AI Threat AlertOpenclaw
AI Threat Alert tracks 267 known AI/ML vulnerabilities affecting Openclaw products — each enriched with CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis. Browse every Openclaw CVE below, sorted by severity and recency.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-62193 | OpenClaw: auth bypass in plugin install wrapper | openclaw | 6.5 |
| HIGH | CVE-2026-62194 | OpenClaw: privilege escalation in plugin install | openclaw | 8.8 |
| HIGH | CVE-2026-62195 | OpenClaw: MCP loopback auth bypass on owner tools | openclaw | 8.3 |
| HIGH | CVE-2026-62196 | OpenClaw: WhatsApp group ID spoof enables auth bypass | openclaw | 8.3 |
| HIGH | CVE-2026-62197 | OpenClaw: CDP policy bypass reaches blocked network | openclaw | 8.5 |
| MEDIUM | CVE-2026-62198 | OpenClaw: web search auth bypass enables restricted ops | openclaw | 5.4 |
| HIGH | CVE-2026-32846 | OpenClaw: path traversal in media parsing leaks secrets | OpenClaw | - |
| HIGH | CVE-2026-45224 | Crabbox: path traversal enables arbitrary file wipe | crabbox | 7.1 |
| HIGH | CVE-2026-45223 | Crabbox: coordinator auth bypass via forged admin claim | crabbox | 8.8 |
| CRITICAL | CVE-2026-8634 | Crabbox: env-var allowlist leaks secrets to remote exec | crabbox | 9.1 |
| HIGH | CVE-2026-8621 | Crabbox: header spoofing bypasses lease auth | crabbox | 8.8 |
| HIGH | CVE-2026-8629 | Crabbox: IDOR lets viewers hijack Code/VNC/Egress | crabbox | 8.1 |
| CRITICAL | CVE-2026-28474 | OpenClaw Nextcloud Talk: allowlist bypass via display name | nextcloud-talk | 9.8 |
| MEDIUM | CVE-2026-28465 | OpenClaw voice-call: webhook auth bypass via headers | voice-call | 5.9 |
| CRITICAL | CVE-2026-22172 | OpenClaw: WebSocket scope self-elevation grants admin | OpenClaw | 9.9 |
| MEDIUM | CVE-2026-34510 | OpenClaw: UNC/file URL bypass in Windows media loaders | OpenClaw | 5.3 |
| HIGH | CVE-2026-44113 | OpenClaw: TOCTOU symlink race escapes sandbox mount | OpenClaw | 7.7 |
| CRITICAL | CVE-2026-44112 | OpenClaw: TOCTOU symlink race escapes OpenShell sandbox | OpenClaw | 9.6 |
| HIGH | CVE-2026-44114 | OpenClaw: dotenv namespace override enables runtime hijack | OpenClaw | 7.8 |
| MEDIUM | CVE-2026-44117 | OpenClaw: SSRF in QQBot media upload bypasses URL checks | OpenClaw | 5.8 |
Frequently asked questions
How many known vulnerabilities affect Openclaw?
267 AI/ML CVEs affecting Openclaw products are tracked, sourced from NVD and GitHub Advisory.
What Openclaw products are affected?
The CVEs below map to the Openclaw AI/ML packages and tools tracked by AI Threat Alert; open any CVE to see the affected components and versions.
Where does the Openclaw vulnerability data come from?
Data is sourced from NVD and GitHub Advisory, then enriched with CVSS severity, EPSS exploit probability, and patch status for each CVE.
How can I monitor Openclaw for new vulnerabilities?
AI Threat Alert tracks Openclaw continuously; a Pro subscription adds breaking alerts when new CVEs affecting Openclaw are published.
How do I assess Openclaw's security exposure?
Each CVE below carries CVSS severity and exploitation signals, so you can review the highest-severity Openclaw issues first and judge the exposure for your stack.