How many CVEs does openclaw have?

openclaw has 588 published CVE records since 2026, including 588 in the last two years.

How many openclaw CVEs are in CISA KEV?

None of openclaw's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which openclaw products have the most CVEs?

The openclaw products with the most published CVEs are openclaw, crabbox, msteams, github.com/openclaw/crabbox, clawdbot.

What are the most common weakness types in openclaw CVEs?

openclaw's CVEs most often map to these CWE weakness types: CWE-863 (Incorrect Authorization), CWE-862 (Missing Authorization), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-918 (Server-Side Request Forgery (SSRF)).

Are there public exploits for openclaw vulnerabilities?

Yes — 17 of openclaw's CVEs have a known public exploit.

How many critical openclaw vulnerabilities are there?

openclaw has 28 critical and 243 high-severity CVEs.

What is the average severity of openclaw CVEs?

The average CVSS base score across openclaw's scored CVEs is 6.6.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

588 CVEs

openclaw Vulnerabilities

Name: openclaw vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for openclaw.

588

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

17

Public exploits

PoC or exploit code

6.6

Avg CVSS

2026–2026

Overview

openclaw has 588 published CVE records since 2026, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 17 have a known public exploit. The average CVSS base score across scored CVEs is 6.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting openclaw products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on openclaw's vulnerability posture, as a share of its 588 published CVEs.

Average CVSS: 6.6
Critical / high: 46%
Actively exploited (KEV): 0%
Public exploit available: 3%
Patch available: 100%

Severity and exploitation

How the CVSS severity of openclaw's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical28

High243

Medium259

Low58

In CISA’s Known Exploited Vulnerabilities catalog

0

None of openclaw's CVEs are currently listed in CISA's KEV catalog.

Public exploits

17

17 of openclaw's CVEs have a known public exploit available.

Most affected products

The openclaw products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in openclaw CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish openclaw CVE records.

Latest openclaw CVEs

The most recently disclosed vulnerabilities affecting openclaw.

OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching
CWE-22
High · CVSS 7.7
EPSS 0.5%2026-07-17
OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals
CWE-863
High · CVSS 7.7
EPSS 0.3%2026-07-17
OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot
CWE-918
Medium · CVSS 4.9
EPSS 0.2%2026-07-17
OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route
CWE-918
Medium · CVSS 5.1
EPSS 0.3%2026-07-17
OpenClaw < 2026.5.18 Authorization Bypass via Skill Command Dispatch
CWE-863
Low · CVSS 2.3
EPSS 0.2%2026-07-17
OpenClaw MS Teams < 2026.5.12 Authorization Bypass
CWE-290
Low · CVSS 2.3
EPSS 0.2%2026-07-17
OpenClaw < 2026.5.18 Authorization Bypass via Device-pair
CWE-863
High · CVSS 7.7
EPSS 0.3%2026-07-17
OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode
CWE-829
High · CVSS 7.1
EPSS 0.1%2026-07-17
OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom
CWE-863
Low · CVSS 2.3
EPSS 0.1%2026-07-17
OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass
CWE-307
Medium · CVSS 6.3
EPSS 0.3%2026-07-17
OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs
CWE-863
Medium · CVSS 6.0
EPSS 0.2%2026-07-17
OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve
CWE-862
High · CVSS 8.7
EPSS 0.3%2026-07-17

Track new openclaw CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor openclaw CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

McAfee607 CVEs arubanetworks607 CVEs FreeBSD603 CVEs Symantec598 CVEs itsourcecode589 CVEs JetBrains580 CVEs Linux Foundation579 CVEs TP-Link570 CVEs

Browse all vendors

Frequently asked questions

Common questions about openclaw vulnerabilities.

How many CVEs does openclaw have?: openclaw has 588 published CVE records since 2026, including 588 in the last two years.
How many openclaw CVEs are in CISA KEV?: None of openclaw's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which openclaw products have the most CVEs?: The openclaw products with the most published CVEs are openclaw, crabbox, msteams, github.com/openclaw/crabbox, clawdbot.
What are the most common weakness types in openclaw CVEs?: openclaw's CVEs most often map to these CWE weakness types: CWE-863 (Incorrect Authorization), CWE-862 (Missing Authorization), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-918 (Server-Side Request Forgery (SSRF)).
Are there public exploits for openclaw vulnerabilities?: Yes — 17 of openclaw's CVEs have a known public exploit.
How many critical openclaw vulnerabilities are there?: openclaw has 28 critical and 243 high-severity CVEs.
What is the average severity of openclaw CVEs?: The average CVSS base score across openclaw's scored CVEs is 6.6.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track openclaw vulnerabilities

Monitor new openclaw vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing