Vulnerabilities

TI-2026-25361 CVE-2026-32913 · GHSA-6mgf-v5j7-45cr

OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects

MEDIUM 44

OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00321 Published 2026-03-23 Fixed in 2026.3.7 CWE-522

TI-2026-22028 CVE-2026-27646 · GHSA-9q36-67vc-rrwg

OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command

LOW 25

OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime.

CVSS 4.0MEDIUM 5.8 Local Low privileges No interaction EPSS 0.00108 Published 2026-03-23 Fixed in 2026.3.7 CWE-863

TI-2026-21625 CVE-2026-27183 · GHSA-r6qf-8968-wj9q

OpenClaw < 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatch

LOW 10

OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip shell wrapper approval requirements.

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00113 Published 2026-03-23 Fixed in 2026.3.7 CWE-863

Vulnerabilities

Filters

OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects

OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command

OpenClaw < 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatch