Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: OpenClaw 2026.4.12 Clear all filters
TI-2026-31708 CVE-2026-43574 · GHSA-49cg-279w-m73x

OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists

Priority LOW 26

OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval authorization.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00244 Published 2026-05-05 Fixed in 2026.4.12 CWE-183
TI-2026-31694 CVE-2026-43530 · GHSA-2cq5-mf3v-mx44

OpenClaw 2026.2.23 < 2026.4.12 - Weakened Exec Approval Binding via busybox and toybox Applet Execution

Priority MEDIUM 40

OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obscure which applet would actually run.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00356 Published 2026-05-05 Fixed in 2026.4.12 CWE-863
TI-2026-30725 CVE-2026-42435 · GHSA-j6c7-3h5x-99g9

OpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment Injection

Priority MEDIUM 40

OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at the argv level.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00408 Published 2026-05-05 Fixed in 2026.4.12 CWE-184