Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: OpenClaw 2026.2.13 Clear all filters
TI-2026-22744 CVE-2026-28475 · GHSA-47q7-97xp-m272

OpenClaw < 2026.2.13 - Timing Attack via Hook Token Comparison

Priority LOW 28

OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0033 Published 2026-03-05 Fixed in 2026.2.13 CWE-208
TI-2026-22731 CVE-2026-28462 · GHSA-gq9c-wg68-gwj2

OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths

Priority MEDIUM 44

OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary di…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00483 Published 2026-03-05 Fixed in 2026.2.13 CWE-22