SB2026041787 - Multiple vulnerabilities in OpenClaw

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026041787

SB2026041787 - Multiple vulnerabilities in OpenClaw

Published: April 17, 2026

Security Bulletin ID SB2026041787
Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 29% Low 71%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 secuirty vulnerabilities.


1) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in browser snapshot, screenshot, and tab routes when handling route-driven navigation. A remote user can use crafted snapshot, screenshot, or tab requests to disclose sensitive information.

This issue affects restrictive browser SSRF configurations and can expose content from internal or otherwise disallowed pages.


2) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in config.get redaction handling when returning configuration data through sourceConfig and runtimeConfig aliases. A remote user can read configuration data through alias fields that survive redaction to disclose sensitive information.

The issue affects authenticated gateway clients with config read access.


3) Missing Authorization (CVE-ID: N/A)

The vulnerability allows a remote user to bypass sender authorization checks.

The vulnerability exists due to improper access control in the Microsoft Teams SSO invoke handler when processing signin invoke requests. A remote user can send a crafted invoke from a disallowed sender to bypass sender authorization checks.

The issue affects SSO signin invoke handling, while normal message handling applies sender allowlist checks.


4) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote user to gain unauthorized access to more privileged authorization context.

The vulnerability exists due to improper access control in collect-mode queue batch dispatch when draining queued messages from different senders as one batch. A remote user can enqueue messages that are processed under the final sender's authorization context to gain unauthorized access to more privileged authorization context.

Earlier messages in a batch may inherit the trust state of the final sender.


5) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote user to retain owner-like execution context.

The vulnerability exists due to improper access control in heartbeat owner downgrade logic when processing webhook wake events carrying untrusted content. A remote user can trigger an untrusted webhook wake event to retain owner-like execution context.


6) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote attacker to bypass group media restrictions.

The vulnerability exists due to improper access control in delivery queue recovery for outbound media replay when replaying recovered queued outbound media after restart or recovery. A remote attacker can trigger media replay from recovered queue entries to bypass group media restrictions.

The issue occurs because the original session context needed to enforce group tool policy may be lost during recovery.


7) Insecure Default Initialization of Resource (CVE-ID: N/A)

The vulnerability allows a remote attacker to access internal services or metadata endpoints.

The vulnerability exists due to initialization of a resource with an insecure default in the browser SSRF policy when handling browser-driven requests to private-network destinations. A remote attacker can trigger browser-driven requests to private-network destinations to access internal services or metadata endpoints.

Private-network access was allowed by default in paths where restrictive behavior was expected.


Remediation

Install update from vendor's website.

References