OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope

OpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch Wrapper

OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim

OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitization

OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface

OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession

OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation

OpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UI

OpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace Plugins

OpenClaw < 2026.3.11 - Workspace Boundary Bypass via Agent RPC Parameters

OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Subagent Control Surface

OpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug Endpoints

OpenClaw < 2026.3.1 - Authorization Bypass in Agent Runs via Owner-Only Tool Access

OpenClaw < 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway Authentication

OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods

OpenClaw < 2026.2.22 - Allowlist Bypass via sort --compress-program Parameter

OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S

OpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run

OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars

OpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.run

OpenClaw Skill Env applySkillConfigenvOverrides code injection

OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths

OpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBins

OpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH Handling

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to…

OpenClaw has a command injection in maintainer clawtributors updater

Authenticated Command Injection in OpenClaw Docker Execution via PATH Environment Variable

OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a…

OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validation

OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags

OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File

OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters

OpenClaw < 2026.2.24 - Arbitrary File Read via Improper Temporary Path Validation in Sandbox

OpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIds

OpenClaw < 2026.2.2 - SSRF via Attachment Media URL Hydration

OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route

OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery

OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes

OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths

OpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset Command

OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool

OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply

OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node

OpenClaw before 2026.7.1 Authentication Bypass via node.invoke

OpenClaw before 2026.8.1 Unauthorized Command Job Access

OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch

OpenClaw iOS Control UI TLS Pin Enforcement Bypass

OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs

OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback

OpenClaw < 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOS