Sign in
Deutsch English Español Polski
Medium

OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images

  • Disclosed: 04.03.2026
  • Updated: 11.10.2026 10:22

Summary

In OpenClaw, the sandboxed image tool did not honor tools.fs.workspaceOnly=true for mounted paths resolved by the sandbox FS bridge. This allowed reading out-of-workspace mounted images (for example /agent/*) and forwarding those bytes to vision model providers.

Impact

Sandbox boundary bypass with confidentiality impact. In affected versions, read/write/edit respected workspace-only guardrails, but image could still load mounted out-of-workspace files and exfiltrate them via model requests.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.22-2
  • Patched versions: >= 2026.2.23 (released)
  • Latest published npm at triage time: 2026.2.22-2

Technical Details

workspaceOnly was enforced in sandbox file tools and apply_patch, but not propagated/enforced for image sandbox path resolution. The fix threads workspaceOnly into image-tool construction and asserts sandbox-root containment before loading media bytes.

Fix Commit(s)

  • dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53

OpenClaw thanks @tdjackey for reporting.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package openclaw < 2026.2.23 2026.2.23

References

CVSS score 5.3/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE)
CWE-200, CWE-284
Platform
npm
Package
openclaw
Disclosed
04.03.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-q6qf-4p5j-r25g - CC BY 4.0

Vulnerability history: openclaw

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (588) in the archive
Total entries
588
First → latest
02.2026 07.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 20
  • High 215
  • Medium 299
  • Low 54

Disclosures per year

Severity:
  1. OpenClaw: Native command authorization could skip owner-command enforcement
    High CVE-2026-53828 < 2026.5.6 2026.5.6
  2. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    High · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  3. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    High CVE-2026-53839 < 2026.5.7 2026.5.7
  4. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    High CVE-2026-53807 < 2026.5.6 2026.5.6
  5. OpenClaw: Matrix allowFrom could bind to mutable display names
    High · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  6. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    High · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  7. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    High · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  8. OpenClaw: Fake package roots could influence memory-core artifact loading
    High · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  9. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    High · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  10. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    High · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  11. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    High · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  12. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Critical CVE-2026-34507 < 2026.4.29 2026.4.29
  13. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    High · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  14. OpenClaw: Slack allowFrom could bind to mutable display names
    High CVE-2026-53823 < 2026.5.3 2026.5.3
  15. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    High · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  16. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    High · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  17. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    High · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  18. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    High · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  19. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    High · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  20. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    High · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  21. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    High · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  22. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    High · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  23. OpenClaw: Shell wrapper argv could change between approval and execution
    High CVE-2026-53822 < 2026.5.18 2026.5.18
  24. OpenClaw: Exec approval display truncation could hide the command being approved
    High · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  25. OpenClaw: Message read actions could skip channel allowlist checks
    High · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  26. OpenClaw: Workspace-derived service PATH could influence trash command selection
    High · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  27. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    High · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  28. OpenClaw: Discord allowFrom could bind to mutable display names
    High · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  29. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    High · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  30. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    High · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  31. OpenClaw: Zalo allowFrom could bind to mutable display names
    High · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  32. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    High · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  33. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    High · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  34. OpenClaw: Shell inline-command parsing could miss an allowlist check
    High · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  35. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    High · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  36. OpenClaw: Host environment sanitizer missed two Node.js control variables
    High · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  37. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    High · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  38. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    High · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  39. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    High · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  40. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    High · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  41. OpenClaw: Workspace dotenv could override runtime-control environment variables
    High · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  42. OpenClaw: Feishu webhook and card-action validation now fail closed
    Critical · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  43. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Critical · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  44. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    High CVE-2026-43533 < 2026.4.10 2026.4.10
  45. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    High · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  46. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    High · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  47. OpenClaw: Sandboxed agents could escape exec routing via host=node override
    High · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  48. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    High · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  49. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    High CVE-2026-43581 < 2026.4.10 2026.4.10
  50. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    High · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  51. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    High · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  52. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    High · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  53. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    High CVE-2026-43528 < 2026.4.14 2026.4.14
  54. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    High CVE-2026-40037 < 2026.4.8 2026.4.8
  55. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    High · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  56. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    High CVE-2026-42427 < 2026.4.8 2026.4.8
  57. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    High ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  58. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    High ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  59. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    High · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  60. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    High · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
  61. OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
    High CVE-2026-34511 < 2026.4.2 2026.4.2
  62. OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
    High CVE-2026-41393 < 2026.3.31 2026.3.31
  63. OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
    High · 9.8 CVE-2026-41386 < 2026.3.22 2026.3.22
  64. OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
    High CVE-2026-41353 < 2026.3.22 2026.3.22
  65. OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
    High · 8.8 CVE-2026-41378 < 2026.3.31 2026.3.31
  66. OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
    Critical · 8.2 CVE-2026-41296 < 2026.3.31 2026.3.31
  67. OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
    High · 6.5 CVE-2026-41369 < 2026.3.31 2026.3.31
  68. OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
    High CVE-2026-41404 < 2026.3.31 2026.3.31
  69. OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
    High CVE-2026-41349 < 2026.3.28 2026.3.28
  70. OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
    High · 6.1 CVE-2026-41373 < 2026.3.31 2026.3.31
  71. OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
    High · 8.8 CVE-2026-41352 < 2026.3.31 2026.3.31
  72. OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
    High · 7.5 CVE-2026-41405 < 2026.3.31 2026.3.31
  73. OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
    High CVE-2026-41366 < 2026.3.31 2026.3.31
  74. OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
    High · 9.6 CVE-2026-41397 < 2026.3.31 2026.3.31
  75. OpenClaw: Workspace `.env` can override the bundled plugin trust root
    High · 7.8 CVE-2026-41396 < 2026.3.31 2026.3.31
  76. OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
    High · 8.1 CVE-2026-41364 < 2026.3.31 2026.3.31
  77. OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
    High · 7.8 CVE-2026-41336 < 2026.3.31 2026.3.31
  78. OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation
    Critical CVE-2026-41329 < 2026.3.31 2026.3.31
  79. OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic
    High · 5.3 CVE-2026-41391 < 2026.3.31 2026.3.31
  80. OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
    Critical · 9.6 CVE-2026-41294 < 2026.3.28 2026.3.28
  81. OpenClaw gateway exec allow-always over-trusts positional carrier executables
    High · 7.3 CVE-2026-41380 < 2026.3.28 2026.3.28
  82. OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`
    High CVE-2026-41371 < 2026.3.28 2026.3.28
  83. OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper
    High · 7.3 CVE-2026-41390 < 2026.3.28 2026.3.28
  84. OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides
    High · 9.6 CVE-2026-41387 < 2026.3.22 2026.3.22
  85. OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing
    High CVE-2026-41299 < 2026.3.28 2026.3.28
  86. OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure
    High · 7.7 CVE-2026-41368 < 2026.3.28 2026.3.28
  87. OpenClaw's message tool media parameter bypasses tool policy filesystem isolation
    High · 6.2 CVE-2026-33581 < 2026.3.24 2026.3.24
  88. OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals
    High · 8.8 CVE-2026-41303 < 2026.3.28 2026.3.28
  89. OpenClaw's device removal and token revocation do not terminate active WebSocket sessions
    High · 7.5 CVE-2026-34503 < 2026.3.28 2026.3.28
  90. OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials
    High · 7.3 CVE-2026-41342 < 2026.3.28 2026.3.28
  91. OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation
    Critical CVE-2026-33579 < 2026.3.28 2026.3.28
  92. OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering
    High CVE-2026-41395 < 2026.3.28 2026.3.28
  93. OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface
    High · 8.1 CVE-2026-35653 < 2026.3.24 2026.3.24
  94. OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send
    High CVE-2026-35621 < 2026.3.24 2026.3.24
  95. OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
    High · 8.6 CVE-2026-35641 < 2026.3.24 2026.3.24
  96. OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
    High · 7.7 CVE-2026-35668 < 2026.3.24 2026.3.24
  97. OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
    High CVE-2026-35629 < 2026.3.28 2026.3.28
  98. OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility
    High CVE-2026-35636 >= 2026.3.11, < 2026.3.28 2026.3.28
  99. OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers
    High CVE-2026-35669 <= 2026.3.24 no fix
  100. OpenClaw: Silent privilege escalation via gateway shared-auth reconnect
    Critical CVE-2026-35625 <= 2026.3.24 no fix
  101. OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin
    Critical CVE-2026-35663 <= 2026.3.24 no fix
  102. OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding
    High CVE-2026-34512 <= 2026.3.24 no fix
  103. OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve
    Critical CVE-2026-35639 < 2026.3.22 2026.3.22
  104. OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement
    High CVE-2026-35631 < 2026.3.22 2026.3.22
  105. OpenClaw has Inconsistent Host Exec Environment Override Sanitization
    High · 7.5 CVE-2026-35650 < 2026.3.22 2026.3.22
  106. OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths
    High CVE-2026-35638 < 2026.3.22 2026.3.22
  107. OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure
    High CVE-2026-35633 < 2026.3.22 2026.3.22
  108. OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface
    High · 8.8 CVE-2026-35643 < 2026.3.22 2026.3.22
  109. OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper
    High · 8.8 CVE-2026-35666 < 2026.3.22 2026.3.22
  110. OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement
    High CVE-2026-35627 < 2026.3.22 2026.3.22
  111. OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers
    High CVE-2026-35660 < 2026.3.23 2026.3.23
  112. OpenClaw: Plivo V2 verified replay identity drifts on query-only variants
    High CVE-2026-35618 < 2026.3.23 2026.3.23
  113. OpenClaw is vulnerable to Path Traversal through path validation bypass
    High · 7.5 CVE-2026-32846 < 2026.03.28 2026.03.28
  114. OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
    High CVE-2026-32917 < 2026.3.13 2026.3.13
  115. OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
    High · 7.5 CVE-2026-32980 < 2026.3.13 2026.3.13
  116. OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
    High CVE-2026-32987 < 2026.3.13 2026.3.13
  117. OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
    High · 8.6 CVE-2026-32974 < 2026.3.12 2026.3.12
  118. OpenClaw: Gateway `agent` calls could override the workspace boundary
    High · 8.8 CVE-2026-33573 < 2026.3.11 2026.3.11
  119. OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
    Critical · 9.9 CVE-2026-22172 < 2026.3.12 2026.3.12
  120. `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
    High · 8.4 CVE-2026-32918 < 2026.3.11 2026.3.11
  121. OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories
    High CVE-2026-32920 < 2026.3.12 2026.3.12
  122. OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
    High · 8.8 CVE-2026-32914 < 2026.3.12 2026.3.12
  123. OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes
    High · 7.1 CVE-2026-32972 < 2026.3.11 2026.3.11
  124. OpenClaw: Sandbox staged writes could escape the verified parent directory before commit
    High · 7.5 CVE-2026-32988 < 2026.3.11 2026.3.11
  125. OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity
    High · 8.0 CVE-2026-32978 < 2026.3.11 2026.3.11
  126. OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv
    High · 7.1 CVE-2026-32971 < 2026.3.11 2026.3.11
  127. OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity
    High · 7.3 CVE-2026-32979 < 2026.3.11 2026.3.11
  128. OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries
    High · 8.8 CVE-2026-32915 < 2026.3.11 2026.3.11
  129. OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE
    Critical · 9.9 CVE-2026-32922 < 2026.3.11 2026.3.11
  130. OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes
    Critical · 9.4 CVE-2026-32916 >= 2026.3.7, < 2026.3.11 2026.3.11
  131. OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode
    High · 8.1 CVE-2026-32302 < 2026.3.11 2026.3.11
  132. OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary
    High · 7.0 ghsa-qcc4-p59m-p54m < 2026.2.26 2026.2.26
  133. OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf
    High · 7.6 CVE-2026-32055 < 2026.2.26 2026.2.26
  134. OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries
    High · 7.1 ghsa-gp3q-wpq4-5c5h < 2026.2.26 2026.2.26
  135. OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects
    High · 9.3 CVE-2026-32913 < 2026.3.7 2026.3.7
  136. OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage
    High · 7.1 ghsa-rchv-x836-w7xp < 2026.3.7 2026.3.7
  137. OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations
    High ghsa-3jx4-q2m7-r496 < 2026.2.25 2026.2.25
  138. OpenClaw Canvas Authentication Bypass Vulnerability
    High · 7.4 CVE-2026-3690 < 2026.2.19 2026.2.19
  139. OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images this entry
    Medium · 5.3 CVE-2026-32002 < 2026.2.23 2026.2.23
  140. OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows
    High · 6.8 CVE-2026-32005 < 2026.2.25 2026.2.25
  141. OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From
    High ghsa-2ch6-x3g4-7759 < 2026.2.23 2026.2.23
  142. OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains
    High CVE-2026-27566 < 2026.2.22 2026.2.22
  143. OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths
    High CVE-2026-27523 < 2026.2.24 2026.2.24
  144. OpenClaw: Zip extraction symlink traversal could write outside destination
    High ghsa-jxrq-8fm4-9p58 < 2026.2.22 2026.2.22
  145. OpenClaw hook transform path containment missed symlink-resolved escapes
    High ghsa-659f-22xc-98f2 < 2026.2.22 2026.2.22
  146. OpenClaw has multiple E2E/test Dockerfiles that run all processes as root
    High ghsa-w7j5-j98m-w679 < 2026.2.21 2026.2.21
  147. OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt
    High ghsa-7ff8-xjh3-mgh6 < 2026.2.23 2026.2.23
  148. OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)
    High · 7.5 CVE-2026-32056 < 2026.2.22 2026.2.22
  149. OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands
    High ghsa-w9cg-v44m-4qv8 < 2026.2.21 2026.2.21
  150. OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot
    High ghsa-xmv6-r34m-62p4 < 2026.2.25 2026.2.25
  151. OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks
    High · 7.8 CVE-2026-32015 >= 2026.1.21, < 2026.2.19 2026.2.19
  152. OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
    High CVE-2026-32063 < 2026.2.21 2026.2.21
  153. OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation
    High CVE-2026-22176 < 2026.2.19 2026.2.19
  154. OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution
    High CVE-2026-22179 < 2026.2.22 2026.2.22
  155. OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling
    High CVE-2026-31994 < 2026.2.19 2026.2.19
  156. OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)
    High · 6.8 CVE-2026-32007 < 2026.2.23 2026.2.23
  157. OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)
    High · 5.7 CVE-2026-32009 < 2026.2.24 2026.2.24
  158. OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization
    High · 8.0 ghsa-474h-prjg-mmw3 < 2026.3.2 2026.3.2
  159. OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification
    High · 6.5 CVE-2026-32004 < 2026.3.2 2026.3.2
  160. OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
    High CVE-2026-27670 < 2026.3.2 2026.3.2
Show more (20) Showing 160 of 236

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.