Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: OpenClaw 2026.2.21 Clear all filters
TI-2026-24575 CVE-2026-32034 · GHSA-3cvx-236h-m9fj

OpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP

Priority LOW 27

OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is exposed over plaintext HTTP, allowing attackers to byp…

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00405 Published 2026-03-19 Fixed in 2026.2.21 CWE-78
TI-2026-24570 CVE-2026-32029 · GHSA-2rgf-hm63-5qph

OpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing

Priority LOW 27

OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoof client IP addresses.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00201 Published 2026-03-19 Fixed in 2026.2.21 CWE-345
TI-2026-24563 CVE-2026-32022 · GHSA-3xfw-4pmr-4xc5

OpenClaw < 2026.2.21 - Arbitrary File Read via grep -e Flag Policy Bypass

Priority LOW 27

OpenClaw versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the grep tool within tools.exec.safeBins that allows attackers to read arbitrary files by supplying a pattern via the -e flag param…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00275 Published 2026-03-19 Fixed in 2026.2.21 CWE-184
TI-2026-24550 CVE-2026-32008 · GHSA-45cg-2683-gfmq

OpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard

Priority MEDIUM 64

OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authenticated users with browser-tool access to navigate to file:/…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00428 Published 2026-03-19 Fixed in 2026.2.21 CWE-610