Threat database

OpenClaw versions before 2026.4.2 have a vulnerability in the Zalo webhook replay deduplication mechanism. This flaw allows legitimate events from different conversations or senders to be incorrectly treated as duplicates, causing silent message suppression and disruption of bot workflows across chat sessions.

OpenClaw versions before 2026.3.22 have an access control bypass vulnerability in the allowProfiles feature. This flaw allows remote attackers with low privileges to manipulate browser proxy profiles at runtime, circumventing profile restrictions and gaining unauthorized access to restricted profiles.

OpenClaw versions before 2026.3.31 have a remote code execution vulnerability due to missing authorization in the node scope gate. An attacker with device pairing credentials can bypass node pairing validation and execute arbitrary commands on the host system.

OpenClaw versions before 2026.3.31 have a replay detection bypass vulnerability in webhook signature handling. The vulnerability arises because the system treats Base64 and Base64URL encoded signatures as distinct, allowing attackers to re-encode valid Telnyx webhook signatures to bypass replay detection while still passing signature verification.

OpenClaw versions before 2026.3.31 have a vulnerability in the session_status function that allows bypassing session visibility restrictions. This flaw occurs because the function does not enforce configured tools.sessions.visibility settings for unsandboxed calls, enabling attackers with limited privileges to access session information that should be restricted.

OpenClaw versions before 2026.3.28 have a missing authorization vulnerability (CWE-862) that allows large language model (LLM) agents to bypass execution approval controls via the config.patch parameter. This enables remote attackers with limited privileges to execute unauthorized operations without user consent.

OpenClaw versions before 2026.3.31 have an authorization bypass vulnerability affecting Discord slash command and autocomplete paths. This flaw allows authorized Discord users to bypass group DM channel allowlist restrictions and access restricted group DM channels. The vulnerability is due to incorrect enforcement of authorization checks in these specific command paths.

OpenClaw versions before 2026.3.31 have a Cross-Site Request Forgery (CSRF) vulnerability due to missing browser-origin validation in HTTP operator endpoints when running in trusted-proxy mode. This flaw allows attackers to send malicious requests from a browser to perform unauthorized actions on these endpoints.

CVE-2026-41346 is a vulnerability in OpenClaw version 2026.2.26 where the system incorrectly enforces pending pairing-request limits per channel file rather than per account. This flaw allows remote attackers to submit pairing requests from other accounts to exhaust the shared pending window, effectively blocking new pairing challenges on unaffected accounts and causing a denial of service.

OpenClaw versions before 2026.3.31 have a vulnerability where Authorization headers are forwarded across cross-origin redirects in the media download functionality. This can lead to exposure of sensitive credentials if attackers craft malicious redirect chains. The vulnerability is identified as CWE-522 (Insufficiently Protected Credentials) and has a medium severity rating.

OpenClaw versions before 2026.3.28 have a privilege escalation vulnerability in the chat.send endpoint. This flaw allows users with write-scoped gateway access to persist admin-only verboseLevel session overrides via the /verbose parameter. Exploiting this can bypass access controls and expose sensitive information intended only for administrators.

OpenClaw versions before 2026.3.31 have a vulnerability where the public LINE webhook endpoint does not enforce a shared pre-auth concurrency limit. This allows remote attackers to flood the webhook with concurrent requests prior to signature verification, potentially exhausting resources and causing transient availability loss.

OpenClaw versions before 2026.3.28 have an authentication bypass vulnerability in the remote onboarding component. This flaw allows attackers to spoof discovery endpoints, redirecting onboarding to malicious gateways and potentially capturing gateway credentials or traffic.

OpenClaw versions before 2026.3.31 have a logic error in the Discord component interaction routing that causes group direct messages to be misclassified as direct messages. This flaw can allow attackers to bypass group DM policy enforcement or cause incorrect session handling. The vulnerability has a low severity score and no known exploits in the wild.

OpenClaw versions before 2026.3.31 have an authentication boundary vulnerability due to improper handling of trust propagation in Telegram legacy allowFrom migration. This flaw allows attackers to bypass authentication controls and gain unauthorized access to named accounts.

OpenClaw versions before 2026.4.2 expose sensitive configuration and state directory metadata in Gateway connection success snapshots to authenticated non-admin clients. This exposure allows these clients to obtain host-specific filesystem paths and deployment details, which can be used for host fingerprinting and potentially facilitate further chained attacks.

CVE-2026-41338 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in OpenClaw versions before 2026.3.31. It affects sandbox file operations where attackers can exploit check-then-act patterns in functions like apply_patch, remove, and mkdir to bypass file descriptor-based defenses by manipulating files between validation and execution.

CVE-2026-41337 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in OpenClaw before version 2026.3.31. It affects the Plivo voice-call replay feature, allowing attackers to mutate the callback origin during replay before rejection. This can be exploited by attackers who have captured valid callbacks for live calls to manipulate callback origins during the replay process.

OpenClaw versions before 2026.3.31 contain a vulnerability where workspace .env files can override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable. This allows attackers to load malicious hook code by replacing trusted default hooks with attacker-controlled ones, leading to arbitrary code execution.

OpenClaw versions before 2026.3.31 have an information disclosure vulnerability in the Control Interface bootstrap JSON. This flaw exposes version and assistant agent identifiers, allowing attackers to obtain sensitive fingerprinting information about system versions and agent configurations. The vulnerability has a medium severity with a CVSS score of 6.9. No patch or fix information is currently provided.