openclaw vulnerabilities
CVEs whose affected-version data names the openclaw package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
212 CVEsRSS
CVE-2026-28474Critical· 9.8OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists
OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their…
▾ Midnightopenclaw · openclawEPSS 0.55%via NVD
CVE-2026-28465Medium· 5.9OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can sp…
▾ Sunlitopenclaw · openclawEPSS 0.43%via NVD