OpenClaw — Vulnerabilities & Security Advisories 339

All 339 CVE vulnerabilities found in OpenClaw, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-26320	OpenClaw macOS deep link confirmation truncation can conceal executed agent message CWE-451	4.3	-	2026-02-19
CVE-2026-26319	OpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated Requests CWE-306	7.5	High	2026-02-19
CVE-2026-26317	OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints CWE-352	7.1	High	2026-02-19
CVE-2026-26316	OpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust CWE-863	7.5	High	2026-02-19
CVE-2026-25474	OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass CWE-345	7.5	High	2026-02-19
CVE-2026-25593	OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply CWE-78	8.4	High	2026-02-06
CVE-2026-25157	OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand CWE-78	7.8	High	2026-02-04
CVE-2026-25475	OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction CWE-200	6.5	Medium	2026-02-04
CVE-2026-25253	OpenClaw 安全漏洞 CWE-669	8.8	High	2026-02-01

All 339 known CVE vulnerabilities affecting OpenClaw with full Chinese analysis, references, and POCs where available.