Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: OpenClaw 2026.4.25 Clear all filters
TI-2026-38850 CVE-2026-53854 · GHSA-4hpg-mp64-x7xq

OpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commands

Priority LOW 26

OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom state across channel boundaries.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00245 Published 2026-06-16 Fixed in 2026.4.25 CWE-863
TI-2026-38848 CVE-2026-53852 · GHSA-8mg9-j9cf-54cj

OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing

Priority LOW 11

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00206 Published 2026-06-16 Fixed in 2026.4.25 CWE-636
TI-2026-38846 CVE-2026-53850 · GHSA-mpc8-jxjh-qpgh

OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command

Priority LOW 29

OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00093 Published 2026-06-16 Fixed in 2026.4.25 CWE-862