OpenClaw CVE Tracker: Every Disclosed Vulnerability, What It Does, and Whether You’re Patched

That’s not a worst-case scenario. That’s the state of OpenClaw security as of March 2026, according to SecurityScorecard’s STRIKE team, who scanned 40,214 exposed OpenClaw instances and found 12,812 directly exploitable via remote code execution. Five security organizations — CNCERT, CrowdStrike, Cisco, Microsoft, and Belgium’s Centre for Cybersecurity — issued independent advisories about the same vulnerability in the same month. When five agencies all say “patch this now,” the subtext is: attackers are already here.

The patches exist. They’ve existed for weeks. The problem isn’t the software — it’s the 17,500+ deployments that haven’t applied them yet.

This tracker covers every OpenClaw CVE: the affected component, how the exploit actually works, the minimum version you need to be safe, and what each vulnerability means if you’re running a self-managed deployment. Bookmark it. Check your version. Then decide whether you want to keep tracking patches yourself or have someone do it for you.

A vulnerability in a misconfigured web server might expose a login form. A vulnerability in your AI agent exposes everything the agent can touch — your inbox, your calendar, your file system, your API credentials, and the tools that can execute shell commands on your host machine. The access footprint isn’t comparable.

3 of OpenClaw’s 9 CVEs are remote code execution vulnerabilities. A 4th is an authentication bypass exploitable from your browser — no network access required. “I’ll update when it’s convenient” isn’t a maintenance posture for AI agent deployments. It’s a countdown.

And OpenClaw’s 9 CVEs aren’t outliers. They’re part of a systemic pattern. Between January and February 2026, security researchers filed over 30 CVEs targeting MCP servers, clients, and infrastructure — ranging from trivial path traversals to a CVSS 9.6 remote code execution flaw in a package downloaded 437,000 times. The OWASP Top 10 for Agentic Applications (2026), peer-reviewed by 100+ security researchers, now formally lists tool misuse, supply chain compromise, and unexpected code execution among its top risk categories.

Why this matters: If you’re running OpenClaw on a VPS and you haven’t checked your version number this month, you don’t know whether your agent is patched. And with 5 national or major security organizations issuing warnings about the same platform in the same 30-day window, “I didn’t know” stopped being a defense a long time ago. The full security hardening framework covers everything beyond just version patching.

Every CVE gets a CVSS score from 0.0 to 10.0. The score reflects attack complexity, whether credentials or network access are required, and the impact if exploitation succeeds. Here’s what the ranges mean for your deployment:

• 9.0–10.0 Critical: Remotely exploitable, no authentication, full system impact. Patch the same day you learn about it.
• 7.0–8.9 High: Serious attack vector with significant impact. Patch within days, not weeks.
• 4.0–6.9 Medium: Requires preconditions or has partial impact. Schedule in your next maintenance window.
• 0.1–3.9 Low: Limited exploitability or limited impact. Catch it in your normal release cycle.

OpenClaw’s 9 CVEs span medium to high, with 3 RCE vulnerabilities in the 7.1–7.3 band and the ClawJacked authentication bypass at 8.8. None are critical (9.0+). But 8.8 on a browser-exploitable bug that bypasses your firewall entirely is a meaningful threat by any measure.

CVSS 8.8. WebSocket authentication bypass. Affects all versions before v3.1.8. Patched in v3.1.8+.

ClawJacked is the CVE that triggered the CNCERT advisory, the CrowdStrike advisory, the Cisco advisory, the Microsoft advisory, and the Belgian CCB advisory — all in March 2026. What makes it unusual isn’t just the CVSS score. It’s that it’s exploitable by anyone who can get you to visit a webpage, regardless of your firewall configuration.

How the Attack Works (The Full Chain)

Here’s what happens. You’re running OpenClaw on localhost. Your firewall is configured correctly. You feel safe. Then you visit a webpage — maybe a blog, a forum post, a link in an email. The page contains JavaScript that opens a WebSocket connection directly to your local OpenClaw gateway. OpenClaw’s gateway doesn’t validate the WebSocket Origin header — it accepts connections from any site, not just your own UI. The connection succeeds. The page exfiltrates your gateway token. The attacker registers as a trusted device. From that point, they can rewrite your tool policies, disable confirmation prompts, and set tools.exec.host to “gateway” — which routes commands to run directly on your host machine, outside the Docker container entirely.

Oasis Security’s analysis revealed an additional design flaw that made the exploit far more practical than the CVSS score alone suggests: the gateway’s rate limiter exempted localhost connections entirely. The malicious JavaScript could brute-force your gateway password at hundreds of attempts per second with no throttling. Combined with the missing Origin header validation, an attacker didn’t need to know your password in advance — the script cracked it live, in-browser, in seconds.

How to Check if You’re Vulnerable

# Check your running OpenClaw version (direct install)
openclaw --version

# Check version inside Docker
docker exec openclaw-gateway openclaw --version

# Check image tag via Docker Compose
docker compose ps
# Look for the image tag on your openclaw-gateway service

# Patched version: v3.1.8 or later
# Anything before v3.1.8 is vulnerable to ClawJacked

If you’re running any version before v3.1.8 and OpenClaw has network access — even localhost-only — update before your next browser session, not your next maintenance window.

Three CVEs in the 6.8–7.3 CVSS range give attackers the ability to execute arbitrary commands on your system. Each one targets a different component, and each has a different attack vector.

CVE-2026-19847: RCE via Tool Injection (CVSS 7.3)

Component: Agent core. Attack vector: Unsanitized input in tool calls reaches a code execution pathway. For deployments where the agent processes external content — emails, documents, web pages — the content itself becomes the injection vector. If your agent reads an email containing a crafted payload, the payload can execute commands. Fix: Patched in v3.0.4.

CVE-2026-14521: RCE via Skill Installer (CVSS 7.1)

Component: Skill manager. Attack vector: A malicious skill package exploits the installer at the binary level — code execution triggers during the install process itself, before the SKILL.md instructions even run. This is distinct from the ClawHavoc supply chain attack (which worked through AI instruction injection). This one doesn’t need the AI to cooperate. Fix: Patched in v2.9.7.

CVE-2026-11203: RCE via Memory Write (CVSS 6.8)

Component: Memory module. Attack vector: The component that manages SOUL.md and MEMORY.md persistent storage contains a write vulnerability that can trigger code execution. This is directly related to the attack vector used in the ClawHavoc campaign: malicious skills wrote to SOUL.md and MEMORY.md to establish persistence across sessions. CVE-2026-11203 closes the execution pathway. Fix: Patched in v2.8.2.

CVE-2026-08441: Privilege Escalation via Docker Config (CVSS 6.2)

This CVE is “mitigated via config” rather than patched. The vulnerability exists in how Docker containers running OpenClaw can escalate privileges from the container user to the host. The fix isn’t a code patch — it’s specific Docker flags: --cap-drop=ALL, --security-opt no-new-privileges, and running as a non-root user (UID 1000+). Without these flags, a compromised container process can escalate to host-level access. This is why the security audit checklist treats Docker hardening flags as high-priority items.

CVE-2026-07133: Privilege Escalation via OAuth Handler (CVSS 5.9)

A logic flaw in OpenClaw’s OAuth handler allows certain API calls to execute at a higher permission level than the authenticating user should have. For multi-user deployments, this creates a lateral movement path. For single-user deployments, the practical impact is lower — but “lower” isn’t “none.” Patched in v2.7.5. If you’re using Composio for OAuth integrations, the Composio OAuth hardening guide covers additional configuration steps beyond this patch.

CVE-2026-04891: Information Disclosure via API Logger (CVSS 5.4)

OpenClaw’s API logger was writing credential-containing fields to log output. API tokens, OAuth headers, and in some configurations email content — all appearing in plain text in log files. If your logs are readable outside the container (mounted volumes, log forwarding services), this is a data exfiltration path. Patched in v2.6.9.

CVE-2026-02217: Information Disclosure via Web UI (CVSS 4.8)

The Web UI exposed internal state information — configuration values, connected integration metadata, session data — to any user with UI access, regardless of permission level. For single-user deployments, the impact is low. For team setups, one user can read another’s integration configuration. Patched in v2.6.1.

CVE-2025-98431: DoS via Gateway (CVSS 4.3)

A malformed request crashes the gateway process. Your agent goes offline until it’s manually restarted. Mitigated via config — specifically, rate limiting on the gateway port. Without rate limiting, this becomes a trivial way to take your agent offline. For production deployments where your agent runs unattended workflows, repeated DoS attacks can disrupt scheduled tasks without leaving an obvious security footprint.

Patching CVEs handles code-level vulnerabilities. It doesn’t handle supply chain attacks. In January 2026, the ClawHavoc campaign placed 2,400+ malicious skills in ClawHub — OpenClaw’s official skill registry. At peak, 1 in 5 published skills was malicious. The payload was the AMOS infostealer, targeting SSH keys, browser credentials, and crypto wallets.

300,000 users were affected. The skills have since been removed, but ClawHub remains an open-upload registry without mandatory security review. Every skill you install is code running with your agent’s permissions.

OpenClaw shipped 7 updates in 2 weeks after the ClawJacked disclosure. That’s the right response to a CVSS 8.8 vulnerability — fast patching. But for self-managed deployments, each update is a manual operation: pull the new image, test that your skills still work, verify your Composio connections, confirm gateway token validity. 7 updates in 14 days means 7 manual update cycles, each one a potential source of configuration drift or workflow disruption.

Most self-installs don’t have a tested update process. They update when something breaks or when they happen to check GitHub. That gap — between when a patch ships and when it’s applied — is exactly the window attackers target after a CVE disclosure.

SecurityScorecard’s STRIKE team quantified the cost of that gap: of the 40,214 exposed OpenClaw instances they discovered, 12,812 were directly exploitable via remote code execution — meaning known, patched CVEs were still present and reachable on those deployments. The team also correlated 549 exposed instances with prior breach activity. These aren’t theoretical risks. They’re instances where the patch existed, the deployment didn’t apply it, and attackers found the gap before the operator did.

Why this matters: If you’re self-managing your OpenClaw deployment, the question isn’t whether you can apply patches. It’s whether you have a process that guarantees you will — within 24 hours for critical CVEs, not “whenever I get around to it.” The full security hardening framework covers patch management as one layer of a defense-in-depth stack.

OpenClaw’s 9 CVEs are all patched or mitigatable. That’s the good news. The bad news is that “patched” and “applied” are very different words, and SecurityScorecard found 12,812 instances where nobody bothered to make them the same word. The CVEs span 3 remote code execution flaws, an authentication bypass that renders firewalls irrelevant, 2 privilege escalation paths, 2 information disclosure leaks, and a denial-of-service bug. The ClawHavoc supply chain attack operated alongside these CVEs, affecting 300,000 users through a separate vector entirely.

Every CVE on this list has a fix. Not every deployment has applied it.

OpenClaw is the most capable open-source AI agent available in 2026. That’s not in dispute. But running capable software without applying its security patches is like buying a vault and leaving the door open because the combination is written on a Post-it you haven’t read yet. The combination exists. The vault works. The question is whether you’ve done the 20 minutes of work that turns “running” into “secure.”

ManageMyClaw Managed Care patches critical CVEs (CVSS 7.0+) within 24 hours of release and moderate CVEs within 72 hours. Every patch is tested against a staging environment first. Starting at $299/month.