Mittel
ghsa-w9j9-w4cp-6wgr
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 600
Filter zurücksetzen
Mittel
CVE-2026-42430
OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable
Niedrig
CVE-2026-42429
OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`
Mittel
CVE-2026-41912
OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation
Mittel
CVE-2026-42426
OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval
Niedrig
CVE-2026-41911
OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)
Mittel
CVE-2026-41914
OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths
Mittel
CVE-2026-42421
OpenClaw: Existing WS sessions survive shared gateway token rotation
Niedrig
CVE-2026-41913
OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths
Hoch
CVE-2026-42432
OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
Mittel
CVE-2026-41910
OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes
Mittel
CVE-2026-41916
OpenClaw: resolvedAuth closure becomes stale after config reload
Mittel
CVE-2026-42431
OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard
Mittel
CVE-2026-42422
OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing
Mittel
CVE-2026-42424
OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration
Mittel
CVE-2026-42423
OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts
Hoch
CVE-2026-42427
OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
Hoch
ghsa-jf56-mccx-5f3f
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
Hoch
ghsa-gfmx-pph7-g46x
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
Mittel
CVE-2026-39398
openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools
Mittel
CVE-2026-40045
OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://
Mittel
CVE-2026-41407
OpenClaw: Shared-secret comparison call sites leaked length information through timing
Mittel
CVE-2026-41354
OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders
Mittel
CVE-2026-41372
OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.