Vulnerabilities

TI-2026-32864 CVE-2026-45006 · GHSA-8wcm-622f-3r46

OpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypass

LOW 36

OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configuration changes by bypassing…

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00489 Published 2026-05-11 Fixed in 2026.4.23 CWE-184

TI-2026-32863 CVE-2026-45005 · GHSA-q8ff-7ffm-m3r9

OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation

LOW 26

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00289 Published 2026-05-11 Fixed in 2026.4.23 CWE-672

TI-2026-32862 CVE-2026-45004 · GHSA-r39h-4c2p-3jxp

OpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory

LOW 37

OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00144 Published 2026-05-11 Fixed in 2026.4.23 CWE-427

Vulnerabilities

Filters

OpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypass

OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation

OpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory