openclaw

CVE-2026-26319 HIGH

OpenClaw < 2026.2.14 - Unauthenticated Webhook Spoofing via Missing Telnyx Signature Verification

CVSS 7.5

EPSS 0.00

CVE-2026-26317 HIGH

OpenClaw < 2026.2.14 - Cross-Site Request Forgery via Unvalidated Origin/Referer

CVSS 7.1

EPSS 0.00

CVE-2026-26316 HIGH

OpenClaw < 2026.2.13 - Incorrect Authorization via BlueBubbles Webhook Loopback Bypass

CVSS 7.5

EPSS 0.00

CVE-2026-25474 HIGH

OpenClaw < 2026.2.1 - Insufficient Verification of Telegram Webhook Secret Token

CVSS 7.5

EPSS 0.00

CVE-2026-24764 LOW

OpenClaw <=2026.2.2 - Command Injection

CVSS 3.7

EPSS 0.00

CVE-2026-25593 HIGH

OpenClaw < 2026.1.20 - Unauthenticated OS Command Injection via Gateway WebSocket API

CVSS 8.4

EPSS 0.01

CVE-2026-25475 MEDIUM

OpenClaw < 2026.1.30 - Unauthenticated Arbitrary File Read via MEDIA Path Traversal

CVSS 6.5

EPSS 0.01

CVE-2026-25157 HIGH

OpenClaw < 2026.1.29 - OS Command Injection via Project Root Path in sshNodeCommand

CVSS 7.7

EPSS 0.01

CVE-2026-24763 HIGH

OpenClaw < 2026.1.29 - Authenticated OS Command Injection via PATH Environment Variable

CVSS 8.8

EPSS 0.05

CVE-2026-25253 HIGH

OpenClaw <2026.1.29 - Info Disclosure

CVSS 8.8

EPSS 0.08