Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: OpenClaw 2026.6.9 Clear all filters
TI-2026-44417 CVE-2026-62194 · GHSA-rqg5-28vh-5645

OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install

Priority MEDIUM 40

OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00447 Published 2026-07-13 Fixed in 2026.6.9 CWE-732
TI-2026-44416 CVE-2026-62193 · GHSA-wfxc-2q5g-mm98

OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install

Priority LOW 30

OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00319 Published 2026-07-13 Fixed in 2026.6.9 CWE-863
TI-2026-44415 CVE-2026-62192 · GHSA-j48q-3j3c-39fr

OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass

Priority LOW 32

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring stronger authorization checks.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00415 Published 2026-07-13 Fixed in 2026.6.9 CWE-863
TI-2026-44414 CVE-2026-62191 · GHSA-wg67-843q-9p4v

OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations

Priority LOW 31

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00364 Published 2026-07-13 Fixed in 2026.6.9 CWE-862
TI-2026-44413 CVE-2026-62190 · GHSA-7x86-836h-h8c5

OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper

Priority MEDIUM 40

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00508 Published 2026-07-13 Fixed in 2026.6.9 CWE-706
TI-2026-44412 CVE-2026-62189 · GHSA-vgjq-7pq9-cvwp

OpenClaw < 2026.6.9 Symlink Following via Mirror Sync

Priority LOW 35

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00375 Published 2026-07-13 Fixed in 2026.6.9 CWE-367