← All credits
KeenSecurityLab
91 vulnerability records and advisories credit this contributor.
CVE-2026-43578
OpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner Downgrade
CVE-2026-43575
OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route
CVE-2026-43573
OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes
CVE-2026-43572
OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler
CVE-2026-43571
OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup
CVE-2026-43570
OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling
CVE-2026-43566
OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events
CVE-2026-43535
OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches
CVE-2026-43534
OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events
CVE-2026-43531
OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File