AI Threat Alert
Openclaw
AI Threat Alert tracks 233 known AI/ML vulnerabilities affecting Openclaw products — each enriched with CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis. Browse every Openclaw CVE below, sorted by severity and recency.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-32002 | OpenClaw: sandbox bypass exfiltrates files via vision API | OpenClaw | 5.3 |
| MEDIUM | CVE-2026-32003 | OpenClaw: env var injection enables RCE via allowlist bypass | OpenClaw | 6.6 |
| MEDIUM | CVE-2026-32001 | OpenClaw: auth bypass enables unauthorized node role injection | OpenClaw | 5.4 |
| LOW | CVE-2026-32006 | OpenClaw: auth bypass via DM identity confusion in groups | OpenClaw | 3.1 |
| MEDIUM | CVE-2026-32007 | OpenClaw: path traversal enables sandbox file escape | OpenClaw | 6.8 |
| MEDIUM | CVE-2026-32005 | OpenClaw: auth bypass enables AI agent session poisoning | OpenClaw | 6.8 |
| HIGH | CVE-2026-32015 | OpenClaw: PATH hijack bypasses exec allowlist controls | OpenClaw | 7.8 |
| HIGH | CVE-2026-32013 | OpenClaw: symlink traversal enables host file read/write | OpenClaw | 8.8 |
| MEDIUM | CVE-2026-32010 | OpenClaw: safeBins bypass enables arbitrary code execution | OpenClaw | 6.3 |
| MEDIUM | CVE-2026-32009 | OpenClaw: binary hijacking via safeBins path bypass | OpenClaw | 5.7 |
| HIGH | CVE-2026-32011 | OpenClaw: pre-auth webhook DoS exhausts parser resources | OpenClaw | 7.5 |
| HIGH | CVE-2026-32016 | OpenClaw: path bypass allows unauthorized binary execution | OpenClaw | 7.8 |
| HIGH | CVE-2026-32017 | OpenClaw: allowlist bypass enables arbitrary file write | OpenClaw | 7.1 |
| HIGH | CVE-2026-32014 | OpenClaw: metadata spoofing bypasses agent command policies | OpenClaw | 8.0 |
| HIGH | CVE-2026-32019 | OpenClaw: SSRF bypass via incomplete IPv4 range validation | OpenClaw | 7.4 |
| MEDIUM | CVE-2026-32024 | OpenClaw: symlink traversal leaks arbitrary local files | OpenClaw | 5.5 |
| LOW | CVE-2026-32018 | OpenClaw: race condition corrupts sandbox registry state | OpenClaw | 3.6 |
| LOW | CVE-2026-32020 | OpenClaw: symlink traversal enables arbitrary file read | OpenClaw | 3.3 |
| HIGH | CVE-2026-32025 | OpenClaw: WebSocket auth bypass enables agent hijack | OpenClaw | 7.5 |
| MEDIUM | CVE-2026-32022 | OpenClaw: grep safeBins bypass enables arbitrary file read | OpenClaw | 6.5 |
Frequently asked questions
How many known vulnerabilities affect Openclaw?
233 AI/ML CVEs affecting Openclaw products are tracked, sourced from NVD and GitHub Advisory.
What Openclaw products are affected?
The CVEs below map to the Openclaw AI/ML packages and tools tracked by AI Threat Alert; open any CVE to see the affected components and versions.
Where does the Openclaw vulnerability data come from?
Data is sourced from NVD and GitHub Advisory, then enriched with CVSS severity, EPSS exploit probability, and patch status for each CVE.
How can I monitor Openclaw for new vulnerabilities?
AI Threat Alert tracks Openclaw continuously; a Pro subscription adds breaking alerts when new CVEs affecting Openclaw are published.
How do I assess Openclaw's security exposure?
Each CVE below carries CVSS severity and exploitation signals, so you can review the highest-severity Openclaw issues first and judge the exposure for your stack.