Vendor
OpenClaw
- CVEs tracked · all time
- 11
- in CISA KEV · all time
- 0
- articles · since 11 Sep
- 0
- articles · all time
- 11
No articles in the last 45 daysThe latest: Securelist, Wed 26 Aug, 10:21 UTC.See the full timeline
Products: OpenClaw
CVEs
11 CVEsCVE-2026-26322OpenClaw Gateway tool allowed unrestricted gatewayUrl overrideCVSSUnrated–Not in KEV0.4%EPSS1article
CVE-2026-26319OpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated RequestsCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-25593OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.applyCVSSUnrated–Not in KEV0.7%EPSS1article
CVE-2026-25475OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path ExtractionCVSSUnrated–Not in KEV0.8%EPSS1article
CVE-2026-25157OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommandCVSSUnrated–Not in KEV1.1%EPSS2articles
- AI driven software surge fuels record Q2 2026 vulnerability spikeSecurelist
- OpenClaw bugs enable full system takeover via chained exploitsDark Reading
- ‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor DeliverySecurityWeek
- OpenClaw chain lets attackers hijack config and steal dataThe Hacker News
- Linux Clipboard Malware Steals Crypto Payments, Researchers Warndti.domaintools.com
- OpenClaw CVE-2026-33579 flaw lets attackers hijack admin rightsArs Technica
- OpenClaw flaw lets malicious site hijack agent CVE-2026-25253Dark Reading
- OpenClaw ClawJacked lets malicious page abuse localhost WebSocketThe Hacker News
- OpenClaw Security Issues Continue as SecureClaw Open Source Tool DebutsSecurityWeek
- Vulnerability Allows Hackers to Hijack OpenClaw AI AssistantSecurityWeek
- OpenClaw Bug Enables One-Click Remote Code Execution via Malicious LinkThe Hacker News · first in our coverage