AI Agent Security Feed

CVE-2026-62220

OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass

CVE-2026-62205

OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions

CVE-2026-62210

OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs

CVE-2026-62201

OpenClaw < 2026.6.6 Network Policy Bypass via exec-server

CVE-2026-62221

OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom

CVE-2026-15193

AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection

CVE-2026-53843

Affected: < 2026.5.26

OpenClaw: Pairing-scoped device session could restore revoked node token authority

CVE-2026-53849

Affected: <= 2026.5.6

OpenClaw: Discord allowFrom could bind to mutable display names

CVE-2026-53857

Affected: <= 2026.5.2

OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy

CVE-2026-53855

Affected: < 2026.4.2

OpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checks

CVE-2026-53853

Affected: < 2026.5.12

OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns

CVE-2026-53864

Affected: <= 2026.5.22

OpenClaw: Host environment sanitizer missed two Node.js control variables

CVE-2026-53866

Affected: <= 2026.5.10-beta.1

OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing

CVE-2026-53865

Affected: < 2026.5.2

OpenClaw: Workspace-derived service PATH could influence trash command selection

CVE-2026-53842

Affected: < 2026.5.2

OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

CVE-2026-53846

Affected: < 2026.4.29

OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install

CVE-2026-53858

Affected: < 2026.5.2

OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots

CVE-2026-53850

Affected: <= 2026.4.24

OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command

CVE-2026-53851

Affected: <= 2026.5.7

OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass

CVE-2026-53840

Affected: < 2026.5.12

OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin

CVE-2026-53844

Affected: <= 2026.4.27

OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search

CVE-2026-53854

Affected: <= 2026.4.24

OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state

CVE-2026-53859

Affected: <= 2026.5.22

OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency

CVE-2026-53863

Affected: <= 2026.4.24

OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy

CVE-2026-53856

Affected: = 2026.4.23

OpenClaw: Config recovery could restore openclaw.json with broad file permissions

CVE-2026-53847

Affected: <= 2026.5.5

OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope

CVE-2026-53861

Affected: <= 2026.5.5

OpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOS

CVE-2026-53845

Affected: <= 2026.5.5

OpenClaw: Skill-command dispatch could skip before-tool-call hooks

CVE-2026-53848

Affected: <= 2026.5.22

OpenClaw < 2026.5.26 - Exec Allowlist Bypass via Transparent Command Wrappers

CVE-2026-53852

Affected: <= 2026.4.24

OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing

CVE-2026-53860

Affected: <= 2026.5.6

OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers

CVE-2026-53862

Affected: <= 2026.5.10-beta.2

OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening

CVE-2026-53841

Affected: <= 2026.5.7

OpenClaw: Exported session HTML could keep unsafe markdown links

CVE-2026-53822

OpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Execution

CVE-2026-53836

Affected: <= 2026.5.7

OpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliases

CVE-2026-53829

OpenClaw < 2026.5.18 - Command Truncation in Exec Approval Display

CVE-2026-53834

Affected: <= 2026.4.26

OpenClaw < 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash Commands

CVE-2026-53831

Affected: < 2026.5.18

OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

CVE-2026-53833

Affected: <= 2026.4.27

OpenClaw: QQBot streaming command could mutate config without explicit allowFrom

CVE-2026-53832

Affected: < 2026.5.18

OpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration

CVE-2026-53837

Affected: <= 2026.5.5

OpenClaw: Mattermost handlers could fall open when channel type was missing

CVE-2026-53830

Affected: <= 2026.4.21

OpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reload

CVE-2026-53838

Affected: < 2026.5.27

OpenClaw < 2026.5.27 - Node Pairing State Mutation via Reconnection

CVE-2026-53814

Affected: < 2026.5.20

OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority

CVE-2026-53817

Affected: < 2026.5.22

OpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing

CVE-2026-53819

Affected: < 2026.5.27

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

CVE-2026-53816

Affected: < 2026.5.18

OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node

CVE-2026-53806

Affected: <= 2026.5.7

OpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec Revalidation

CVE-2026-53810

Affected: < 2026.5.18

OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

CVE-2026-53811

Affected: <= 2026.5.6

OpenClaw: Matrix allowFrom could bind to mutable display names

CVE-2026-53813

Affected: <= 2026.4.24

OpenClaw: Fake package roots could influence memory-core artifact loading

CVE-2026-53815

Affected: <= 2026.5.19-beta.2

OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions

CVE-2026-53818

Affected: < 2026.4.24

OpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP Loopback

CVE-2026-53812

Affected: < 2026.5.18

OpenClaw's browser act interactions could bypass private-network navigation checks

CVE-2026-53809

Affected: <= 2026.4.24

OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy

CVE-2026-35630

Affected: < 2026.5.18

OpenClaw: QQBot native approval buttons did not enforce configured approver identity

CVE-2026-32906

OpenClaw < 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver Gate

CVE-2026-34507

OpenClaw < 2026.4.29 - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom Checks

CVE-2026-45224

Crabbox < 0.9.0 Path Traversal via Islo Provider Workspace Resolution

CVE-2026-45001

OpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access

CVE-2026-44993

OpenClaw < 2026.4.20 - Direct Message Misclassification in Feishu Card Actions

CVE-2026-44991

OpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel Senders

CVE-2026-43533

OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags

CVE-2026-43531

OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File

CVE-2026-41396

OpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust Root

CVE-2026-42422

OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function

CVE-2026-42428

OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads

CVE-2026-42432

OpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass

CVE-2026-41375

OpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints

CVE-2026-41393

OpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery

CVE-2026-41402

OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass

CVE-2026-41408

OpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypass

CVE-2026-41916

OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload

CVE-2026-41364

OpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar Upload

CVE-2026-41372

OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery

CVE-2026-41366

OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting

CVE-2026-41367

OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions

CVE-2026-41349

OpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch

CVE-2026-41359

OpenClaw < 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistence

CVE-2026-41343

OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency

CVE-2026-41335

OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON

CVE-2026-41338

OpenClaw < 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File Operations

CVE-2026-41299

OpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guard

CVE-2026-41301

OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass

CVE-2026-35663

OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim

CVE-2026-35621

OpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence

CVE-2026-35652

OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch

CVE-2026-35649

OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist

CVE-2026-35656

OpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate Limiter

CVE-2026-35639

OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation

CVE-2026-34512

OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint

CVE-2026-35636

OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution

CVE-2026-35617

OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName

CVE-2026-35624

OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk

CVE-2026-34425

OpenClaw - Shell-Bleed Protection Preflight Validation Bypass

CVE-2026-33580

OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication

CVE-2026-32988

OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unvalidated Temporary File Creation

CVE-2026-32977

OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path

CVE-2026-33578

OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions

CVE-2026-32918

OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool

CVE-2026-32919

OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash Commands

CVE-2026-32846

OpenClaw Media Parsing Path Traversal to Arbitrary File Read

CVE-2026-27646

OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command

CVE-2026-32042

OpenClaw < 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway Authentication

CVE-2026-32049

OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass

CVE-2026-32048

OpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn

CVE-2026-32044

OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installation

CVE-2026-32054

OpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path Handling

CVE-2026-22172

OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections

CVE-2026-32035

OpenClaw < 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript Handler

CVE-2026-31995

OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension

CVE-2026-32020

OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler

CVE-2026-22171

OpenClaw < 2026.2.19 - Path Traversal in Feishu Media Temporary File Naming

CVE-2026-22169

OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins

CVE-2026-27523

OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths

CVE-2026-27545

OpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind

CVE-2026-22180

OpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write Operations

CVE-2026-32060

OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths

CVE-2026-30741

A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6

CVE-2026-28446

OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching

CVE-2026-28462

OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths

CVE-2026-28478

Affected: < 2026.2.13, <= 2026.1.24-3

OpenClaw affected by denial of service via unbounded webhook request body buffering

CVE-2026-28482

OpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parameters

CVE-2026-28393

OpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path Traversal

CVE-2026-28469

Affected: < 2026.2.14, <= 2026.1.24-3

OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting

CVE-2026-28458

Affected: >= 2026.1.20, < 2026.2.1, <= 0.1.0

OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access

CVE-2026-28480

Affected: < 2026.2.14, <= 2026.1.24-3

OpenClaw Telegram allowlist authorization accepted mutable usernames

CVE-2026-29612

Affected: < 2026.2.14, <= 2026.1.24-3

OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding

CVE-2026-28452

Affected: < 2026.2.14, <= 2026.1.24-3

OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)

CVE-2026-28448

OpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control

CVE-2026-28471

OpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix Plugin

CVE-2026-28457

OpenClaw < 2026.2.14 - Path Traversal in Sandbox Skill Mirroring via Name Parameter

CVE-2026-33068

Affected: < 2.1.50

Workspace trust dialog bypass via repo-controlled settings. A malicious .claude/settings.json could auto-approve dangerous permissions when the repository is opened.

CVE-2026-26323

OpenClaw has a command injection in maintainer clawtributors updater

CVE-2026-27002

OpenClaw: Docker container escape via unvalidated bind mount config injection

CVE-2026-26317

Affected: < 2026.2.14, <= 2026.1.24-3

OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints

CVE-2026-27004

OpenClaw session tool visibility hardening and Telegram webhook secret fallback

CVE-2026-26328

Affected: < 2026.2.14, < 2026.2.14

OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities

CVE-2026-24764

OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions

CVE-2026-25157

Affected: < 2026.1.29

OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand

CVE-2026-24763

Affected: <= 2026.1.24

OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable

CVE-2026-25253

Affected: <= 2026.1.28

OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl

CVE-2026-24887

Affected: < 2.1.0

Command injection via find command bypass. Claude Code's denylist for dangerous commands could be bypassed using the find command's -exec flag.

CVE-2026-21852

Affected: < 2.0.65

API key exfiltration via ANTHROPIC_BASE_URL override. A malicious .env file could redirect API calls to an attacker-controlled endpoint, leaking the user's API key.

CVE-2025-59536

Affected: < 1.0.111

Remote code execution via malicious hooks/MCP configs in untrusted repos. Opening an untrusted repository could trigger pre-trust code execution through crafted hook configurations.

CVE-2025-55284

Affected: < 1.0.90

Data exfiltration via DNS requests through prompt injection. Malicious content in project files could trigger DNS-based data exfiltration bypassing network controls.

CVE-2025-54794

Affected: < 1.0.80

Prompt injection bypassing approval prompts. Crafted file contents could manipulate Claude Code into executing unapproved tool calls without user consent.