CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants |
| 03/03/2026 |
| GHSA-943q-mwmv-hhvh | 높음8.8 | OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval | 02/03/2026 |
| GHSA-6x2m-hqfw-hvpj | 보통 | OpenClaw: Node exec approvals could be replayed across nodes | 02/03/2026 |
| GHSA-7xmq-g46g-f8pv | 높음 | OpenClaw: Sandbox media TOCTOU could read files outside sandbox root | 02/03/2026 |
| GHSA-x82f-27x3-q89c | 높음 | OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries | 02/03/2026 |
| GHSA-8m9v-xpgf-g99m | 보통 | OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization | 02/03/2026 |
| GHSA-392f-ggf5-fp3c | 보통 | OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists | 02/03/2026 |
| CVE-2026-28363 | 높음8.8 | In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied. | 27/02/2026 |
| CVE-2026-27576 | 보통4.0 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt payloads before forwarding them to chat.send. Because ACP runs over local stdio, this mainly affects local ACP clients (for example IDE integrations) that send unu | 21/02/2026 |
| CVE-2026-27488 | 높음7.3 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19. | 21/02/2026 |
| CVE-2026-27487 | 높음8.0 | OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data, this created an OS com | 21/02/2026 |
| CVE-2026-27486 | 보통5.3 | OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern matching to terminate processes without verifying if they are owned by the current OpenClaw process. On shared hosts, unrelated processes can be terminated if th | 21/02/2026 |
| CVE-2026-27485 | 보통4.4 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks t | 21/02/2026 |
| CVE-2026-27484 | 보통4.3 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and the bot has the neces | 21/02/2026 |
| CVE-2026-27009 | 보통5.8 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `<script>` tag without script-context-safe escaping. A crafted value containing `</script>` could break out of the script tag and execute attacker | 20/02/2026 |
| CVE-2026-27008 | 보통6.7 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in `download` skill installation allowed `targetDir` values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated. In the admin-only `skills.install` flow, this could write files outside the intended insta | 20/02/2026 |