OpenClaw has 246 CVEs on record. Cadence is steady at roughly 95 per quarter. The busiest recent month was September 2026 with 92. The median CVSS is 6.7 (medium), with 8 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (58) and CWE-862 (35). Most affected products: OpenClaw (211), OpenClaw Windows Node (6), clawhub (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.7
- Publish → KEV
- —
- Last 90 days
- 95 prev 114
Weakness classes
Products
- OpenClaw 211
- OpenClaw Windows Node 6
- clawhub 5
- ClawScan 3
- crabbox 3
- @openclaw/feishu 2
Worst active — by depth score
CVE-2026-33579Critical· 9.9OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check67CVE-2026-8634Critical· 9.1Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens…62CVE-2026-101882High· 8.8OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil61CVE-2026-101880High· 8.8OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions61CVE-2026-22172Critical· 9.9OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections55
OpenClaw vulnerabilities
CVEs affecting OpenClaw, newest first. Open any entry for full detail, references, and exploit status.
246 CVEsRSS
CVE-2026-53848Low· 4.3OpenClaw: Exec allowlist could miss side effects from transparent command wrappers
OpenClaw: Exec allowlist could miss side effects from transparent command wrappers
CVE-2026-53859Medium· 6.5OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently
CVE-2026-53855High· 8.1OpenClaw: Shell positional parameters could weaken strict inline-eval checks
OpenClaw: Shell positional parameters could weaken strict inline-eval checks
CVE-2026-53862Low· 4.2OpenClaw: Bootstrap token replay could widen pending pairing scopes
OpenClaw: Bootstrap token replay could widen pending pairing scopes
CVE-2026-53851Medium· 5.3OpenClaw: Slack reaction events could ignore reaction notification settings
OpenClaw: Slack reaction events could ignore reaction notification settings
CVE-2026-53841Medium· 6.1OpenClaw: Exported session HTML could keep unsafe markdown links
OpenClaw: Exported session HTML could keep unsafe markdown links
CVE-2026-53847MediumOpenClaw: Active Memory write scope could mutate global config
OpenClaw: Active Memory write scope could mutate global config
CVE-2026-53845Low· 4.3OpenClaw: Skill-command dispatch could skip before-tool-call hooks
OpenClaw: Skill-command dispatch could skip before-tool-call hooks
CVE-2026-53857High· 8.1OpenClaw: Zalo allowFrom could bind to mutable display names
OpenClaw: Zalo allowFrom could bind to mutable display names
CVE-2026-53856Medium· 5.5OpenClaw: Config recovery could restore openclaw.json with broad file permissions
OpenClaw: Config recovery could restore openclaw.json with broad file permissions
CVE-2026-53844Medium· 6.5OpenClaw: memory-wiki shared search could miss session visibility checks
OpenClaw: memory-wiki shared search could miss session visibility checks
CVE-2026-53860Low· 4.2OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers
OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers
CVE-2026-53853High· 7.1OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
CVE-2026-53846High· 7.1OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
CVE-2026-53850MediumOpenClaw: Focus command could miss controlScope enforcement
OpenClaw: Focus command could miss controlScope enforcement
CVE-2026-53858High· 7.1OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
CVE-2026-53849High· 8.1OpenClaw: Discord allowFrom could bind to mutable display names
OpenClaw: Discord allowFrom could bind to mutable display names
CVE-2026-53865High· 7.1OpenClaw: Workspace-derived service PATH could influence trash command selection
OpenClaw: Workspace-derived service PATH could influence trash command selection
CVE-2026-53852Low· 5.4OpenClaw: Empty-scope device re-pairing could confuse caller scope containment
OpenClaw: Empty-scope device re-pairing could confuse caller scope containment
CVE-2026-53854MediumOpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state
OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state
CVE-2026-53840High· 7.1OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
GHSA-6xcg-6q43-rj2vLow· 6.1Duplicate Advisory: Exported session HTML could keep unsafe markdown links
Duplicate Advisory: Exported session HTML could keep unsafe markdown links
GHSA-6jm4-83g2-35gvMedium· 6.5Duplicate Advisory: memory-wiki shared search could miss session visibility checks
Duplicate Advisory: memory-wiki shared search could miss session visibility checks
GHSA-x7cf-6gp3-q5f8Medium· 7.1Duplicate Advisory: MCP Streamable HTTP redirects could forward configured custom headers to another origin
Duplicate Advisory: MCP Streamable HTTP redirects could forward configured custom headers to another origin
GHSA-wrmq-9fc4-gwwjHigh· 8.8Duplicate Advisory: Pairing-scoped device session could restore revoked node token authority
Duplicate Advisory: Pairing-scoped device session could restore revoked node token authority
GHSA-9fr2-p65v-gqxqHigh· 7.1Duplicate Advisory: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
Duplicate Advisory: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
GHSA-58wc-8wrv-xp9jMedium· 5.4Duplicate Advisory: Active Memory write scope could mutate global config
Duplicate Advisory: Active Memory write scope could mutate global config
GHSA-wrr6-p5r6-474mLow· 4.3Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers
Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers
GHSA-gw2c-6hcg-5g52Medium· 5.5Duplicate Advisory: Focus command could miss controlScope enforcement
Duplicate Advisory: Focus command could miss controlScope enforcement
GHSA-p44v-rx83-vjp4High· 8.1Duplicate Advisory: Discord allowFrom could bind to mutable display names
Duplicate Advisory: Discord allowFrom could bind to mutable display names