AI Threat Alert
Openclaw
AI Threat Alert tracks 233 known AI/ML vulnerabilities affecting Openclaw products — each enriched with CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis. Browse every Openclaw CVE below, sorted by severity and recency.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| CRITICAL | CVE-2026-28451 | OpenClaw: SSRF via Feishu extension exposes internal services | openclaw | 9.3 |
| CRITICAL | CVE-2026-30741 | OpenClaw: RCE via request-side prompt injection | openclaw | 9.8 |
| LOW | CVE-2026-24764 | OpenClaw: indirect prompt injection via Slack metadata | openclaw | 3.7 |
| HIGH | CVE-2026-26321 | OpenClaw: path traversal enables local file exfiltration | openclaw | 7.5 |
| MEDIUM | CVE-2026-25475 | OpenClaw: path traversal enables arbitrary file read | openclaw | 6.5 |
| MEDIUM | CVE-2026-26320 | OpenClaw: UI deception enables arbitrary command execution | openclaw | 6.5 |
| MEDIUM | CVE-2026-26972 | OpenClaw: path traversal allows arbitrary file write | openclaw | 6.7 |
| HIGH | CVE-2026-27001 | OpenClaw: prompt injection via unsanitized workspace path | openclaw | 7.8 |
| HIGH | CVE-2026-53811 | OpenClaw: privilege escalation via identity spoofing | openclaw | 8.8 |
| LOW | CVE-2026-53809 | OpenClaw: policy bypass exposes restricted tool access | openclaw | 3.8 |
| HIGH | CVE-2026-53812 | OpenClaw: SSRF bypasses private-network access controls | openclaw | 7.7 |
| HIGH | CVE-2026-53807 | OpenClaw: auth bypass allows unauthorized command execution | OpenClaw | 8.8 |
| HIGH | CVE-2026-53806 | OpenClaw: shell flag bypass enables RCE in agent exec | openclaw | 8.8 |
| HIGH | CVE-2026-53813 | OpenClaw: path traversal enables RCE via memory-core artifacts | openclaw | 7.8 |
| HIGH | CVE-2026-53810 | OpenClaw: extension metadata bypass enables agent RCE | openclaw | 8.8 |
| MEDIUM | CVE-2026-53808 | OpenClaw: approval bypass enables unauthorized skill changes | OpenClaw | 6.5 |
| HIGH | CVE-2026-53819 | OpenClaw: RCE via workspace .env executable override | openclaw | 8.8 |
| HIGH | CVE-2026-53816 | OpenClaw: node event forgery bypasses exec authorization | openclaw | 7.2 |
| MEDIUM | CVE-2026-53815 | OpenClaw: auth bypass exposes restricted channel messages | openclaw | 6.5 |
| HIGH | CVE-2026-53814 | OpenClaw: privilege escalation via hook-triggered MCP scope | openclaw | 8.3 |
Page 1 of 12
Frequently asked questions
How many known vulnerabilities affect Openclaw?
233 AI/ML CVEs affecting Openclaw products are tracked, sourced from NVD and GitHub Advisory.
What Openclaw products are affected?
The CVEs below map to the Openclaw AI/ML packages and tools tracked by AI Threat Alert; open any CVE to see the affected components and versions.
Where does the Openclaw vulnerability data come from?
Data is sourced from NVD and GitHub Advisory, then enriched with CVSS severity, EPSS exploit probability, and patch status for each CVE.
How can I monitor Openclaw for new vulnerabilities?
AI Threat Alert tracks Openclaw continuously; a Pro subscription adds breaking alerts when new CVEs affecting Openclaw are published.
How do I assess Openclaw's security exposure?
Each CVE below carries CVSS severity and exploitation signals, so you can review the highest-severity Openclaw issues first and judge the exposure for your stack.