Vulnerabilities

TI-2026-29988 CVE-2026-41387 · GHSA-j7p2-qcwm-94v4

OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitization

LOW 38

OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00241 Published 2026-04-28 Fixed in 2026.3.22 CWE-183

TI-2026-29987 CVE-2026-41386 · GHSA-gg9v-mgcp-v6m7

OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes

MEDIUM 47

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00328 Published 2026-04-28 Fixed in 2026.3.22 CWE-648

Vulnerabilities

Filters

OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitization

OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes