SB2026052922 - Multiple vulnerabilities in OpenClaw

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026052922

SB2026052922 - Multiple vulnerabilities in OpenClaw

Published: May 29, 2026 Updated: May 29, 2026

Security Bulletin ID SB2026052922
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to load memory-core artifacts from an unintended local location.

The vulnerability exists due to improper access control in package root resolution for memory-core artifact loading when resolving a local package root influenced by workspace state. A local user can influence package root selection to load memory-core artifacts from an unintended local location.

Only instances with the affected feature enabled and reachable are vulnerable, and practical impact depends on whether lower-trust input can reach that path.


2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to retain or restore device scopes broader than intended.

The vulnerability exists due to improper access control in the device re-pairing feature when processing a re-pairing request with an empty scope set. A remote user can send a crafted device re-pairing request to retain or restore device scopes broader than intended.

Only configurations with the affected feature enabled and reachable are vulnerable.


3) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause incorrect group-policy decisions for a tool invocation.

The vulnerability exists due to improper input validation in the group policy resolver when processing a supplied group id. A remote user can supply an unvalidated group id to cause incorrect group-policy decisions for a tool invocation.

Only deployments where the affected feature is enabled and reachable are exposed.


4) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to modify focus state outside the intended authority.

The vulnerability exists due to improper access control in the focus command when the affected feature is enabled and reachable. A remote user can trigger the focus command to modify focus state outside the intended authority.

Only configurations where lower-trust input can reach the affected path are exposed.


5) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to access bundled tools outside the intended provider policy.

The vulnerability exists due to improper access control in embedded runner policy handling when processing requests that use provider aliases. A remote user can send a request using provider aliases to access bundled tools outside the intended provider policy.

Only deployments where the affected feature is enabled and reachable are exposed, and practical impact depends on whether lower-trust input can reach the affected path.


6) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute owner-style commands across channel boundaries.

The vulnerability exists due to improper access control in internal/webchat command authorization when handling sender input on an affected internal or webchat path. A remote user can send input through the affected path to execute owner-style commands across channel boundaries.

Only configurations with the affected feature enabled and reachable are vulnerable.


Remediation

Install update from vendor's website.

References