CVE Vulnerability Catalog

Grav before version 2.0.4 ships a default .htaccess file whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack the [NC] flag, making extension matching case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Docker volume mounts), an unauthenticated attacker can request these files with uppercase or mixed-case extensions (e.g., .YAML, .PHP) to bypass the restrictions and read sensitive configuration files that may contain API keys and credentials.

OpenClaw before version 2026.5.18 contains an authorization bypass vulnerability in the exec allowlist glob matching mechanism. Attackers can craft input paths that bypass glob patterns, allowing execution or persistence of unauthorized actions when the feature is enabled.

OpenClaw before version 2026.6.5 contains an authorization bypass vulnerability in the node exec approvals feature. Lower-trust callers can execute actions beyond their intended authorization by using different gateway and node environments. Attackers can exploit mismatched environment configurations to persist or execute actions exceeding the caller's approved permissions.

Server-Side Request Forgery (SSRF) vulnerability in OpenClaw versions 2026.4.14 through 2026.5.25. Browser snapshot routes fail to validate post-navigation destinations, allowing attackers with lower trust to bypass OpenClaw policy checks and reach network destinations that should have been blocked.

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks.

An authorization bypass vulnerability in OpenClaw before version 2026.5.18 exists in the device-pair approval feature, allowing lower-trust callers to execute actions beyond their intended authorization.

OpenClaw before version 2026.5.22 contains a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level.

OpenClaw 2026.2.12 before 2026.5.26 has an authorization bypass vulnerability in agentId validation. A lower-trust attacker can submit blank agent IDs to bypass restrictions and perform actions requiring stronger authorization.

OpenClaw versions 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature. Lower-trust callers can bypass role-management checks. Attackers can perform actions requiring stronger authorization by reaching the affected feature through configured input paths.

OpenClaw versions 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing non-allowlisted senders to perform unauthorized operations.

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks.

OpenClaw before version 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should have required a stronger authorization or policy check.

In OpenClaw versions 2026.5.10-beta.1 through 2026.6.5, an authorization bypass in the ClickClack agent-mode dispatch feature may ignore the toolsAllow policy. A lower-trust caller can perform actions requiring stronger authorization.

An authentication bypass vulnerability in OpenClaw before version 2026.6.5 allows lower-trust callers to reach admin-scoped tools. Attackers can perform actions requiring stronger authorization by exploiting insufficient policy checks on configured input paths.

OpenClaw versions before 2026.6.9 have a missing authorization vulnerability in Discord moderation actions. A lower-trust caller or configured input path could perform moderation actions that should have required stronger authorization or policy checks.

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When enabled and reachable, a lower-trust caller or configured input path can perform actions that should have required stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. The issue is fixed in version 2026.6.6.

OpenClaw versions before 2026.6.6 have an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization level.

OpenClaw versions 2026.6.1 through 2026.6.8 contain a privilege escalation vulnerability in isolated cron jobs. Lower-trust attackers can regain access to denied execution tools via misconfigured input paths.

A vulnerability in OpenClaw before version 2026.6.6 allows a network policy bypass in the sandbox exec-server. Attackers can send HTTP requests through the exec-server to access internal network resources that should have been blocked by configured policies.

In the h2o HTTP server prior to commit 9265bdd, there is an HTTP/2 state amplification vulnerability that combines HPACK decompression amplification with Slowloris-style stream stalling. Decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack.