Openclaw Security Vulnerabilities (CVEs)

OpenClaw versions 2026.2.13 and below on macOS are vulnerable to OS command injection when refreshing OAuth tokens in the Keychain. This allows attack...

OpenClaw's ACP bridge accepts excessively large prompt text blocks, allowing local ACP clients to send oversized payloads that could cause resource ex...

OpenClaw versions 2026.2.17 and below have a symlink vulnerability in the skill packaging script that allows local file inclusion when building .skill...

OpenClaw Control UI had a stored XSS vulnerability where attacker-controlled JavaScript could execute in the Control UI origin. This affected OpenClaw...

OpenClaw session tools allowed broader session targeting than intended in shared-agent deployments, potentially exposing transcript content across pee...

OpenClaw versions before 2026.2.15 contain a path traversal vulnerability in the skill installation process. The bug allows malicious skill packages t...

OpenClaw versions 2026.1.12 through 2026.2.12 contain a path traversal vulnerability in browser download helpers that allows authenticated attackers t...

OpenClaw personal AI assistant versions before 2026.2.14 allow authenticated attackers to read arbitrary files from the Gateway host via path traversa...

OpenClaw's Feishu extension had a path traversal vulnerability that allowed reading arbitrary local files by supplying attacker-controlled paths. This...

OpenClaw versions 2026.1.8 through 2026.2.13 have a command injection vulnerability in a developer script that processes git commit metadata. When mai...

OpenClaw personal AI assistant versions before 2026.2.14 could expose sensitive configuration secrets to clients with read-only permissions. The vulne...

OpenClaw's SSRF protection could be bypassed using IPv4-mapped IPv6 addresses, allowing attackers to access restricted internal resources like localho...

OpenClaw versions 2026.2.13 and below with the @openclaw/voice-call plugin allow unauthenticated attackers to forge Telnyx webhook events when telnyx....

This vulnerability allows attackers to bypass authentication in OpenClaw's BlueBubbles iMessage plugin by sending webhook requests from localhost addr...

OpenClaw versions 2026.1.30 and below have an authentication bypass vulnerability in Telegram webhook mode. When channels.telegram.webhookSecret is no...

OpenClaw personal AI assistant versions before 2026.1.20 contain a command injection vulnerability. Unauthenticated local clients can exploit the Gate...

OpenClaw versions before 2026.1.30 contain a path traversal vulnerability in the isValidMedia() function that allows reading arbitrary files on the sy...

OpenClaw versions before 2026.1.29 contain two command injection vulnerabilities. Attackers can execute arbitrary commands on remote SSH hosts via une...

OpenClaw (formerly Clawdbot) versions prior to 2026.1.29 contain a command injection vulnerability in the Docker sandbox execution mechanism. Authenti...

OpenClaw (also known as clawdbot or Moltbot) versions before 2026.1.29 automatically establish WebSocket connections using gatewayUrl values from quer...