Skip to content
OOpenClaw
Products
| Product | CVEs | Exploited | Latest |
|---|
| OpenClaw | 634 | – | Sep 29, 2026 |
| OpenClaw Windows Node | 6 | – | Sep 30, 2026 |
| crabbox | 5 | – | May 14, 2026 |
| clawhub | 5 | – | Sep 26, 2026 |
| msteams | 4 | – | Sep 26, 2026 |
| feishu | 4 | – | Sep 26, 2026 |
| voice-call | 3 | – | Sep 26, 2026 |
| ClawScan | 3 | – | Oct 14, 2026 |
| clawdbot | 2 | – | Feb 19, 2026 |
| discord | 2 | – | Sep 26, 2026 |
| matrix | 2 | – | Sep 26, 2026 |
| slack | 2 | – | Sep 26, 2026 |
| line | 1 | – | Sep 26, 2026 |
| OpenClaw iOS | 1 | – | Sep 22, 2026 |
| googlechat | 1 | – | Sep 26, 2026 |
| @openclaw/bluebubbles | 1 | – | Feb 19, 2026 |
| whatsapp | 1 | – | Sep 26, 2026 |
| diagnostics-prometheus | 1 | – | Sep 26, 2026 |
| nextcloud-talk | 1 | – | Mar 5, 2026 |
Exploited and recent CVEs
-
CVE-2026-110689
Medium 5.3
OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism
0.1%
-
CVE-2026-101884
High 7.5
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override
0.5%
-
CVE-2026-101883
Medium 5.4
OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present
0.3%
-
CVE-2026-101882
High 8.8
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
0.7%
-
CVE-2026-101881
Medium 6.5
OpenClaw Windows Node before 2026.7.1 Denial of Service
0.4%
-
CVE-2026-101880
High 8.8
OpenClaw Windows Node before 2026.7.1 Authorization Bypass
0.7%
-
CVE-2026-101879
Medium 6.5
OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
0.4%
-
CVE-2026-102807
Medium 5.3
OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket
0.2%
-
CVE-2026-102806
Medium 6.3
OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines
0.3%
-
CVE-2026-100604
Medium 5.4
ClawHub Authentication Bypass via Former Publisher Skill Control
0.3%
-
CVE-2026-100603
Medium 5.4
ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports
0.3%
-
CVE-2026-100602
Medium 6.5
ClawHub Changelog Preview Information Disclosure via Authorization Bypass
0.3%
-
CVE-2026-100601
Medium 5.3
ClawHub SSRF via Unchecked DNS Resolution in Profile Image
0.3%
-
CVE-2026-100600
Medium 5.3
ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API
0.4%
-
CVE-2026-100599
High 8.8
OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome
0.3%
-
CVE-2026-100598
High 7.1
OpenClaw before 2026.7.1 Approval Binding Logic Error
0.1%
-
CVE-2026-100597
High 7.8
OpenClaw before 2026.7.1 Path Traversal via Filesystem Race
<0.1%
-
CVE-2026-100596
High 8.8
OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration
0.2%
-
CVE-2026-100595
Medium 6.5
OpenClaw before 2026.7.1 Authorization Bypass via diagnostics
0.2%
-
CVE-2026-100594
Medium 6.5
OpenClaw before 2026.7.1 Authorization Bypass via trajectory export
0.2%
-
CVE-2026-100593
Medium 5.4
OpenClaw before 2026.7.1 Authentication Bypass via activation
0.1%
-
CVE-2026-100592
Medium 6.3
OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming
0.2%
-
CVE-2026-100591
Medium 6.3
OpenClaw before 2026.7.1 Authentication Bypass via Active Memory
0.2%
-
CVE-2026-100590
Medium 4.3
OpenClaw before 2026.7.1 Authorization Bypass via voice set
0.2%
-
CVE-2026-100589
High 8.3
OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node
0.3%
-
CVE-2026-100588
High 8.3
OpenClaw before 2026.7.1 Authentication Bypass via node.invoke
0.3%
-
CVE-2026-100587
High 8.8
OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
0.2%
-
CVE-2026-100586
High 8.8
OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind
0.2%
-
CVE-2026-100585
High 8.0
OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel
0.2%
-
CVE-2026-100584
Medium 6.7
OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
<0.1%