Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: OpenClaw 2026.2.26 Clear all filters
TI-2026-24606 CVE-2026-32067 · GHSA-vjp8-wprm-2jw9

OpenClaw < 2026.2.26 - Cross-Account Authorization Bypass in DM Pairing Store

Priority LOW 10

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple ac…

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00171 Published 2026-03-21 Fixed in 2026.2.26 CWE-863
TI-2026-24598 CVE-2026-32058 · GHSA-hjvp-qhm6-wrh2

OpenClaw < 2026.2.26 - Approval Context-Binding Weakness in system.run via host=node

Priority LOW 10

OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests with modified environment variables.

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00203 Published 2026-03-21 Fixed in 2026.2.26 CWE-863
TI-2026-24595 CVE-2026-32055 · GHSA-mgrq-9f93-wpp5

OpenClaw < 2026.2.26 - Workspace Path Boundary Bypass via Non-existent Symlink

Priority LOW 32

OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the workspace through in-workspace symlinks pointing to non-existe…

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00342 Published 2026-03-21 Fixed in 2026.2.26 CWE-22