Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: OpenClaw 2026.2.22 Clear all filters
TI-2026-17789 CVE-2026-22179 · GHSA-9p38-94jf-hgjj

OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.run

Priority HIGH 68

OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command subs…

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00669 Published 2026-03-18 Fixed in 2026.2.22 CWE-78
TI-2026-17784 CVE-2026-22174 · GHSA-v3j7-34xh-6g3w

OpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP Probe

Priority LOW 25

OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to capture the Gateway authentication token.

CVSS 4.0MEDIUM 5.9 Local No auth No interaction EPSS 0.00134 Published 2026-03-18 Fixed in 2026.2.22 CWE-306
TI-2026-17781 CVE-2026-22170 · GHSA-jwf4-8wf4-jf2m

OpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom Configuration

Priority LOW 34

OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration causes dmPolicy pairing and allowlist restrictions to be ineffe…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00271 Published 2026-03-18 Fixed in 2026.2.22 CWE-863
TI-2026-17780 CVE-2026-22169 · GHSA-vmqr-rc7x-3446

OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins

Priority LOW 33

OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compress-program option.

CVSS 4.0HIGH 7.1 Local High privileges No interaction EPSS 0.0021 Published 2026-03-18 Fixed in 2026.2.22 CWE-78