Filtered by vendor Openclaw Subscriptions
Total 347 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-4040 1 Openclaw 1 Openclaw 2026-03-20 3.3 Low
A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version 2026.2.19-beta.1 is capable of addressing this issue. The identifier of the patch is bafdbb6f112409a65decd3d4e7350fbd637c7754. Upgrading the affected component is advised.
CVE-2026-32059 1 Openclaw 1 Openclaw 2026-03-20 8.8 High
OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allowing attackers to bypass denied-flag checks via abbreviated options. Remote attackers can execute sort commands with abbreviated long options to skip approval requirements in allowlist mode.
CVE-2026-32060 1 Openclaw 1 Openclaw 2026-03-20 8.8 High
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary files.
CVE-2026-32061 1 Openclaw 1 Openclaw 2026-03-20 4.4 Medium
OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outside the config directory boundary. Attackers with config modification capabilities can exploit this by specifying absolute paths, traversal sequences, or symlinks to access sensitive files readable by the OpenClaw process user, including API keys and credentials.
CVE-2026-32063 1 Openclaw 1 Openclaw 2026-03-20 7.1 High
OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-controlled environment values are not validated for CR/LF characters, allowing newline injection to break out of Environment= lines and inject arbitrary systemd directives. An attacker who can influence config.env.vars and trigger service install or restart can execute arbitrary commands with the privileges of the OpenClaw gateway service user.
CVE-2026-30741 1 Openclaw 2 Agent Platform, Openclaw 2026-03-20 9.8 Critical
A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Side prompt injection attack.
CVE-2026-28484 1 Openclaw 1 Openclaw 2026-03-06 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.