AI Threat Alert

OpenClaw Vulnerabilities

pipAI Agents

AI Threat Alert tracks 582 known vulnerabilities in OpenClaw, 21 rated critical — an AI/ML ai agents in the pip ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

Data sources
582
Total CVEs
21
Critical
pip
Ecosystem
Oct 14, 2026
Last CVE
32%
Patch Rate
5d
Avg Time to Patch

Known Vulnerabilities(582 total, page 10 of 24)

SeverityCVE IDSummaryCVSSPublished
HIGHCVE-2026-35625OpenClaw: privilege escalation to RCE via silent reconnect7.8Apr 9, 2026MEDIUMCVE-2026-35626OpenClaw: unauthenticated DoS via webhook body buffering5.3Apr 9, 2026MEDIUMCVE-2026-35627OpenClaw: pre-auth DoS via Nostr DM resource exhaustion6.5Apr 9, 2026MEDIUMCVE-2026-35624OpenClaw: auth bypass exposes protected Talk rooms4.2Apr 9, 2026MEDIUMCVE-2026-35623OpenClaw: Brute-force auth bypass via webhook rate limit miss4.8Apr 9, 2026MEDIUMCVE-2026-35621OpenClaw: privilege escalation via scope bypass in allowlist6.5Apr 10, 2026MEDIUMCVE-2026-35618OpenClaw: Plivo V2 replay bypass allows unauth actions6.5Apr 9, 2026MEDIUMCVE-2026-35617OpenClaw: auth bypass via group policy name collision4.2Apr 9, 2026MEDIUMCVE-2026-35619OpenClaw: auth bypass exposes AI gateway model metadata4.3Apr 10, 2026MEDIUMCVE-2026-35620OpenClaw: missing authz enables session policy hijack5.4Apr 10, 2026MEDIUMCVE-2026-34505OpenClaw: webhook rate-limit bypass enables brute-force6.5Mar 31, 2026HIGHCVE-2026-34504OpenClaw: SSRF in fal provider exposes internal services8.3Mar 31, 2026HIGHCVE-2026-34503OpenClaw: WebSocket session persists after token revocation8.1Mar 31, 2026MEDIUMCVE-2026-33581OpenClaw: sandbox bypass enables arbitrary file read6.5Mar 31, 2026HIGHCVE-2026-34512OpenClaw: improper authz allows admin session kill8.1Apr 9, 2026MEDIUMCVE-2026-34506OpenClaw: auth bypass lets any Teams user invoke AI agent4.3Mar 31, 2026HIGHCVE-2026-33577OpenClaw: scope bypass lets low-priv ops elevate node access8.1Mar 31, 2026MEDIUMCVE-2026-33574OpenClaw: TOCTOU path traversal enables arbitrary file write6.2Mar 29, 2026MEDIUMCVE-2026-33578OpenClaw: allowlist bypass exposes AI agents to all users4.3Mar 31, 2026MEDIUMCVE-2026-33580OpenClaw: webhook brute-force enables event forgery6.5Mar 31, 2026HIGHCVE-2026-33575OpenClaw: gateway credential exposed in pairing setup codes7.5Mar 29, 2026HIGHCVE-2026-33573OpenClaw: workspace boundary bypass, arbitrary exec8.8Mar 29, 2026MEDIUMCVE-2026-33576OpenClaw: pre-auth media fetch enables disk exhaustion DoS6.5Mar 31, 2026CRITICALCVE-2026-33579OpenClaw: scope bypass escalates low-priv to admin9.9Mar 31, 2026MEDIUMCVE-2026-32977OpenClaw: TOCTOU race condition enables sandbox file escape6.3Mar 31, 2026

Showing 226–250 of 582

← PreviousNext →

Frequently asked questions

What is OpenClaw?

OpenClaw is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the pip ecosystem.

How many known vulnerabilities does OpenClaw have?

OpenClaw has 582 known CVEs, 21 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is OpenClaw distributed in?

OpenClaw is distributed via the pip ecosystem and categorized as ai agents.

Where does the OpenClaw vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of OpenClaw?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor OpenClaw in your stack

Get instant alerts when new vulnerabilities affect OpenClaw. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring