Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: OpenClaw 2026.6.6 Clear all filters
TI-2026-44423 CVE-2026-62200 · GHSA-h7rf-pv8c-84mg

OpenClaw < 2026.6.6 Authentication Bypass via Git ext transport

Priority MEDIUM 40

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00525 Published 2026-07-13 Fixed in 2026.6.6 CWE-184
TI-2026-44421 CVE-2026-62198 · GHSA-jfxm-h5m6-27f9

OpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web Search

Priority LOW 24

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stronger policy checks.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00271 Published 2026-07-13 Fixed in 2026.6.6 CWE-863
TI-2026-44420 CVE-2026-62197 · GHSA-3x84-qq85-fj65 · GHSA-jw7v-5mp7-ghgm

OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery

Priority LOW 28

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00334 Published 2026-07-13 Fixed in 2026.6.6 CWE-918
TI-2026-44418 CVE-2026-62195 · GHSA-5pr8-xjq5-2wrc

OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback

Priority MEDIUM 40

OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00396 Published 2026-07-13 Fixed in 2026.6.6 CWE-732