Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: OpenClaw 2026.2.1 Clear all filters
TI-2026-22727 CVE-2026-28458 · GHSA-mr32-vwc2-5j6h

OpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket Endpoint

Priority LOW 34

OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing we…

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00351 Published 2026-03-05 Fixed in 2026.2.1 CWE-306
TI-2026-22718 CVE-2026-28448 · GHSA-33rq-m5x2-fvgf

OpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control

Priority LOW 35

OpenClaw versions 2026.1.29 prior to 2026.2.1 contain a vulnerability in the Twitch plugin (must be installed and enabled) in which it fails to enforce the allowFrom allowlist when allowedRoles is unset or empty, allowin…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00515 Published 2026-03-05 Fixed in 2026.2.1 CWE-285
TI-2026-22716 CVE-2026-28446 · GHSA-4rj2-gpmh-qq5x

OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching

Priority MEDIUM 49

OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist policy validation that accepts empty caller IDs and uses suffix-…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00747 Published 2026-03-05 Fixed in 2026.2.1, 2026.2.2 CWE-303