Technology · npm
openclaw (npm) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 214 vulnerabilities in openclaw (npm): 0 in the last 7 days and 0 in the last 90 days, 8 of them critical and 0 exploited in the wild. The most recent, CVE-2026-62208, was published on 17 July 2026.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 8
- Exploited in the wild
- 0
Latest openclaw (npm) vulnerabilities
- CVE-2026-62208: OpenClaw credential leakage via Authorization header forwarding in MCP SSEmediumCVSS 6.5EPSS 0.4%
- Duplicate Advisory: Browser CDP discovery could accept blocked WebSocket URLshighCVSS 8.5
- CVE-2026-62197: OpenClaw policy bypass in browser CDP discoveryhighCVSS 8.5EPSS 0.3%
- CVE-2026-53866: OpenClaw allowlist bypass in shell inline-command parsinghighCVSS 8.1EPSS 0.4%
- CVE-2026-53865: OpenClaw path traversal in maintenance task executionhighCVSS 7.1EPSS 0.2%
- CVE-2026-53864: OpenClaw insufficient sanitization in host environment sanitizerhighCVSS 8.1EPSS 0.4%
- CVE-2026-53863: OpenClaw authorization bypass via unvalidated group IDshighCVSS 7.1EPSS 0.3%
- CVE-2026-53862: OpenClaw bootstrap token replay in pending pairing scopesmediumCVSS 4.2EPSS 0.1%
- CVE-2026-53861: OpenClaw allowlist bypass in macOS Swift exec featuremediumCVSS 6.6EPSS 0.4%
- CVE-2026-53860: OpenClaw sender policy bypass in BlueBubbles integrationmediumCVSS 4.2EPSS 0.2%
- CVE-2026-53859: OpenClaw hostname validation bypass in model and workspace URLsmediumCVSS 6.5EPSS 0.4%
- CVE-2026-53858: OpenClaw environment variable injection in STATE_DIRECTORYhighCVSS 7.1EPSS 0.2%
- CVE-2026-53857: OpenClaw policy enforcement bypass in Zalo allowFrom policyhighCVSS 8.1EPSS 0.4%
- CVE-2026-53856: OpenClaw insecure file permissions in config recoverymediumCVSS 5.5EPSS 0.1%
- CVE-2026-53855: OpenClaw inline-eval bypass via shell positional parametershighCVSS 8.1EPSS 0.4%
- CVE-2026-53854: OpenClaw privilege escalation in internal and webchat command authenticationmediumCVSS 6.5EPSS 0.4%
- CVE-2026-53853: OpenClaw argument pattern validation bypass in exec allowlisthighCVSS 8.3EPSS 0.6%
- CVE-2026-53852: OpenClaw scope containment bypass in device re-pairingmediumCVSS 5.4EPSS 0.3%
- CVE-2026-53851: OpenClaw Slack reaction event notification bypassmediumCVSS 5.3EPSS 0.3%
- CVE-2026-53850: OpenClaw authorization bypass in focus commandmediumCVSS 5.5EPSS 0.1%
- CVE-2026-53849: OpenClaw privilege escalation in allowFrom featurehighCVSS 8.1EPSS 0.4%
- CVE-2026-53848: OpenClaw exec allowlist bypass via transparent command wrappersmediumCVSS 4.3EPSS 0.3%
- CVE-2026-53847: OpenClaw privilege escalation in Active Memory write scopemediumCVSS 5.4EPSS 0.3%
- CVE-2026-53845: OpenClaw hook bypass in skill-command dispatchmediumCVSS 4.3EPSS 0.3%
- CVE-2026-53844: OpenClaw session visibility check bypass in shared memory searchmediumCVSS 6.5EPSS 0.4%
Most severe openclaw (npm) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-33579: OpenClaw privilege escalation in device pairing approvalcriticalCVSS 9.9EPSS 0.5%
- CVE-2026-32917: OpenClaw remote command injection in iMessage attachment stagingcriticalCVSS 9.8EPSS 3.2%
- CVE-2026-53838: OpenClaw state mutation in node pairing reconnectioncriticalCVSS 9.8EPSS 0.4%
- CVE-2026-44112: OpenClaw TOCTOU race condition in OpenShell sandbox filesystem writescriticalCVSS 9.6EPSS 0.4%
- CVE-2026-43581: OpenClaw sandbox browser CDP relay network exposurecriticalCVSS 9.6EPSS 0.2%
- CVE-2026-32916: OpenClaw authorization bypass in plugin subagent routescriticalCVSS 9.4EPSS 0.6%
- CVE-2026-35663: OpenClaw privilege escalation in gateway backend reconnectcriticalCVSS 8.8EPSS 0.5%
- CVE-2026-35639: OpenClaw Gateway privilege escalation in device.pair.approvecriticalCVSS 4EPSS 0.8%
- CVE-2026-45006: OpenClaw improper access control in gateway tool config operationshighCVSS 8.8EPSS 0.9%
- CVE-2026-53836: OpenClaw allowlist bypass in PowerShell encoded-command handlinghighCVSS 8.8EPSS 0.8%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many openclaw (npm) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/npm-openclaw)<a href="https://junglewise.ai/threats/technologies/npm-openclaw"><img src="https://junglewise.ai/threats/technologies/npm-openclaw/badge.svg" alt="openclaw (npm) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/npm-openclaw.json, and this page as text at https://junglewise.ai/threats/technologies/npm-openclaw.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "openclaw (npm) vulnerabilities", https://junglewise.ai/threats/technologies/npm-openclaw, 13 November 2026.