SB2026052906 - Multiple vulnerabilities in OpenClaw

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026052906

SB2026052906 - Multiple vulnerabilities in OpenClaw

Published: May 29, 2026

Security Bulletin ID SB2026052906
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Incomplete List of Disallowed Inputs (CVE-ID: N/A)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to influence a Node.js child process or coverage output path.

The vulnerability exists due to incomplete list of disallowed inputs in the host environment sanitizer when processing lower-trust environment sources. A remote user can supply crafted environment variables through a workspace .env, tool environment override, or skill environment block to influence a Node.js child process or coverage output path.

Only instances where the affected feature is enabled and reachable are vulnerable, and practical impact depends on whether lower-trust input can reach the accepted environment path.


2) Incomplete List of Disallowed Inputs (CVE-ID: N/A)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to trigger unintended wrapper-level side effects.

The vulnerability exists due to incomplete neutralization of special elements in the exec allowlist path when processing command requests through transparent command wrappers. A remote user can submit a crafted command request to trigger unintended wrapper-level side effects.

Exploitation requires the affected feature to be enabled and reachable, and practical impact depends on whether lower-trust input can reach that path.


3) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to perform server-side request forgery.

The vulnerability exists due to improper input validation in hostname policy checks for model- or workspace-derived URLs when handling a hostname presented with a trailing dot. A remote user can supply a URL using a trailing-dot hostname to perform server-side request forgery.

Exploitation requires the affected feature to be enabled and reachable, and practical impact depends on whether lower-trust input can reach the affected request path.


4) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to regain revoked node token authority.

The vulnerability exists due to improper access control in the device session handling logic when processing a surviving pairing-scoped session after node token revocation. A remote user can maintain a same-device pairing-scoped session to regain revoked node token authority.

The issue affects deployments where an already paired device retains a same-device session with pairing-related scope after its node token is revoked.


Remediation

Install update from vendor's website.

References