AI Threat Alert

OpenClaw Vulnerabilities

pipAI Agents

AI Threat Alert tracks 582 known vulnerabilities in OpenClaw, 21 rated critical — an AI/ML ai agents in the pip ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

Data sources
582
Total CVEs
21
Critical
pip
Ecosystem
Oct 14, 2026
Last CVE
32%
Patch Rate
5d
Avg Time to Patch

Known Vulnerabilities(582 total, page 5 of 24)

SeverityCVE IDSummaryCVSSPublished
LOWCVE-2026-91835OpenClaw ClawScan: file classifier conflict hides content2.8Sep 15, 2026HIGHGHSA-2q7j-2vhx-56g8OpenClaw Feishu: broken authz bypasses tool disable8.1Sep 3, 2026HIGHGHSA-w8wf-3qvj-6xqfOpenClaw Feishu: authz bypass skips account disablement8.1Sep 3, 2026CRITICALCVE-2026-66421OpenClaw Dashboard: stored XSS enables admin takeover9.3Jul 30, 2026HIGHCVE-2026-66420MeshCentral: origin-check bypass lets attackers hijack admin sessions8.8Jul 30, 2026CRITICALCVE-2026-66418OpenClaw: stored XSS via login field hijacks admin9.3Jul 30, 2026HIGHCVE-2026-62229OpenClaw: glob bypass in exec allowlist enables auth bypass8.8Jul 17, 2026HIGHCVE-2026-62228OpenClaw: authz bypass in node exec approvals8.8Jul 17, 2026HIGHCVE-2026-62227OpenClaw: SSRF bypass in browser snapshot navigation7.7Jul 17, 2026HIGHCVE-2026-62226OpenClaw: auth bypass in browser act route8.5Jul 17, 2026MEDIUMCVE-2026-62225OpenClaw: authz bypass in skill dispatch5.4Jul 17, 2026MEDIUMCVE-2026-62224OpenClaw: MS Teams auth bypass via display name spoof5.4Jul 17, 2026HIGHCVE-2026-62223OpenClaw: authorization bypass in device pairing8.8Jul 17, 2026HIGHCVE-2026-62222OpenClaw: untrusted plugin loading in setup-mode7.8Jul 17, 2026MEDIUMCVE-2026-62221OpenClaw: allowFrom auth bypass runs blocked commands5.4Jul 17, 2026MEDIUMCVE-2026-62220OpenClaw: WS auth rate-limit bypass enables DoS5.3Jul 17, 2026HIGHCVE-2026-62219OpenClaw: agent hook auth bypass via blank IDs7.1Jul 17, 2026HIGHCVE-2026-62218OpenClaw: authorization bypass in device pairing8.8Jul 17, 2026HIGHCVE-2026-62217OpenClaw: QQBot exec approval bypass enables RCE8.8Jul 17, 2026MEDIUMCVE-2026-62216OpenClaw: policy bypass enables SSRF via media upload5.0Jul 17, 2026HIGHCVE-2026-62215OpenClaw: auth bypass forges trusted A2UI actions8.0Jul 17, 2026MEDIUMCVE-2026-62214OpenClaw: serviceUrl validation flaw leaks bot tokens6.5Jul 17, 2026MEDIUMCVE-2026-62213OpenClaw: Teams outbound leaks Bot Framework tokens6.5Jul 17, 2026HIGHCVE-2026-62212OpenClaw: TOCTOU race bypasses Teams SSRF guard7.1Jul 17, 2026MEDIUMCVE-2026-62211OpenClaw: credential redaction bypass via export5.0Jul 17, 2026

Showing 101–125 of 582

← PreviousNext →

Frequently asked questions

What is OpenClaw?

OpenClaw is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the pip ecosystem.

How many known vulnerabilities does OpenClaw have?

OpenClaw has 582 known CVEs, 21 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is OpenClaw distributed in?

OpenClaw is distributed via the pip ecosystem and categorized as ai agents.

Where does the OpenClaw vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of OpenClaw?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor OpenClaw in your stack

Get instant alerts when new vulnerabilities affect OpenClaw. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring