AI Threat Alert

OpenClaw Vulnerabilities

pip AI Agents

AI Threat Alert tracks 427 known vulnerabilities in OpenClaw, 15 rated critical — an AI/ML ai agents in the pip ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

Data sources
427
Total CVEs
15
Critical
pip
Ecosystem
Jul 8, 2026
Last CVE
41%
Patch Rate
3d
Avg Time to Patch

Known Vulnerabilities (427 total, page 5 of 18)

Severity CVE ID Summary CVSS Published
HIGH CVE-2026-32979 OpenClaw: TOCTOU race enables local code execution 7.3 Mar 29, 2026 HIGH CVE-2026-33572 OpenClaw: insecure transcript files expose agent secrets 8.4 Mar 29, 2026 CRITICAL CVE-2026-32973 OpenClaw: exec allowlist bypass enables RCE 9.8 Mar 29, 2026 CRITICAL CVE-2026-32975 OpenClaw: auth bypass via group name spoofing in agent 9.8 Mar 29, 2026 MEDIUM CVE-2026-32976 OpenClaw: auth bypass mutates protected agent config 6.5 Mar 31, 2026 LOW CVE-2026-32970 OpenClaw: credential fallback bypasses local auth boundary 2.5 Mar 31, 2026 HIGH CVE-2026-32974 OpenClaw: auth bypass triggers forged webhook tool execution 8.6 Mar 29, 2026 HIGH CVE-2026-32972 OpenClaw: auth bypass enables persistent CDP backdoor 7.1 Mar 29, 2026 CRITICAL CVE-2026-32924 OpenClaw: auth bypass via Feishu reaction misclassification 9.8 Mar 29, 2026 HIGH CVE-2026-32971 OpenClaw: approval UI spoofing enables local RCE 7.1 Mar 31, 2026 CRITICAL CVE-2026-32917 OpenClaw: RCE via unsanitized iMessage SCP paths 9.8 Mar 31, 2026 MEDIUM CVE-2026-32921 OpenClaw: script approval bypass allows code execution 6.3 Mar 31, 2026 MEDIUM CVE-2026-32923 OpenClaw: auth bypass enables Discord reaction context injection 5.4 Mar 29, 2026 HIGH CVE-2026-32918 OpenClaw: session sandbox escape exposes cross-agent state 8.4 Mar 29, 2026 MEDIUM CVE-2026-32919 OpenClaw: auth bypass enables unauthorized session reset 6.1 Mar 29, 2026 HIGH CVE-2026-32920 OpenClaw: workspace plugin auto-load enables RCE 8.4 Mar 31, 2026 CRITICAL CVE-2026-32922 OpenClaw: privilege escalation to RCE via token scope bypass 9.9 Mar 29, 2026 CRITICAL CVE-2026-32916 OpenClaw: auth bypass enables unauth agent execution 9.4 Mar 31, 2026 MEDIUM CVE-2026-32895 OpenClaw: auth bypass circumvents Slack event allowlists 5.4 Mar 21, 2026 HIGH CVE-2026-32915 OpenClaw: sandbox bypass enables sibling agent hijack 8.8 Mar 29, 2026 MEDIUM CVE-2026-32898 OpenClaw: ACP bypass enables silent tool execution 5.4 Mar 21, 2026 MEDIUM CVE-2026-32899 OpenClaw: sender-policy bypass injects unauthorized agent events 4.3 Mar 21, 2026 MEDIUM CVE-2026-32896 OpenClaw: auth bypass via webhook passwordless fallback 4.8 Mar 21, 2026 CRITICAL CVE-2026-32913 OpenClaw: auth header leak via cross-origin redirect 9.3 Mar 23, 2026 HIGH CVE-2026-32914 OpenClaw: access control bypass in config/debug handlers 8.8 Mar 29, 2026

Showing 101–125 of 427

← Previous Next →

Frequently asked questions

What is OpenClaw?

OpenClaw is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the pip ecosystem.

How many known vulnerabilities does OpenClaw have?

OpenClaw has 427 known CVEs, 15 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is OpenClaw distributed in?

OpenClaw is distributed via the pip ecosystem and categorized as ai agents.

Where does the OpenClaw vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of OpenClaw?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor OpenClaw in your stack

Get instant alerts when new vulnerabilities affect OpenClaw. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring