Zaloguj się
Deutsch English Español Polski
Wysoka

OpenClaw has a LFI in BlueBubbles media path handling

  • Ujawniono: 18.02.2026
  • Aktualizacja: 11.10.2026 10:22

Summary

The BlueBubbles extension accepted attacker-controlled local filesystem paths via mediaPath and could read arbitrary local files from disk before sending them as media attachments.

Details

When sendBlueBubblesMedia received a non-HTTP media source, the previous implementation resolved it to a local path and read it directly from disk. There was no required allowlist of safe directories, so values like /etc/passwd (or equivalent sensitive paths on other platforms) could be requested and exfiltrated.

The fix hardens local media loading by requiring explicit configured roots (channels.bluebubbles.mediaLocalRoots) and by enforcing canonical-path containment checks before reading local files. Paths outside allowed roots are rejected.

Fix PR: https://github.com/openclaw/openclaw/pull/16322 Fix commit: https://github.com/openclaw/openclaw/commit/71f357d9498cebb0efe016b0496d5fbe807539fc

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: < v2026.2.14
  • Fixed: >= v2026.2.14 (planned)

Impact

An attacker able to trigger BlueBubbles media sends could exfiltrate local files accessible to the OpenClaw process.

Remediation

Upgrade to a release that includes commit 71f357d9498cebb0efe016b0496d5fbe807539fc and configure channels.bluebubbles.mediaLocalRoots to explicit trusted directories.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka npm openclaw < 2026.2.14 2026.2.14

Odnośniki

Ocena CVSS 7.5/10
Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Słabość (CWE)
CWE-22
Platforma
npm
Paczka
openclaw
Ujawniono
18.02.2026
Aktualizacja
11.10.2026 10:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-rwj8-p9vq-25gv - CC BY 4.0

Historia podatności: openclaw

Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (589) w archiwum
Wszystkich wpisów
589
Pierwsza → ostatnia
02.2026 10.2026
Bez poprawki
9
Wykorzystywana w atakach
0

Rozkład istotności

  • Krytyczna 20
  • Wysoka 215
  • Średnia 300
  • Niska 54

Ujawnienia w latach

Istotność:
  1. OpenClaw: Native command authorization could skip owner-command enforcement
    Wysoka CVE-2026-53828 < 2026.5.6 2026.5.6
  2. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    Wysoka · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  3. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    Wysoka CVE-2026-53839 < 2026.5.7 2026.5.7
  4. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    Wysoka CVE-2026-53807 < 2026.5.6 2026.5.6
  5. OpenClaw: Matrix allowFrom could bind to mutable display names
    Wysoka · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  6. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    Wysoka · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  7. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    Wysoka · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  8. OpenClaw: Fake package roots could influence memory-core artifact loading
    Wysoka · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  9. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    Wysoka · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  10. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    Wysoka · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  11. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    Wysoka · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  12. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Krytyczna CVE-2026-34507 < 2026.4.29 2026.4.29
  13. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    Wysoka · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  14. OpenClaw: Slack allowFrom could bind to mutable display names
    Wysoka CVE-2026-53823 < 2026.5.3 2026.5.3
  15. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    Wysoka · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  16. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    Wysoka · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  17. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    Wysoka · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  18. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    Wysoka · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  19. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    Wysoka · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  20. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    Wysoka · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  21. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    Wysoka · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  22. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    Wysoka · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  23. OpenClaw: Shell wrapper argv could change between approval and execution
    Wysoka CVE-2026-53822 < 2026.5.18 2026.5.18
  24. OpenClaw: Exec approval display truncation could hide the command being approved
    Wysoka · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  25. OpenClaw: Message read actions could skip channel allowlist checks
    Wysoka · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  26. OpenClaw: Workspace-derived service PATH could influence trash command selection
    Wysoka · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  27. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    Wysoka · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  28. OpenClaw: Discord allowFrom could bind to mutable display names
    Wysoka · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  29. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    Wysoka · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  30. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    Wysoka · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  31. OpenClaw: Zalo allowFrom could bind to mutable display names
    Wysoka · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  32. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    Wysoka · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  33. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    Wysoka · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  34. OpenClaw: Shell inline-command parsing could miss an allowlist check
    Wysoka · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  35. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    Wysoka · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  36. OpenClaw: Host environment sanitizer missed two Node.js control variables
    Wysoka · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  37. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    Wysoka · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  38. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    Wysoka · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  39. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    Wysoka · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  40. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    Wysoka · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  41. OpenClaw: Workspace dotenv could override runtime-control environment variables
    Wysoka · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  42. OpenClaw: Feishu webhook and card-action validation now fail closed
    Krytyczna · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  43. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Krytyczna · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  44. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    Wysoka CVE-2026-43533 < 2026.4.10 2026.4.10
  45. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    Wysoka · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  46. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    Wysoka · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  47. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    Wysoka · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  48. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    Wysoka · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  49. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    Wysoka CVE-2026-43581 < 2026.4.10 2026.4.10
  50. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    Wysoka · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  51. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    Wysoka · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  52. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    Wysoka · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  53. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    Wysoka CVE-2026-43528 < 2026.4.14 2026.4.14
  54. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    Wysoka CVE-2026-40037 < 2026.4.8 2026.4.8
  55. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    Wysoka · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  56. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    Wysoka CVE-2026-42427 < 2026.4.8 2026.4.8
  57. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    Wysoka ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  58. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    Wysoka ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  59. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    Wysoka · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  60. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    Wysoka · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
  61. OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
    Wysoka CVE-2026-34511 < 2026.4.2 2026.4.2
  62. OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
    Wysoka CVE-2026-41393 < 2026.3.31 2026.3.31
  63. OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
    Wysoka · 9.8 CVE-2026-41386 < 2026.3.22 2026.3.22
  64. OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
    Wysoka CVE-2026-41353 < 2026.3.22 2026.3.22
  65. OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
    Wysoka · 8.8 CVE-2026-41378 < 2026.3.31 2026.3.31
  66. OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
    Krytyczna · 8.2 CVE-2026-41296 < 2026.3.31 2026.3.31
  67. OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
    Wysoka · 6.5 CVE-2026-41369 < 2026.3.31 2026.3.31
  68. OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
    Wysoka CVE-2026-41404 < 2026.3.31 2026.3.31
  69. OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
    Wysoka CVE-2026-41349 < 2026.3.28 2026.3.28
  70. OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
    Wysoka · 6.1 CVE-2026-41373 < 2026.3.31 2026.3.31
  71. OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
    Wysoka · 8.8 CVE-2026-41352 < 2026.3.31 2026.3.31
  72. OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
    Wysoka · 7.5 CVE-2026-41405 < 2026.3.31 2026.3.31
  73. OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
    Wysoka CVE-2026-41366 < 2026.3.31 2026.3.31
  74. OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
    Wysoka · 9.6 CVE-2026-41397 < 2026.3.31 2026.3.31
  75. OpenClaw: Workspace `.env` can override the bundled plugin trust root
    Wysoka · 7.8 CVE-2026-41396 < 2026.3.31 2026.3.31
  76. OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
    Wysoka · 8.1 CVE-2026-41364 < 2026.3.31 2026.3.31
  77. OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
    Wysoka · 7.8 CVE-2026-41336 < 2026.3.31 2026.3.31
  78. OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation
    Krytyczna CVE-2026-41329 < 2026.3.31 2026.3.31
  79. OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic
    Wysoka · 5.3 CVE-2026-41391 < 2026.3.31 2026.3.31
  80. OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
    Krytyczna · 9.6 CVE-2026-41294 < 2026.3.28 2026.3.28
  81. OpenClaw gateway exec allow-always over-trusts positional carrier executables
    Wysoka · 7.3 CVE-2026-41380 < 2026.3.28 2026.3.28
  82. OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`
    Wysoka CVE-2026-41371 < 2026.3.28 2026.3.28
  83. OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper
    Wysoka · 7.3 CVE-2026-41390 < 2026.3.28 2026.3.28
  84. OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides
    Wysoka · 9.6 CVE-2026-41387 < 2026.3.22 2026.3.22
  85. OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing
    Wysoka CVE-2026-41299 < 2026.3.28 2026.3.28
  86. OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure
    Wysoka · 7.7 CVE-2026-41368 < 2026.3.28 2026.3.28
  87. OpenClaw's message tool media parameter bypasses tool policy filesystem isolation
    Wysoka · 6.2 CVE-2026-33581 < 2026.3.24 2026.3.24
  88. OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals
    Wysoka · 8.8 CVE-2026-41303 < 2026.3.28 2026.3.28
  89. OpenClaw's device removal and token revocation do not terminate active WebSocket sessions
    Wysoka · 7.5 CVE-2026-34503 < 2026.3.28 2026.3.28
  90. OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials
    Wysoka · 7.3 CVE-2026-41342 < 2026.3.28 2026.3.28
  91. OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation
    Krytyczna CVE-2026-33579 < 2026.3.28 2026.3.28
  92. OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering
    Wysoka CVE-2026-41395 < 2026.3.28 2026.3.28
  93. OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface
    Wysoka · 8.1 CVE-2026-35653 < 2026.3.24 2026.3.24
  94. OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send
    Wysoka CVE-2026-35621 < 2026.3.24 2026.3.24
  95. OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
    Wysoka · 8.6 CVE-2026-35641 < 2026.3.24 2026.3.24
  96. OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
    Wysoka · 7.7 CVE-2026-35668 < 2026.3.24 2026.3.24
  97. OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
    Wysoka CVE-2026-35629 < 2026.3.28 2026.3.28
  98. OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility
    Wysoka CVE-2026-35636 >= 2026.3.11, < 2026.3.28 2026.3.28
  99. OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers
    Wysoka CVE-2026-35669 <= 2026.3.24 brak poprawki
  100. OpenClaw: Silent privilege escalation via gateway shared-auth reconnect
    Krytyczna CVE-2026-35625 <= 2026.3.24 brak poprawki
  101. OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin
    Krytyczna CVE-2026-35663 <= 2026.3.24 brak poprawki
  102. OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding
    Wysoka CVE-2026-34512 <= 2026.3.24 brak poprawki
  103. OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve
    Krytyczna CVE-2026-35639 < 2026.3.22 2026.3.22
  104. OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement
    Wysoka CVE-2026-35631 < 2026.3.22 2026.3.22
  105. OpenClaw has Inconsistent Host Exec Environment Override Sanitization
    Wysoka · 7.5 CVE-2026-35650 < 2026.3.22 2026.3.22
  106. OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths
    Wysoka CVE-2026-35638 < 2026.3.22 2026.3.22
  107. OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure
    Wysoka CVE-2026-35633 < 2026.3.22 2026.3.22
  108. OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface
    Wysoka · 8.8 CVE-2026-35643 < 2026.3.22 2026.3.22
  109. OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper
    Wysoka · 8.8 CVE-2026-35666 < 2026.3.22 2026.3.22
  110. OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement
    Wysoka CVE-2026-35627 < 2026.3.22 2026.3.22
  111. OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers
    Wysoka CVE-2026-35660 < 2026.3.23 2026.3.23
  112. OpenClaw: Plivo V2 verified replay identity drifts on query-only variants
    Wysoka CVE-2026-35618 < 2026.3.23 2026.3.23
  113. OpenClaw is vulnerable to Path Traversal through path validation bypass
    Wysoka · 7.5 CVE-2026-32846 < 2026.03.28 2026.03.28
  114. OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
    Wysoka CVE-2026-32917 < 2026.3.13 2026.3.13
  115. OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
    Wysoka · 7.5 CVE-2026-32980 < 2026.3.13 2026.3.13
  116. OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
    Wysoka CVE-2026-32987 < 2026.3.13 2026.3.13
  117. OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
    Wysoka · 8.6 CVE-2026-32974 < 2026.3.12 2026.3.12
  118. OpenClaw: Gateway `agent` calls could override the workspace boundary
    Wysoka · 8.8 CVE-2026-33573 < 2026.3.11 2026.3.11
  119. OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
    Krytyczna · 9.9 CVE-2026-22172 < 2026.3.12 2026.3.12
  120. `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
    Wysoka · 8.4 CVE-2026-32918 < 2026.3.11 2026.3.11
  121. OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories
    Wysoka CVE-2026-32920 < 2026.3.12 2026.3.12
  122. OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
    Wysoka · 8.8 CVE-2026-32914 < 2026.3.12 2026.3.12
  123. OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes
    Wysoka · 7.1 CVE-2026-32972 < 2026.3.11 2026.3.11
  124. OpenClaw: Sandbox staged writes could escape the verified parent directory before commit
    Wysoka · 7.5 CVE-2026-32988 < 2026.3.11 2026.3.11
  125. OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity
    Wysoka · 8.0 CVE-2026-32978 < 2026.3.11 2026.3.11
  126. OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv
    Wysoka · 7.1 CVE-2026-32971 < 2026.3.11 2026.3.11
  127. OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity
    Wysoka · 7.3 CVE-2026-32979 < 2026.3.11 2026.3.11
  128. OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries
    Wysoka · 8.8 CVE-2026-32915 < 2026.3.11 2026.3.11
  129. OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE
    Krytyczna · 9.9 CVE-2026-32922 < 2026.3.11 2026.3.11
  130. OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes
    Krytyczna · 9.4 CVE-2026-32916 >= 2026.3.7, < 2026.3.11 2026.3.11
  131. OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode
    Wysoka · 8.1 CVE-2026-32302 < 2026.3.11 2026.3.11
  132. OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary
    Wysoka · 7.0 ghsa-qcc4-p59m-p54m < 2026.2.26 2026.2.26
  133. OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf
    Wysoka · 7.6 CVE-2026-32055 < 2026.2.26 2026.2.26
  134. OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries
    Wysoka · 7.1 ghsa-gp3q-wpq4-5c5h < 2026.2.26 2026.2.26
  135. OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects
    Wysoka · 9.3 CVE-2026-32913 < 2026.3.7 2026.3.7
  136. OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage
    Wysoka · 7.1 ghsa-rchv-x836-w7xp < 2026.3.7 2026.3.7
  137. OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations
    Wysoka ghsa-3jx4-q2m7-r496 < 2026.2.25 2026.2.25
  138. OpenClaw Canvas Authentication Bypass Vulnerability
    Wysoka · 7.4 CVE-2026-3690 < 2026.2.19 2026.2.19
  139. OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows
    Wysoka · 6.8 CVE-2026-32005 < 2026.2.25 2026.2.25
  140. OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From
    Wysoka ghsa-2ch6-x3g4-7759 < 2026.2.23 2026.2.23
  141. OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains
    Wysoka CVE-2026-27566 < 2026.2.22 2026.2.22
  142. OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths
    Wysoka CVE-2026-27523 < 2026.2.24 2026.2.24
  143. OpenClaw: Zip extraction symlink traversal could write outside destination
    Wysoka ghsa-jxrq-8fm4-9p58 < 2026.2.22 2026.2.22
  144. OpenClaw hook transform path containment missed symlink-resolved escapes
    Wysoka ghsa-659f-22xc-98f2 < 2026.2.22 2026.2.22
  145. OpenClaw has multiple E2E/test Dockerfiles that run all processes as root
    Wysoka ghsa-w7j5-j98m-w679 < 2026.2.21 2026.2.21
  146. OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt
    Wysoka ghsa-7ff8-xjh3-mgh6 < 2026.2.23 2026.2.23
  147. OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)
    Wysoka · 7.5 CVE-2026-32056 < 2026.2.22 2026.2.22
  148. OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands
    Wysoka ghsa-w9cg-v44m-4qv8 < 2026.2.21 2026.2.21
  149. OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot
    Wysoka ghsa-xmv6-r34m-62p4 < 2026.2.25 2026.2.25
  150. OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks
    Wysoka · 7.8 CVE-2026-32015 >= 2026.1.21, < 2026.2.19 2026.2.19
  151. OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
    Wysoka CVE-2026-32063 < 2026.2.21 2026.2.21
  152. OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation
    Wysoka CVE-2026-22176 < 2026.2.19 2026.2.19
  153. OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution
    Wysoka CVE-2026-22179 < 2026.2.22 2026.2.22
  154. OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling
    Wysoka CVE-2026-31994 < 2026.2.19 2026.2.19
  155. OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)
    Wysoka · 6.8 CVE-2026-32007 < 2026.2.23 2026.2.23
  156. OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)
    Wysoka · 5.7 CVE-2026-32009 < 2026.2.24 2026.2.24
  157. OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization
    Wysoka · 8.0 ghsa-474h-prjg-mmw3 < 2026.3.2 2026.3.2
  158. OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification
    Wysoka · 6.5 CVE-2026-32004 < 2026.3.2 2026.3.2
  159. OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
    Wysoka CVE-2026-27670 < 2026.3.2 2026.3.2
  160. OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace
    Wysoka CVE-2026-31990 < 2026.3.2 2026.3.2
  161. OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia
    Wysoka · 7.5 CVE-2026-32030 < 2026.2.19 2026.2.19
  162. OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment
    Wysoka · 7.8 CVE-2026-32032 < 2026.2.22 2026.2.22
  163. OpenClaw's andbox browser noVNC observer lacked VNC authentication
    Wysoka · 7.7 CVE-2026-32064 < 2026.2.21 2026.2.21
  164. OpenClaw DM pairing-store identities could satisfy group allowlist authorization
    Wysoka · 6.5 CVE-2026-32027 < 2026.2.26 2026.2.26
  165. OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
    Wysoka ghsa-9f72-qcpw-2hxc < 2026.2.24 2026.2.24
  166. OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths
    Wysoka · 6.5 CVE-2026-32036 < 2026.2.26 2026.2.26
  167. OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists
    Wysoka · 6.0 CVE-2026-32037 < 2026.2.22 2026.2.22
  168. OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading
    Wysoka · 6.0 CVE-2026-28393 >= 2.0.0-beta3, < 2026.2.14 2026.2.14
  169. OpenClaw has command injection via Windows shell fallback in Lobster tool execution
    Wysoka CVE-2026-32000 < 2026.2.19 2026.2.19
  170. OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection
    Wysoka ghsa-qj22-xqjr-v83v < 2026.2.25 2026.2.25
  171. OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
    Wysoka · 6.6 CVE-2026-32003 < 2026.2.22 2026.2.22
  172. OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy
    Wysoka · 8.0 CVE-2026-32014 < 2026.2.26 2026.2.26
  173. OpenClaw: Node system.run approval bypass via parent-symlink cwd rebind
    Wysoka CVE-2026-27545 < 2026.2.26 2026.2.26
  174. OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset
    Wysoka CVE-2026-27522 < 2026.2.24 2026.2.24
  175. OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval
    Wysoka · 8.8 ghsa-943q-mwmv-hhvh < 2026.2.14 2026.2.14
  176. OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway
    Krytyczna · 9.9 CVE-2026-28466 < 2026.2.14 2026.2.14
  177. OpenClaw has non-constant-time token comparison in hooks authentication
    Wysoka · 5.9 CVE-2026-28464 < 2026.2.12 2026.2.12
  178. OpenClaw has Zip Slip path traversal in tar archive extraction
    Wysoka · 8.1 CVE-2026-28453 < 2026.2.14 2026.2.14
  179. OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write
    Krytyczna · 8.8 CVE-2026-32013 < 2026.2.25 2026.2.25
  180. OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure
    Wysoka · 7.5 CVE-2026-32062 < 2026.2.22 2026.2.22
  181. OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels
    Wysoka CVE-2026-32049 < 2026.2.22 2026.2.22
  182. OpenClaw Canvas Path Traversal Information Disclosure Vulnerability
    Wysoka CVE-2026-3689 < 2026.2.21 2026.2.21
  183. OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments
    Wysoka CVE-2026-22168 < 2026.2.21 2026.2.21
  184. OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind
    Wysoka CVE-2026-31997 < 2026.3.1 2026.3.1
  185. OpenClaw has web_search citation redirect SSRF via private-network-allowing policy
    Wysoka CVE-2026-31989 < 2026.3.1 2026.3.1
  186. OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools
    Wysoka CVE-2026-32051 < 2026.3.1 2026.3.1
  187. OpenClaw: Sandbox media TOCTOU could read files outside sandbox root
    Wysoka ghsa-7xmq-g46g-f8pv < 2026.3.1 2026.3.1
  188. OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries
    Wysoka ghsa-x82f-27x3-q89c < 2026.3.1 2026.3.1
  189. CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths
    Krytyczna CVE-2026-31999 >= 2026.2.26, < 2026.3.1 2026.3.1
  190. OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failure
    Wysoka · 6.9 CVE-2026-32041 < 2026.3.1 2026.3.1
  191. OpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode
    Krytyczna · 9.9 CVE-2026-28363 < 2026.2.23 2026.2.23
  192. OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace
    Wysoka · 8.8 CVE-2026-32060 < 2026.2.14 2026.2.14
  193. OpenClaw replaced a deprecated sandbox hash algorithm
    Wysoka · 5.4 CVE-2026-28479 < 2026.2.15 2026.2.15
  194. OpenClaw: Docker container escape via unvalidated bind mount config injection
    Wysoka CVE-2026-27002 < 2026.2.15 2026.2.15
  195. OpenClaw: Unsanitized CWD path injection into LLM prompts
    Wysoka CVE-2026-27001 < 2026.2.15 2026.2.15
  196. OpenClaw has an authentication bypass in sandbox browser bridge server
    Wysoka · 7.1 CVE-2026-28468 >= 2026.1.29-beta.1, < 2026.2.14 2026.2.14
  197. OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension
    Wysoka · 8.6 CVE-2026-28451 < 2026.2.14 2026.2.14
  198. OpenClaw has a LFI in BlueBubbles media path handling ten wpis
    Wysoka · 7.5 CVE-2026-29611 < 2026.2.14 2026.2.14
  199. OpenClaw: Prevent shell injection in macOS keychain credential write
    Wysoka · 7.6 CVE-2026-27487 < 2026.2.14 2026.2.14
  200. OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes
    Wysoka · 7.5 CVE-2026-28462 < 2026.2.13 2026.2.13
  201. OpenClaw affected by potential code execution via unsafe hook module path handling in Gateway
    Wysoka · 7.2 CVE-2026-28456 >= 2026.1.5, < 2026.2.14 2026.2.14
  202. OpenClaw's unsanitized session ID enables path traversal in transcript file operations
    Wysoka · 5.5 CVE-2026-28482 < 2026.2.12 2026.2.12
  203. OpenClaw inter-session prompts could be treated as direct user instructions
    Wysoka ghsa-w5c7-9qqw-6645 < 2026.2.13 2026.2.13
  204. OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)
    Wysoka · 8.8 CVE-2026-29610 < 2026.2.14 2026.2.14
  205. OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting
    Wysoka · 9.8 CVE-2026-28469 < 2026.2.14 2026.2.14
  206. OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints
    Wysoka · 7.1 CVE-2026-26317 < 2026.2.14 2026.2.14
  207. OpenClaw affected by denial of service via unbounded webhook request body buffering
    Wysoka · 7.5 CVE-2026-28478 < 2026.2.13 2026.2.13
  208. OpenClaw affected by denial of service via unbounded URL-backed media fetch
    Wysoka · 7.5 CVE-2026-29609 < 2026.2.14 2026.2.14
  209. OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands
    Wysoka · 4.8 CVE-2026-28392 < 2026.2.14 2026.2.14
  210. OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion
    Wysoka · 5.7 CVE-2026-28463 < 2026.2.14 2026.2.14
  211. OpenClaw has a command injection in maintainer clawtributors updater
    Wysoka CVE-2026-26323 >= 2026.1.8, < 2026.2.14 2026.2.14
  212. OpenClaw has a path traversal in browser upload allows local file read
    Wysoka CVE-2026-26329 < 2026.2.14 2026.2.14
  213. OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning
    Wysoka CVE-2026-26327 < 2026.2.14 2026.2.14
  214. OpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals
    Wysoka · 7.2 CVE-2026-26325 < 2026.2.14 2026.2.14
  215. OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)
    Wysoka · 7.5 CVE-2026-26324 < 2026.2.14 2026.2.14
  216. OpenClaw Gateway tool allowed unrestricted gatewayUrl override
    Wysoka · 7.6 CVE-2026-26322 < 2026.2.14 2026.2.14
  217. OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension
    Wysoka · 7.5 CVE-2026-26321 < 2026.2.14 2026.2.14
  218. OpenClaw macOS deep link confirmation truncation can conceal executed agent message
    Wysoka CVE-2026-26320 >= 2026.2.6-0, < 2026.2.14 2026.2.14
  219. OpenClaw is Missing Webhook Authentication in Telnyx Provider Allows Unauthenticated Requests
    Wysoka · 7.5 CVE-2026-26319 < 2026.2.14 2026.2.14
  220. OpenClaw has a Path Traversal in Plugin Installation
    Wysoka · 8.1 CVE-2026-28447 >= 2026.1.20, < 2026.2.1 2026.2.1
Pokaż więcej (15) Widać 220 z 235

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.