| GHSA-qhrr-grqp-6x2g | TRUNG BÌNH | OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode | 03/03/2026 |
| GHSA-h656-5vcf-cm23 | TRUNG BÌNH | OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check | 03/03/2026 |
| GHSA-9f72-qcpw-2hxc | CAO | OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs | 03/03/2026 |
| GHSA-qj22-xqjr-v83v | CAO | OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection | 03/03/2026 |
| GHSA-5847-rm3g-23mw | TRUNG BÌNH | OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants | 03/03/2026 |
| GHSA-943q-mwmv-hhvh | CAO8.8 | OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval | 02/03/2026 |
| GHSA-6x2m-hqfw-hvpj | TRUNG BÌNH | OpenClaw: Node exec approvals could be replayed across nodes | 02/03/2026 |
| GHSA-7xmq-g46g-f8pv | CAO | OpenClaw: Sandbox media TOCTOU could read files outside sandbox root | 02/03/2026 |
| GHSA-x82f-27x3-q89c | CAO | OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries | 02/03/2026 |
| GHSA-8m9v-xpgf-g99m | TRUNG BÌNH | OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization | 02/03/2026 |
| GHSA-392f-ggf5-fp3c | TRUNG BÌNH | OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists | 02/03/2026 |
| CVE-2026-28363 | CAO8.8 | In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied. | 27/02/2026 |
| CVE-2026-27576 | TRUNG BÌNH4.0 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt payloads before forwarding them to chat.send. Because ACP runs over local stdio, this mainly affects local ACP clients (for example IDE integrations) that send unu | 21/02/2026 |
| CVE-2026-27488 | CAO7.3 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19. | 21/02/2026 |
| CVE-2026-27487 | CAO8.0 | OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data, this created an OS com | 21/02/2026 |
| CVE-2026-27486 | TRUNG BÌNH5.3 | OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern matching to terminate processes without verifying if they are owned by the current OpenClaw process. On shared hosts, unrelated processes can be terminated if th | 21/02/2026 |
| CVE-2026-27485 | TRUNG BÌNH4.4 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks t | 21/02/2026 |
| CVE-2026-27484 | TRUNG BÌNH4.3 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and the bot has the neces | 21/02/2026 |
| CVE-2026-27009 | TRUNG BÌNH5.8 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `<script>` tag without script-context-safe escaping. A crafted value containing `</script>` could break out of the script tag and execute attacker | 20/02/2026 |
| CVE-2026-27008 | TRUNG BÌNH6.7 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in `download` skill installation allowed `targetDir` values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated. In the admin-only `skills.install` flow, this could write files outside the intended insta | 20/02/2026 |