2026-43529 Low 2 OpenClaw: TOCTOU read in exec script preflight CWE-367 2026-05-05

CVE-2026-43534 — OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events

Field Detail
CVSS 9.3 (CRITICAL) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CWE CWE-345 (CWE-345: Insufficient Verification of Data Authenticity)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-7g8c-cfr3-vqqr

OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context.

References:

CVE-2026-43566 — OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events

Field Detail
CVSS 9.1 (CRITICAL) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CWE CWE-184 (CWE-184: Incomplete List of Disallowed Inputs)
Affected < 2026.4.14
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-g2hm-779g-vm32

OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content. Attackers can exploit this by sending untrusted webhook wake events to preserve owner-like execution context when the run should have been downgraded.

References:

CVE-2026-43533 — OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags

Field Detail
CVSS 8.9 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CWE CWE-23 (CWE-23: Relative Path Traversal)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-66r7-m7xm-v49h

OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storage boundary. Attackers can craft malicious reply text containing media tags to disclose arbitrary local files through outbound media handling.

References:

CVE-2026-25253 — OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl

Field Detail
CVSS 8.8 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE CWE-669 (CWE-669 Incorrect Resource Transfer Between Spheres)
Affected < 2026.1.29
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-g8p2-7wf7-98mq

OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.

Naming note: Uses all three names in description. packageURL still references pkg:npm/clawdbot. References:

CVE-2026-24763 — OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable

Field Detail
CVSS 8.8 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE CWE-78 (CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
Affected < 2026.1.29
Vendor/Product clawdbot / clawdbot
Advisory GHSA-mc68-q9jw-2h3v

OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An authenticated user able to control environment variables could influence command execution within the container context. This vulnerability is fixed in 2026.1.29.

Naming note: Uses old name clawdbot/clawdbot as vendor/product. References:

CVE-2026-28478 — OpenClaw affected by denial of service via unbounded webhook request body buffering

Field Detail
CVSS 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE CWE-770 (Allocation of Resources Without Limits or Throttling)
Affected < 2026.2.13
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-q447-rj3r-2cgh

OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits. Remote unauthenticated attackers can send oversized JSON payloads or slow uploads to webhook endpoints causing memory pressure and availability degradation.

References:

CVE-2026-42435 — OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms

Field Detail
CVSS 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE CWE-184 (CWE-184: Incomplete List of Disallowed Inputs)
Affected < 2026.4.12
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-j6c7-3h5x-99g9

OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at the argv level. Attackers can bypass exec preflight handling to manipulate high-risk shell variables like SHELLOPTS and PS4, affecting execution semantics and security controls.

References:

CVE-2026-42434 — OpenClaw: Sandboxed agents could escape exec routing via host=node override

Field Detail
CVSS 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE CWE-863 (CWE-863: Incorrect Authorization)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-736r-jwj6-4w23

OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node. Attackers can bypass sandbox boundaries and route execution to remote nodes instead of intended sandbox paths.

References:

CVE-2026-43530 — OpenClaw: busybox and toybox applet execution weakened exec approval binding

Field Detail
CVSS 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE CWE-863 (CWE-863: Incorrect Authorization)
Affected < 2026.4.12
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-2cq5-mf3v-mx44

OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obscure which applet would actually run. Attackers can exploit opaque multi-call binaries to bypass exec approval mechanisms and weaken risk classification of unsafe applet invocations.

References:

CVE-2026-43526 — OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes

Field Detail
CVSS 8.3 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CWE CWE-918 (CWE-918 Server-Side Request Forgery (SSRF))
Affected < 2026.4.12
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-2767-2q9v-9326

OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fetched bytes subsequently re-uploaded through the channel.

References:

CVE-2026-28469 — OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting

Field Detail
CVSS 8.2 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE CWE-639 (Authorization Bypass Through User-Controlled Key)
Affected < 2026.2.14
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-rq6g-px6m-c248

OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misrouting when multiple webhook targets share the same HTTP path. Attackers can exploit first-match request verification semantics to process inbound webhook events under incorrect account contexts, bypassing intended allowlists and session policies.

References:

CVE-2026-42437 — OpenClaw: Voice-call realtime WebSocket accepted oversized frames

Field Detail
CVSS 8.2 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE CWE-770 (CWE-770: Allocation of Resources Without Limits or Throttling)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-vw3h-q6xq-jjm5

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unavailability for deployments exposing the webhook path.

References:

CVE-2026-25157 — OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand

Field Detail
CVSS 7.8 (HIGH) — CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE CWE-78 (CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
Affected < 2026.1.29
Vendor/Product openclaw / openclaw
Advisory GHSA-q284-4pvr-m585

OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When the cd command failed, the unescaped path was interpolated directly into an echo statement, allowing arbitrary command execution on the remote SSH host. The parseSSHTarget function did not validate that SSH target strings could not begin with a dash. An attacker-supplied target like -oProxyCommand=... would be interpreted as an SSH configuration flag rather than a hostname, allowing arbitrary command execution on the local machine. This issue has been patched in version 2026.1.29.

CVE-2026-43571 — OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows

Field Detail
CVSS 7.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE CWE-829 (CWE-829: Inclusion of Functionality from Untrusted Control Sphere)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-82qx-6vj7-p8m2

OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins. Attackers can exploit this by crafting malicious workspace plugins that bypass intended trust gates during setup-time plugin loading.

References:

CVE-2026-43569 — OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins

Field Detail
CVSS 7.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE CWE-829 (CWE-829: Inclusion of Functionality from Untrusted Control Sphere)
Affected < 2026.4.9
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-939r-rj45-g2rj

OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider auth choices are shadowed. Attackers can exploit this by crafting malicious workspace plugins that are automatically selected and enabled during authentication setup without explicit user consent.

References:

CVE-2026-43535 — OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches

Field Detail
CVSS 7.6 (HIGH) — CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CWE CWE-266 (CWE-266: Incorrect Privilege Assignment)
Affected < 2026.4.14
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-jwrq-8g5x-5fhm

OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final sender's authorization context. Attackers can exploit this by sending multiple queued messages to drain batches using a more privileged sender's context, causing earlier messages to execute with elevated permissions.

References:

CVE-2026-28458 — OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access

Field Detail
CVSS 7.4 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CWE CWE-306 (Missing Authentication for Critical Function)
Affected < 2026.2.1
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-mr32-vwc2-5j6h

OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing websites to connect via loopback and access sensitive data. Attackers can exploit this by connecting to ws://127.0.0.1:18792/cdp to steal session cookies and execute JavaScript in other browser tabs.

References:

CVE-2026-26317 — OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints

Field Detail
CVSS 7.1 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
CWE CWE-352 (CWE-352: Cross-Site Request Forgery (CSRF))
Affected <= 2026.1.24-3
Vendor/Product openclaw / clawdbot
Advisory GHSA-3fqr-4cg8-h96q

OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins. A malicious website can trigger unauthorized state changes against a victim's local OpenClaw browser control plane (for example opening tabs, starting/stopping the browser, mutating storage/cookies) if the browser control service is reachable on loopback in the victim's browser context. Starting in version 2026.2.14, mutating HTTP methods (POST/PUT/PATCH/DELETE) are rejected when the request indicates a non-loopback Origin/Referer (or Sec-Fetch-Site: cross-site). Other mitigations include enabling browser control auth (token/password) and avoid running with auth disabled.

Naming note: Uses old name openclaw/clawdbot as vendor/product. References:

CVE-2026-42433 — OpenClaw: Matrix profile config persistence was reachable from operator.write message tools

Field Detail
CVSS 7.1 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE CWE-862 (CWE-862 Missing Authorization)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-7jp6-r74r-995q

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner message-tool runs.

References:

CVE-2026-43528 — OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases

Field Detail
CVSS 7.1 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CWE CWE-212 (CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer)
Affected < 2026.4.14
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-8372-7vhw-cm6q

OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted.

References:

CVE-2026-43567 — OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter

Field Detail
CVSS 7.1 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE CWE-862 (CWE-862 Missing Authorization)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-jf25-7968-h2h5

OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system.

References:

CVE-2026-43568 — OpenClaw: Memory dreaming config persistence was reachable from operator.write commands

Field Detail
CVSS 7.1 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE CWE-862 (CWE-862 Missing Authorization)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-5gjc-grvm-m88j

OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming settings. Attackers with write-scoped gateway access can toggle admin-class configuration mutations through the /dreaming endpoint to escalate privileges.

References:

CVE-2026-43531 — OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File

Field Detail
CVSS 7 (HIGH) — CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE CWE-15 (CWE-15: External Control of System or Configuration Setting)
Affected < 2026.4.9
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-7wv4-cc7p-jhxc

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser executable paths to compromise application behavior.

References:

CVE-2026-28480 — OpenClaw Telegram allowlist authorization accepted mutable usernames

Field Detail
CVSS 6.9 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CWE CWE-290 (Authentication Bypass by Spoofing)
Affected < 2026.2.14
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-mj5r-hh7j-4gxf

OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled usernames to bypass allowlist restrictions and interact with bots as unauthorized senders.

References:

CVE-2026-29612 — OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding

Field Detail
CVSS 6.8 (MEDIUM) — CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE CWE-770 (Allocation of Resources Without Limits or Throttling)
Affected < 2026.2.14
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-w2cg-vxx6-5xjg

OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service.

References:

CVE-2026-28452 — OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)

Field Detail
CVSS 6.7 (MEDIUM) — CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE CWE-770 (Allocation of Resources Without Limits or Throttling)
Affected < 2026.2.14
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-h89v-j3x9-8wqj

OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource exhaustion by providing maliciously crafted archive files during install or update operations, causing service degradation or system unavailability.

References:

CVE-2026-26328 — OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities

Field Detail
CVSS 6.5 (MEDIUM) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE CWE-284 (CWE-284: Improper Access Control), CWE-863 (CWE-863: Incorrect Authorization)
Affected <= 2026.1.24-3
Vendor/Product openclaw / clawdbot
Advisory GHSA-g34w-4xqq-h79m

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage groupPolicy=allowlist, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.

Naming note: Uses old name openclaw/clawdbot as vendor/product. References:

CVE-2026-41389 — OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

Field Detail
CVSS 6.3 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CWE CWE-73 (CWE-73: External Control of File Name or Path)
Affected < 2026.4.15
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-mr34-9552-qr95

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. Attackers can craft malicious tool-result media references to trigger host-side file reads or Windows network path access, potentially disclosing sensitive files or exposing credentials.

References:

CVE-2026-43527 — OpenClaw: Browser SSRF policy default allowed private-network navigation

Field Detail
CVSS 6.3 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CWE CWE-918 (CWE-918 Server-Side Request Forgery (SSRF)), CWE-1188 (CWE-1188 Initialization of a Resource with an Insecure Default)
Affected < 2026.4.14
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-53vx-pmqw-863c

OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration to access internal services or metadata endpoints through browser-driven requests.

References:

CVE-2026-43572 — OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks

Field Detail
CVSS 6.3 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CWE CWE-862 (CWE-862 Missing Authorization)
Affected < 2026.4.14
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-gc9r-867r-j85f

OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks. Attackers can bypass sender authorization by sending SSO invoke requests that are processed without proper validation, allowing unauthorized access to Teams SSO signin functionality.

References:

CVE-2026-43574 — OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists

Field Detail
CVSS 6 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE CWE-183 (CWE-183: Permissive List of Allowed Inputs)
Affected < 2026.4.12
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-49cg-279w-m73x

OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval authorization. Attackers can resolve pending approvals without proper authorization by exploiting this logic flaw if they know an approval id.

References:

CVE-2026-42439 — OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes

Field Detail
CVSS 4.9 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N
CWE CWE-862 (CWE-862 Missing Authorization)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-rj2p-j66c-mgqh

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured browser SSRF policy protections by exploiting the /tabs/action endpoint to perform unauthorized tab navigation operations.

References:

CVE-2026-42436 — OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation

Field Detail
CVSS 4.9 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CWE CWE-862 (CWE-862 Missing Authorization)
Affected < 2026.4.14
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-c4qm-58hj-j6pj

OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the final browser target after navigation. Authenticated callers can bypass SSRF restrictions to expose internal or disallowed page content by exploiting route-driven navigation without proper policy re-validation.

References:

CVE-2026-42438 — OpenClaw: Sender policy bypass in host media attachment reads allows unauthorized local file disclosure

Field Detail
CVSS 4.9 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
CWE CWE-863 (CWE-863: Incorrect Authorization)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-jhpv-5j76-m56h

OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized local file disclosure. Attackers with denied read access via toolsBySender or group policy can trigger host-media attachment loading to bypass sender and group-scoped authorization boundaries and retrieve readable local files through the outbound media path.

References:

CVE-2026-43532 — OpenClaw: Discord event cover images bypassed sandbox media normalization

Field Detail
CVSS 4.9 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CWE CWE-184 (CWE-184: Incomplete List of Disallowed Inputs)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-c9h3-5p7r-mrjh

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media.

References:

CVE-2026-43573 — OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement

Field Detail
CVSS 4.9 (MEDIUM) — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CWE CWE-862 (CWE-862 Missing Authorization), CWE-918 (CWE-918 Server-Side Request Forgery (SSRF))
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-527m-976r-jf79

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement.

References:

CVE-2026-41358 — OpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Context

Field Detail
CVSS 2.3 (LOW) — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CWE CWE-346 (CWE-346: Origin Validation Error)
Affected < 2026.4.2
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-qm77-8qjp-4vcm

OpenClaw before 2026.4.2 fails to filter Slack thread context by sender allowlist, allowing non-allowlisted messages to enter agent context. Attackers can inject unauthorized thread messages through allowlisted user replies to bypass sender access controls and manipulate model context.

References:

CVE-2026-41908 — OpenClaw < 2026.4.20 - Scope Enforcement Bypass in Assistant-Media Route

Field Detail
CVSS 2.3 (LOW) — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CWE CWE-863 (CWE-863 Incorrect Authorization)
Affected < 2026.4.20
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-v8qf-fr4g-28p2

OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.read scope to access protected assistant-media files and metadata. Attackers can bypass identity-bearing HTTP auth path scope validation to retrieve sensitive media content within allowed media roots.

References:

CVE-2026-43529 — OpenClaw: TOCTOU read in exec script preflight

Field Detail
CVSS 2 (LOW) — CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CWE CWE-367 (CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition)
Affected < 2026.4.10
Vendor/Product OpenClaw / OpenClaw
Advisory GHSA-gj9q-8w99-mp8j

OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boundary checks. An attacker with workspace write access can race-condition swap the target file between validation and preflight read, causing the validator to inspect a different file identity than the one that passed the initial boundary check.

References:

⏳ CVE Publication Pipeline

Of 40 GHSAs with CVE IDs, 40 are fully published and 0 remain RESERVED.

graph LR
    A["1️⃣ GitHub Reserves<br/>CVE ID<br/><b>RESERVED</b>"] --> B["2️⃣ GHSA Goes Public<br/>with CVE ID Shown"]
    B --> C["3️⃣ CNA Submits<br/>CVE Record via<br/>CVE Services<br/><b>PUBLISHED</b>"]
    C --> D["4️⃣ cvelistV5 Bot<br/>Commits JSON File"]

    style A fill:#fee,stroke:#c33,color:#333
    style B fill:#fff3cd,stroke:#856404,color:#333
    style C fill:#d4edda,stroke:#155724,color:#333
    style D fill:#cce5ff,stroke:#004085,color:#333
CVE ID State cvelistV5 GHSA Published CNA
CVE-2026-24763 ✅ PUBLISHED ✅ 2026-02-02 GitHub_M
CVE-2026-25157 ✅ PUBLISHED ✅ 2026-02-02 GitHub_M
CVE-2026-25253 ✅ PUBLISHED ✅ 2026-02-02 mitre
CVE-2026-26317 ✅ PUBLISHED ✅ 2026-02-18 GitHub_M
CVE-2026-26328 ✅ PUBLISHED ✅ 2026-02-18 GitHub_M
CVE-2026-28452 ✅ PUBLISHED ✅ 2026-02-18 VulnCheck
CVE-2026-28458 ✅ PUBLISHED ✅ 2026-02-17 VulnCheck
CVE-2026-28469 ✅ PUBLISHED ✅ 2026-02-18 VulnCheck
CVE-2026-28478 ✅ PUBLISHED ✅ 2026-02-18 VulnCheck
CVE-2026-28480 ✅ PUBLISHED ✅ 2026-02-18 VulnCheck
CVE-2026-29612 ✅ PUBLISHED ✅ 2026-02-18 VulnCheck
CVE-2026-41358 ✅ PUBLISHED ✅ 2026-05-04 VulnCheck
CVE-2026-41389 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-41908 ✅ PUBLISHED ✅ 2026-04-25 VulnCheck
CVE-2026-42433 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-42434 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-42435 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-42436 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-42437 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-42438 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-42439 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43526 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43527 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43528 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43529 ✅ PUBLISHED ✅ 2026-04-16 VulnCheck
CVE-2026-43530 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43531 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43532 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43533 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43534 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43535 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43566 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43567 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43568 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43569 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43571 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43572 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43573 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-43574 ✅ PUBLISHED ✅ 2026-04-17 VulnCheck
CVE-2026-6011 ✅ PUBLISHED ❌ 2026-04-10 —

🔑 Key Insights

Insight Detail
Dominant Weakness 36% of categorized issues relate to Allowlist Bypass (32/89)
V5 Sync Rate 40/40 CVE IDs (100%) have full cvelistV5 records
Advisory Velocity 148 security advisories across 2026-02-02 → 2026-05-05
Top Severity 1 Critical + 47 High = 48 high-impact issues (32%)

Vulnerability Categories

Category Count Examples
OS Command Injection (CWE-78) 21 PATH injection, SSH command injection, Docker exec, keychain writes
Path Traversal (CWE-22) 8 MEDIA: paths, plugin install, browser downloads, Zip Slip, transcript paths
SSRF 12 Image tool fetch, Feishu extension, attachment/media URLs, IPv6 bypass
Auth Bypass / Missing Auth 4 WebSocket config.apply, webhook verification, browser relay, sandbox bridge
Allowlist Bypass 32 Telegram usernames, Matrix displayName, Slack DM, Twitch, voice-call
Injection (XSS/CSRF/Prompt) 8 XSS in Control UI, prompt injection via Slack/CWD/logs, CSRF
Denial of Service 4 Unbounded media fetch, webhook body buffering, archive expansion

📋 All Security Advisories (148)

Critical & High Severity

GHSA CVE Severity Title Published
GHSA-cwj3-vqpp-pmxr — High OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes 2026-05-05
GHSA-r39h-4c2p-3jxp — High OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution 2026-05-05
GHSA-wppj-c6mr-83jj — High OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root 2026-05-04
GHSA-r6xh-pqhr-v4xh — High OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens 2026-05-04
GHSA-5mh4-3rv3-fpcf — High Duplicate Advisory: OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables 2026-04-28
GHSA-5799-3xg7-rfrv — High Duplicate Advisory: OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host 2026-04-28
GHSA-394x-274p-mqc6 — High Duplicate Advisory: OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send 2026-04-24
GHSA-7vq9-42cc-33j4 — High Duplicate Advisory: OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md 2026-04-24
GHSA-gv2f-q4wp-fvh5 — High Duplicate Advisory: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials 2026-04-24
GHSA-jx3c-247h-cxwp — High Duplicate Advisory: OpenClaw: Workspace .env can override the bundled hooks root and load attacker hook code 2026-04-24
GHSA-66r7-m7xm-v49h CVE-2026-43533 High OpenClaw: QQBot media tags could read arbitrary local files through reply text 2026-04-17
GHSA-2cq5-mf3v-mx44 CVE-2026-43530 High OpenClaw: busybox and toybox applet execution weakened exec approval binding 2026-04-17
GHSA-7jp6-r74r-995q CVE-2026-42433 High OpenClaw: Matrix profile config persistence was reachable from operator.write message tools 2026-04-17
GHSA-736r-jwj6-4w23 CVE-2026-42434 High OpenClaw: Sandboxed agents could escape exec routing via host=node override 2026-04-17
GHSA-939r-rj45-g2rj CVE-2026-43569 High OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins 2026-04-17
GHSA-82qx-6vj7-p8m2 CVE-2026-43571 High OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows 2026-04-17
GHSA-vw3h-q6xq-jjm5 CVE-2026-42437 High OpenClaw: Voice-call realtime WebSocket accepted oversized frames 2026-04-17
GHSA-8372-7vhw-cm6q CVE-2026-43528 High OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases 2026-04-17
GHSA-xh72-v6v9-mwhc — Critical OpenClaw: Feishu webhook and card-action validation now fail closed 2026-04-17
GHSA-2gvc-4f3c-2855 — High OpenClaw: Matrix room control-command authorization no longer trusts DM pairing-store entries 2026-04-17
GHSA-xmxx-7p24-h892 — High OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation 2026-04-17
GHSA-525j-hqq2-66r4 — High OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0 2026-04-17
GHSA-vfp4-8x56-j7c5 — High OpenClaw: Exec environment denylist missed high-risk interpreter startup variables 2026-04-17
GHSA-r3v5-2grc-429h — High Duplicate Advisory: OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve 2026-04-10
GHSA-rq6g-px6m-c248 CVE-2026-28469 High OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting 2026-02-18
GHSA-3fqr-4cg8-h96q CVE-2026-26317 High OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints 2026-02-18
GHSA-q447-rj3r-2cgh CVE-2026-28478 High OpenClaw affected by denial of service via unbounded webhook request body buffering 2026-02-18
GHSA-mr32-vwc2-5j6h CVE-2026-28458 High OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access 2026-02-17
GHSA-q284-4pvr-m585 CVE-2026-25157 High OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand 2026-02-02
GHSA-g8p2-7wf7-98mq CVE-2026-25253 High OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl 2026-02-02
GHSA-mc68-q9jw-2h3v CVE-2026-24763 High OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable 2026-02-02
GHSA-r2c6-8jc8-g32w — High Duplicate Advisory: 1-Click RCE via Authentication Token Exfiltration From gatewayUrl 2026-02-02

Medium Severity

GHSA CVE Severity Title Published
GHSA-q8ff-7ffm-m3r9 — Medium OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload 2026-05-05
GHSA-93rg-2xm5-2p9v — Medium OpenClaw's Gateway Control UI bootstrap config required Gateway auth 2026-05-04
GHSA-5h3g-6xhh-rg6p — Medium OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes 2026-05-04
GHSA-x3h8-jrgh-p8jx — Medium OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs 2026-05-04
GHSA-55cf-xx38-4p9p — Medium OpenClaw: Workspace dotenv files cannot override connector endpoint hosts 2026-05-04
GHSA-q3jj-46pq-826r — Medium OpenClaw's ACP child sessions inherit subagent security envelope constraints 2026-05-04
GHSA-2hh7-c75g-qj2r — Medium OpenClaw validates Zalo outbound photo URLs through the SSRF guard 2026-05-04
GHSA-gfg9-5357-hv4c — Medium OpenClaw: Webchat audio embedding could read local files without local-root containment 2026-04-29
GHSA-c28g-vh7m-fm7v — Medium OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners 2026-04-29
GHSA-f5fm-9jmp-c88r — Medium Duplicate Advisory: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections 2026-04-28
GHSA-8pf2-vj79-4wxg — Medium Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API 2026-04-28
GHSA-qp56-gp47-jwj3 — Medium Duplicate Advisory: OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image 2026-04-28
GHSA-7jm2-g593-4qrc — Medium OpenClaw: Agent gateway config mutations could change protected operator settings 2026-04-25
GHSA-qrp5-gfw2-gxv4 — Medium OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy 2026-04-25
GHSA-h2vw-ph2c-jvwf — Medium OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests 2026-04-25
GHSA-mj59-h3q9-ghfh — Medium OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config 2026-04-25
GHSA-hxvm-xjvf-93f3 — Medium OpenClaw: Workspace dotenv could override runtime-control environment variables 2026-04-25
GHSA-72q8-jcmc-97wx — Medium OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy 2026-04-25
GHSA-2xcp-x87w-q377 — Medium OpenClaw: Hook mapping templates could bypass hook session-key opt-in 2026-04-25
GHSA-m563-373q-885c — Medium Duplicate Advisory: OpenClaw: OpenShell mirror mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup 2026-04-24
GHSA-6477-wvjj-47v6 — Medium Duplicate Advisory: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders 2026-04-24
GHSA-m958-864j-xq5w — Medium Duplicate Advisory: OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding 2026-04-24
GHSA-mf69-r24q-ghhr — Medium Duplicate Advisory: OpenClaw: Pairing pending-request caps were enforced per channel instead of per account 2026-04-24
GHSA-v3c2-39fm-jq4h — Medium Duplicate Advisory: OpenClaw: Gateway operator.write can reach admin-only persisted verboseLevel via chat.send /verbose 2026-04-24
GHSA-2hv5-4h3g-4hjv — Medium Duplicate Advisory: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification 2026-04-24
GHSA-cw28-63x4-37c3 — Medium Duplicate Advisory: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection 2026-04-24
GHSA-fjm8-mgc9-mf65 — Medium Duplicate Advisory: OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability 2026-04-24
GHSA-r7p2-r9g4-4xph — Medium Duplicate Advisory: OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients 2026-04-24
GHSA-w9f5-8q83-qwpx — Medium Duplicate Advisory: OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting 2026-04-24
GHSA-wcm7-94wg-h74h — Medium Duplicate Advisory: OpenClaw host-env blocklist missing GIT_TEMPLATE_DIR and AWS_CONFIG_FILE allows code execution via env override 2026-04-24
GHSA-qc5j-2mqx-x83q — Medium Duplicate Advisory: OpenClaw: Webchat media embedding enforces local-root containment for tool-result files 2026-04-20
GHSA-mr34-9552-qr95 CVE-2026-41389 Medium OpenClaw: Webchat media embedding enforces local-root containment for tool-result files 2026-04-17
GHSA-jhpv-5j76-m56h CVE-2026-42438 Medium OpenClaw: Sender policy bypass in host media attachment reads allows unauthorized local file disclosure 2026-04-17
GHSA-527m-976r-jf79 CVE-2026-43573 Medium OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement 2026-04-17
GHSA-rj2p-j66c-mgqh CVE-2026-42439 Medium OpenClaw: Browser tabs action select and close routes bypassed SSRF policy 2026-04-17
GHSA-jf25-7968-h2h5 CVE-2026-43567 Medium OpenClaw: screen_record outPath bypassed workspace-only filesystem guard 2026-04-17
GHSA-53vx-pmqw-863c CVE-2026-43527 Medium OpenClaw: Browser SSRF policy default allowed private-network navigation 2026-04-17
GHSA-2767-2q9v-9326 CVE-2026-43526 Medium OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes 2026-04-17
GHSA-7wv4-cc7p-jhxc CVE-2026-43531 Medium OpenClaw: Workspace .env could inject OpenClaw runtime-control variables 2026-04-17
GHSA-c9h3-5p7r-mrjh CVE-2026-43532 Medium OpenClaw: Discord event cover images bypassed sandbox media normalization 2026-04-17
GHSA-49cg-279w-m73x CVE-2026-43574 Medium OpenClaw: Empty approver lists could grant explicit approval authorization 2026-04-17
GHSA-7g8c-cfr3-vqqr CVE-2026-43534 Medium OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input 2026-04-17
GHSA-j6c7-3h5x-99g9 CVE-2026-42435 Medium OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms 2026-04-17
GHSA-5gjc-grvm-m88j CVE-2026-43568 Medium OpenClaw: Memory dreaming config persistence was reachable from operator.write commands 2026-04-17
GHSA-g2hm-779g-vm32 CVE-2026-43566 Medium OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events 2026-04-17
GHSA-c4qm-58hj-j6pj CVE-2026-42436 Medium OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation 2026-04-17
GHSA-jwrq-8g5x-5fhm CVE-2026-43535 Medium OpenClaw: Collect-mode queue batches could reuse the last sender authorization context 2026-04-17
GHSA-f934-5rqf-xx47 — Medium OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths 2026-04-17
GHSA-f7fh-qg34-x2xh — Medium OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets 2026-04-17
GHSA-536q-mj95-h29h — Medium OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage 2026-04-17
GHSA-qmwg-qprg-3j38 — Medium OpenClaw: Browser interaction routes could pivot into local CDP and regain file reads 2026-04-17
GHSA-f3h5-h452-vp3j — Medium OpenClaw: Nostr profile mutation routes allowed operator.write config persistence 2026-04-17
GHSA-xq94-r468-qwgj — Medium OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding 2026-04-17
GHSA-g375-h3v6-4873 — Medium OpenClaw: Heartbeat owner downgrade missed local async exec completion events 2026-04-17
GHSA-92jp-89mq-4374 — Medium OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials 2026-04-17
GHSA-p6j4-wvmc-vx2h — Medium Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete 2026-04-10
GHSA-59xc-5v89-r7pr — Medium Duplicate Advisory: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token 2026-04-10
GHSA-pmf3-2q63-jmp6 — Medium Duplicate Advisory: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013) 2026-04-10
GHSA-m5jp-p3r5-mfqp — Medium Duplicate Advisory: OpenClaw: Gateway Plugin Subagent Fallback deleteSession Uses Synthetic operator.admin 2026-04-10
GHSA-hm63-vwj4-mj2q — Medium Duplicate Advisory: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure 2026-04-10
GHSA-mj5r-hh7j-4gxf CVE-2026-28480 Medium OpenClaw Telegram allowlist authorization accepted mutable usernames 2026-02-18
GHSA-h89v-j3x9-8wqj CVE-2026-28452 Medium OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR) 2026-02-18
GHSA-w2cg-vxx6-5xjg CVE-2026-29612 Medium OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks 2026-02-18
GHSA-g34w-4xqq-h79m CVE-2026-26328 Medium OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities 2026-02-18

Low Severity

GHSA CVE Severity Title Published
GHSA-qm77-8qjp-4vcm CVE-2026-41358 Low OpenClaw: Slack thread context could include messages from non-allowlisted senders 2026-05-04
GHSA-v8qf-fr4g-28p2 CVE-2026-41908 Low OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization 2026-04-25
GHSA-j4c5-89f5-f3pm — Low OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks 2026-04-25
GHSA-xrq9-jm7v-g9h7 — Low OpenClaw: Paired-device pairing actions were not limited to the caller device 2026-04-25
GHSA-c4qg-j8jg-42q5 — Low OpenClaw: QQBot direct media upload skipped URL SSRF validation 2026-04-25
GHSA-57r2-h2wj-g887 — Low OpenClaw: Isolated cron awareness events were recorded as trusted system events 2026-04-25
GHSA-7hrg-5w46-5r2x — Low Duplicate Advisory: OpenClaw: Slack thread context could include messages from non-allowlisted senders 2026-04-24
GHSA-wwc3-c577-533m — Low Duplicate Advisory: OpenClaw: Gateway device.token.rotate does not terminate active WebSocket sessions after credential rotation 2026-04-24
GHSA-qgp3-3rj7-qqq4 — Low Duplicate Advisory: OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist 2026-04-24
GHSA-2xp4-qhr4-xqm2 — Low Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode 2026-04-24
GHSA-pr66-whqj-rq5p — Low Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message 2026-04-24
GHSA-qgx9-6px9-7p75 — Low Duplicate Advisory: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization 2026-04-23
GHSA-gc9r-867r-j85f CVE-2026-43572 Low OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks 2026-04-17
GHSA-r77c-2cmr-7p47 — Low OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay 2026-04-17
GHSA-gj9q-8w99-mp8j CVE-2026-43529 Low OpenClaw: TOCTOU read in exec script preflight 2026-04-16
GHSA-52vj-fvrv-7q82 CVE-2026-6011 Low OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts 2026-04-10
GHSA-chm2-m3w2-wcxm — Low OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch 2026-02-17

Repo-Only Advisories (~35 more)

These advisories are listed on the repo security page but not yet indexed in the GitHub Advisory Database. See the full advisory list for details.

GHSA Severity Title Published
GHSA-3vvq-q2qc-7rmp High B-M3: ClawHub package downloads are not enforced with integrity verification 2026-04-08
GHSA-4f8g-77mw-3rxc High Gateway plugin HTTP auth: gateway widens identity-bearing operator.read requests into runtime operator.write 2026-04-08
GHSA-5wj5-87vq-39xm High Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement 2026-04-08
GHSA-67mf-f936-ppxf High OpenClaw node.pair.approve placed in operator.write scope instead of operator.pairing allows unprivileged pairing approval 2026-04-08
GHSA-7437-7hg8-frrw High HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class) 2026-04-08
GHSA-846p-hgpv-vphc High QQ Bot structured payloads could read arbitrary local files 2026-04-02
GHSA-cm8v-2vh9-cxf3 High GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant) 2026-04-08
GHSA-cmfr-9m2r-xwhq High OpenClaw node.invoke(browser.proxy) bypasses browser.request persistent profile-mutation guard 2026-04-08
GHSA-gfmx-pph7-g46x High Lower-trust background runtime output is injected into trusted System: events, and local async exec completion misses the intended exec-event downgrade 2026-04-08
GHSA-jf56-mccx-5f3f High Authenticated /hooks/wake and mapped wake payloads are promoted into the trusted System: prompt channel 2026-04-08
GHSA-m34q-h93w-vg5x High OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped 2026-04-02
GHSA-q2gc-xjqw-qp89 High strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts 2026-04-08
GHSA-qqq7-4hxc-x63c High Shared reply MEDIA: paths are treated as trusted and can trigger cross-channel local file exfiltration 2026-04-08
GHSA-qx8j-g322-qj6m High fetchWithSsrFGuard replays unsafe request bodies across cross-origin redirects 2026-04-08
GHSA-w9j9-w4cp-6wgr High OpenClaw Host-Exec Environment Variable Injection 2026-04-08
GHSA-whf9-3hcx-gq54 High OpenClaw device.token.rotate mints tokens for unapproved roles, bypassing device role-upgrade pairing 2026-04-08
GHSA-25wv-8phj-8p7r Medium Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths 2026-04-08
GHSA-2qrv-rc5x-2g2h Medium Untrusted workspace channel shadows could execute during built-in channel setup 2026-04-02
GHSA-3fv3-6p2v-gxwj Medium QQ Bot Extension: Missing SSRF Protection on All Media Fetch Paths 2026-04-08
GHSA-4p4f-fc8q-84m3 Medium iOS A2UI bridge trusted generic local-network pages for agent.request dispatch 2026-04-02
GHSA-5fc7-f62m-8983 Medium Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix) 2026-04-08
GHSA-5h3f-885m-v22w Medium Existing WS sessions survive shared gateway token rotation 2026-04-08
GHSA-5hff-46vh-rxmw Medium Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill 2026-04-02
GHSA-68x5-xx89-w9mm Medium resolvedAuth closure becomes stale after config reload 2026-04-08
GHSA-98ch-45wp-ch47 Medium Windows-compatible env override keys could bypass system.run approval binding 2026-04-02
GHSA-9jpj-g8vv-j5mf Medium Gemini OAuth exposed the PKCE verifier through the OAuth state parameter 2026-04-02
GHSA-ccx3-fw7q-rr2r Medium Multiple Code Paths Missing Base64 Pre-Allocation Size Checks 2026-04-08
GHSA-cqgw-44wg-44rf Medium Discord voice manager bypasses channel-level member access allowlist 2026-03-31
GHSA-cr8r-7g2h-6wr6 Medium Remote marketplace repository paths could escape through symlink traversal 2026-04-16
GHSA-fvx6-pj3r-5q4q Medium Complex interpreter pipelines could skip exec script preflight validation 2026-04-02
GHSA-rxmx-g7hr-8mx4 Medium Zalo replay dedupe keys could suppress messages across chats or senders 2026-04-02
GHSA-vc32-h5mq-453v Medium /allowlist omits owner-only enforcement for cross-channel allowlist writes 2026-04-08
GHSA-vr5g-mmx7-h897 Medium Browser SSRF Policy Bypass via Interaction-Triggered Navigation 2026-04-08
GHSA-2f7j-rp58-mr42 Low Gateway hello snapshots exposed host config and state paths to non-admin clients 2026-04-02
GHSA-jj6q-rrrf-h66h Low Shared-secret comparison call sites leaked length information through timing 2026-04-02

Naming Inconsistencies

The OpenClaw project has been renamed multiple times, causing inconsistencies across CVE records:

CVE vendor product packageURL Description Names
CVE-2026-43534 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43566 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43533 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-25253 OpenClaw OpenClaw pkg:npm/clawdbot OpenClaw / clawdbot / Moltbot
CVE-2026-24763 clawdbot clawdbot — OpenClaw (formerly Clawdbot)
CVE-2026-28478 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-42435 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-42434 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43530 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43526 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-28469 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-42437 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-25157 openclaw openclaw — OpenClaw
CVE-2026-43571 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43569 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43535 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-28458 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-26317 openclaw clawdbot — OpenClaw (formerly Clawdbot)
CVE-2026-42433 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43528 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43567 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43568 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43531 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-28480 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-29612 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-28452 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-26328 openclaw clawdbot — OpenClaw (formerly Clawdbot)
CVE-2026-41389 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43527 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43572 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43574 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-42439 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-42436 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-42438 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43532 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43573 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-41358 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-41908 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw
CVE-2026-43529 OpenClaw OpenClaw pkg:npm/openclaw OpenClaw

Data Sources

Source URL
CVE List v5 CVEProject/cvelistV5
GitHub Advisory DB github.com/advisories
Repo Security Tab openclaw/openclaw/security
CVE Services API https://cveawg.mitre.org/api/cve-id/{CVE-ID}

README copy captured when this server was indexed; it may lag the repository. The original is authoritative.

Questions

About OpenClawCVEs

How do I install OpenClawCVEs?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is OpenClawCVEs safe to use with an AI agent?

Its trust score is 52 out of 100 (fair). It passes 1 of the 1 static security checks run so far. It has no ConduID identity yet, so agent calls to it are not receipted.

Is OpenClawCVEs still maintained?

Conduid hasn't recorded a commit date for this repository yet. Check the repository directly for recent activity.