VulertSecurity VulertSecurity

Vulnerability Database · npm · openclaw · Version

openclaw 2026.5.19

2026.5.19 is affected by 91 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 3 High 30 Medium 46 Low 12 Unrated 0

All openclaw versions & vulnerabilities → Search the database for this package →
Released 20 May 2026 Licence MIT Also known from other sources 0 Newer releases 282 Database updated 22/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

openclaw 2026.5.19 vulnerabilities

91 vulnerabilities cover openclaw 2026.5.19. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Node Pairing Reconnection Vulnerability in OpenClaw: Potential Approval Scope Confusion 9.8 medium 2026.5.27 13 Jun 2026
Critical Privilege Escalation Vulnerability in OpenClaw: Gateway Shared-Auth Reconnect Issue 9.4 critical No fix published 27 Mar 2026
Critical Vulnerability in OpenClaw: Gateway Backend Reconnect Allows Non-Admin Operators to Self-Claim Admin Privileges 9.3 critical No fix published 27 Mar 2026
CVE-2026-53819: OpenClaw Package Vulnerability Allows .env Override of Homebrew Executable 8.8 high 2026.5.27 02 Jul 2026
CVE-2026-53843: OpenClaw Node Token Authority Revocation Bypass Vulnerability 8.8 high 2026.5.26 18 Jun 2026
Authorization Bypass Vulnerability in OpenClaw: Revoked Node Token Authority Restoration 8.8 high No fix published 16 Jun 2026
Unrestricted Admin Access in OpenClaw Gateway Plugin HTTP Auth 8.6 high No fix published 27 Mar 2026
CVE-2026-62197: OpenClaw Browser CDP Discovery Vulnerability Allows Access to Blocked WebSocket URLs 8.5 medium 2026.6.6 21 Oct 2026
Policy Bypass Vulnerability in OpenClaw: Accepting Blocked WebSocket URLs 8.5 medium 2026.6.6 14 Jul 2026
CVE-2026-53814: OpenClaw CLI Authority Escalation via Hook-Triggered Runs 8.4 high 2026.5.20 02 Jul 2026
Critical Session Sandbox Escape in OpenClaw: Access to Parent and Sibling Session State 8.4 critical No fix published 29 Mar 2026
High-Risk Argument Pattern Validation Bypass in OpenClaw Package 8.3 high No fix published 16 Jun 2026
CVE-2026-53864: OpenClaw Node.js Control Variables Exposure Vulnerability 8.1 high 2026.5.26 18 Jun 2026
Allowlist Bypass Vulnerability in OpenClaw: Shell Inline-Command Parsing Issue 8.1 high No fix published 16 Jun 2026
Insufficient Sanitization in OpenClaw: Node.js Control Variables Vulnerability 8.1 high No fix published 16 Jun 2026
Shell Positional Parameters Vulnerability in OpenClaw: Inline-Eval Bypass Risk 8.1 high No fix published 16 Jun 2026
High-Risk Policy Enforcement Vulnerability in OpenClaw: Mutable Display Names in Zalo 8.1 high No fix published 16 Jun 2026
Privilege Escalation Vulnerability in OpenClaw: Discord allowFrom Feature Misconfiguration 8.1 high No fix published 16 Jun 2026
Privilege Escalation Vulnerability in OpenClaw Package: Gateway Plugin Subagent Fallback Issue 8.1 medium No fix published 10 Apr 2026
CVE-2026-53817: OpenClaw Control UI Locality Spoofing Vulnerability 8.0 high 2026.5.22 02 Jul 2026
High Severity VNC Authentication Bypass in OpenClaw Package 7.7 high No fix published 21 Mar 2026
Node Pairing Reconnection Vulnerability in OpenClaw: Approval Scope Confusion 7.6 high 2026.5.27 02 Jul 2026
Path Traversal Vulnerability in OpenClaw: Workspace Path Guard Bypass 7.6 high No fix published 21 Mar 2026
Resource Exhaustion Vulnerability in OpenClaw: Unauthenticated Telegram Webhook Request Handling 7.5 high No fix published 29 Mar 2026
Critical Remote Code Execution Vulnerability in OpenClaw Package 7.5 high No fix published 21 Mar 2026
Memory Overload Risk in OpenClaw: Inbound Media Download Vulnerability 7.5 high No fix published 21 Mar 2026
High Severity Vulnerability in OpenClaw: Cross-Agent Sandbox Inheritance Bypass 7.5 high No fix published 21 Mar 2026
Server-Side Request Forgery (SSRF) Vulnerability in OpenClaw Package 7.4 medium No fix published 19 Mar 2026
Input Validation Vulnerability in OpenClaw Package: Unvalidated Group IDs in Tool Group Policy Callers 7.1 medium No fix published 16 Jun 2026
Path Traversal Vulnerability in OpenClaw Package: Risk of Unintended Executable Execution 7.1 high No fix published 16 Jun 2026
Environment Variable Injection Vulnerability in OpenClaw: Impact on Dependency Resolution 7.1 high No fix published 16 Jun 2026
Path Traversal Vulnerability in OpenClaw: Impact on Dependency Installation 7.1 high No fix published 16 Jun 2026
Symlink Traversal Vulnerability in OpenClaw: Incomplete Fix for CVE-2026-32013 7.1 medium No fix published 10 Apr 2026
Unauthorized Admin Access in OpenClaw: HTTP Session Kill Path Vulnerability 7.1 high No fix published 27 Mar 2026
Symlink Traversal Vulnerability in OpenClaw Package: Incomplete Fix for CVE-2026-32013 7.1 high No fix published 26 Mar 2026
Allowlist Bypass Vulnerability in OpenClaw Package 7.1 high No fix published 19 Mar 2026
Allowlist Exec-Guard Bypass Vulnerability in OpenClaw 7.1 high No fix published 19 Mar 2026
Authorization Bypass Vulnerability in OpenClaw Package: Synology Chat Plugin 7.0 high No fix published 19 Mar 2026
Approval Integrity Vulnerability in OpenClaw Package: Unintended Local Script Execution 6.7 medium No fix published 19 Mar 2026
Allowlist Bypass Vulnerability in OpenClaw Package 6.6 medium No fix published 16 Jun 2026
Authorization Header Exposure in OpenClaw MCP SSE - Moderate Vulnerability 6.5 medium 2026.6.5 01 Jul 2026
CVE-2026-53859: OpenClaw Hostname Checks Inconsistent Handling of Trailing-Dot Hosts 6.5 medium 2026.5.26 18 Jun 2026
Privilege Escalation Vulnerability in OpenClaw Package 6.5 medium No fix published 16 Jun 2026
Hostname Validation Vulnerability in OpenClaw: Inconsistent Trailing-Dot Handling 6.5 medium No fix published 16 Jun 2026
Session Visibility Check Bypass in OpenClaw - Moderate Vulnerability 6.5 medium No fix published 16 Jun 2026
Symlink Traversal Vulnerability in OpenClaw Package 6.5 medium No fix published 21 Mar 2026
OpenClaw Twilio Webhook Replay Vulnerability: Event ID Randomization Issue 6.5 medium No fix published 21 Mar 2026
TOCTOU Vulnerability in OpenClaw Package Allows Arbitrary Command Execution 6.5 medium No fix published 21 Mar 2026
Command Injection Vulnerability in OpenClaw Package 6.4 medium No fix published 21 Mar 2026
Authorization Bypass in OpenClaw: Command Execution Vulnerability 6.4 high No fix published 19 Mar 2026
Brute-Force Vulnerability in OpenClaw Telegram Webhook: Weak Secret Exploitation 6.3 medium No fix published 27 Mar 2026
Current Working Directory Injection Vulnerability in OpenClaw Package 6.3 medium No fix published 19 Mar 2026
Cross-Site Scripting Vulnerability in OpenClaw Package - Unsafe Link Export 6.1 low No fix published 16 Jun 2026
Command Injection Vulnerability in OpenClaw Package 6.1 medium No fix published 19 Mar 2026
Symlink Traversal Vulnerability in OpenClaw: Potential File Overwrites 6.1 medium No fix published 19 Mar 2026
OpenClaw Vulnerability: Executable Rebind Risk in system.run Approvals 6.0 medium No fix published 19 Mar 2026
Improper Authentication in OpenClaw: Google Chat Webhook Vulnerability 5.9 medium No fix published 10 Apr 2026
Authentication Bypass in OpenClaw: Trusted-Proxy Control UI Pairing Vulnerability 5.9 medium No fix published 21 Mar 2026
Tokenless Authentication Bypass in OpenClaw Package 5.9 high No fix published 21 Mar 2026
Allowlist Bypass Vulnerability in OpenClaw Package 5.9 medium No fix published 19 Mar 2026
Insecure File Permissions in OpenClaw: A Vulnerability Overview 5.5 medium No fix published 16 Jun 2026
Control Scope Bypass Vulnerability in OpenClaw: Focus Command Issue 5.5 medium No fix published 16 Jun 2026
Scope Containment Bypass Vulnerability in OpenClaw: Empty-Scope Device Re-Pairing 5.4 low No fix published 16 Jun 2026
Privilege Escalation Vulnerability in OpenClaw Package 5.4 medium No fix published 16 Jun 2026
Authorization Bypass Vulnerability in OpenClaw ACP Client 5.4 medium No fix published 21 Mar 2026
Unauthorized Event Handling in OpenClaw: Slack System Events Bypass 5.4 medium No fix published 21 Mar 2026
Notification Bypass Vulnerability in OpenClaw: Slack Reaction Events Ignored 5.3 medium No fix published 16 Jun 2026
OpenClaw Vulnerability: Gateway HTTP Session History Route Bypasses Operator Read Scope 5.3 medium No fix published 29 Mar 2026
Bypass of Mention Requirements in OpenClaw: BlueBubbles Group Reactions Vulnerability 5.3 medium No fix published 27 Mar 2026
Matrix Verification Notices Bypass in OpenClaw: A Security Concern 5.3 medium No fix published 27 Mar 2026
Improper Sandbox Configuration Vulnerability in OpenClaw 5.3 medium No fix published 21 Mar 2026
Command Injection Vulnerability in OpenClaw Package - Windows Lobster Shell Fallback 5.3 medium No fix published 19 Mar 2026
Brute-Force Vulnerability in OpenClaw: Telegram Webhook Lacks Rate Limiting 4.8 medium No fix published 10 Apr 2026
Brute-Force Vulnerability in OpenClaw Webhook Authentication 4.8 medium No fix published 10 Apr 2026
Authentication Bypass Vulnerability in OpenClaw: BlueBubbles Plugin Webhook 4.8 medium No fix published 21 Mar 2026
Approval Integrity Bypass in OpenClaw: Execute Unexpected Binaries 4.8 medium No fix published 21 Mar 2026
OpenClaw macOS Companion App Vulnerability: Allowlist Parsing Mismatch 4.8 medium No fix published 19 Mar 2026
Replay Attack Vulnerability in OpenClaw: Nextcloud Talk Webhook Processing 4.8 medium No fix published 19 Mar 2026
CVE-2026-53848: OpenClaw Exec Allowlist Bypass via Command Wrappers 4.3 low 2026.5.26 18 Jun 2026
Hook Bypass Vulnerability in OpenClaw: Skill-command Dispatch Issue 4.3 low No fix published 16 Jun 2026
Exec Allowlist Bypass Vulnerability in OpenClaw: Potential for Unintended Command Execution 4.3 low No fix published 16 Jun 2026
Inconsistent Sender-Policy Checks in OpenClaw: A Security Concern 4.3 medium No fix published 21 Mar 2026
Bootstrap Token Replay Vulnerability in OpenClaw: Duplicate Advisory 4.2 low No fix published 16 Jun 2026
Sender Policy Bypass Vulnerability in OpenClaw: BlueBubbles Metadata Exploitation 4.2 low No fix published 16 Jun 2026
Policy Confusion Vulnerability in OpenClaw: Nextcloud Talk Room Authorization Flaw 4.2 low No fix published 10 Apr 2026
Authorization Bypass Vulnerability in OpenClaw: Google Chat Group Policy Rebinding 4.2 low No fix published 10 Apr 2026
Unauthorized Access Vulnerability in OpenClaw Package 3.7 medium No fix published 21 Mar 2026
Authorization Bypass Vulnerability in OpenClaw Package 3.7 low No fix published 19 Mar 2026
Input Validation Bypass in OpenClaw Package - Arbitrary File Operations Vulnerability 3.6 low No fix published 19 Mar 2026
Approval Context-Binding Weakness in OpenClaw Package 2.6 low No fix published 21 Mar 2026
Brute-Force Vulnerability in OpenClaw: BlueBubbles Webhook Lacks Rate Limiting N/A medium No fix published 27 Mar 2026

Looking for another version, or everything Vulert holds for openclaw?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About openclaw 2026.5.19

Is openclaw 2026.5.19 vulnerable?

Yes. 91 vulnerabilities in the Vulert database cover openclaw 2026.5.19: 3 critical, 30 high, 46 medium and 12 low. Each entry above names the fixed version to move to.

Is 2026.5.19 the latest release of openclaw?

No. 2026.5.19 was published 20 May 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor openclaw for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the openclaw version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.