Question 1

How many total CVEs does OpenClaw have now?
  22+ disclosed CVEs as of March 2026. The first 9 (CVSS 4.3–8.8) were filed between January and February 2026, covering remote code execution, authentication bypass, privilege escalation, information disclosure, and denial of service. The second batch of 13+, disclosed since February, adds a CVSS 8.8 GNU long-option abbreviation bypass, multiple allowlist bypasses, command injections on Windows, an authorization bypass in the Synology-chat plugin, a shell-fallback exploit in the Lobster extension, two denial-of-service flaws targeting webhook endpoints, and 1 CVE with details still pending.

Accepted Answer

22+ disclosed CVEs as of March 2026. The first 9 (CVSS 4.3–8.8) were filed between January and February 2026, covering remote code execution, authentication bypass, privilege escalation, information disclosure, and denial of service. The second batch of 13+, disclosed since February, adds a CVSS 8.8 GNU long-option abbreviation bypass, multiple allowlist bypasses, command injections on Windows, an authorization bypass in the Synology-chat plugin, a shell-fallback exploit in the Lobster extension, two denial-of-service flaws targeting webhook endpoints, and 1 CVE with details still pending.

Question 2

What are the allowlist bypass CVEs and why do they matter?
  Six CVEs target OpenClaw's command execution allowlists — the primary mechanism most deployments use to restrict what an agent can run. CVE-2026-28363 (CVSS 8.8, the highest in this wave) exploits GNU long-option abbreviations to bypass the sort command. CVE-2026-27566, CVE-2026-31995, and CVE-2026-31992 wrap blocked commands inside approved binaries (like env bash or env -S) to smuggle payloads past the policy analysis. CVE-2026-28460 uses shell line-continuation characters. CVE-2026-32059 targets the sort command execution path. The wrapper-chain bypasses are fixed in 2026.2.22; others are awaiting patches.

Accepted Answer

Six CVEs target OpenClaw's command execution allowlists — the primary mechanism most deployments use to restrict what an agent can run. CVE-2026-28363 (CVSS 8.8, the highest in this wave) exploits GNU long-option abbreviations to bypass the sort command. CVE-2026-27566, CVE-2026-31995, and CVE-2026-31992 wrap blocked commands inside approved binaries (like env bash or env -S) to smuggle payloads past the policy analysis. CVE-2026-28460 uses shell line-continuation characters. CVE-2026-32059 targets the sort command execution path. The wrapper-chain bypasses are fixed in 2026.2.22; others are awaiting patches.

Question 3

Do the Windows command injection CVEs affect Linux/Docker deployments?
  CVE-2026-31994 and CVE-2026-22176 specifically target Windows scheduled task script generation in gateway.cmd files. If you're running OpenClaw exclusively on Linux or in Docker containers, these don't directly affect your deployment. However, if your agent generates scheduled tasks for Windows endpoints or if any part of your workflow chain touches Windows, you should update to version 2026.2.19 or later.

Accepted Answer

CVE-2026-31994 and CVE-2026-22176 specifically target Windows scheduled task script generation in gateway.cmd files. If you're running OpenClaw exclusively on Linux or in Docker containers, these don't directly affect your deployment. However, if your agent generates scheduled tasks for Windows endpoints or if any part of your workflow chain touches Windows, you should update to version 2026.2.19 or later.

Question 4

What's the minimum safe version for all known CVEs?
  Version 2026.3.1 covers all CVEs from this wave that have published fix versions. Combined with the patches from the first wave, you need at least version 2026.3.1 to be covered against all patched CVEs. However, 5 CVEs in this wave (CVE-2026-28363, CVE-2026-28460, CVE-2026-32000, CVE-2026-32059, and CVE-2026-29607) don't have confirmed fix versions yet. The safe floor will move when those patches land.

Accepted Answer

Version 2026.3.1 covers all CVEs from this wave that have published fix versions. Combined with the patches from the first wave, you need at least version 2026.3.1 to be covered against all patched CVEs. However, 5 CVEs in this wave (CVE-2026-28363, CVE-2026-28460, CVE-2026-32000, CVE-2026-32059, and CVE-2026-29607) don't have confirmed fix versions yet. The safe floor will move when those patches land.

Question 5

Is updating enough, or do I need to audit my configuration too?
  Updating patches the vulnerability. It doesn't undo exploitation that may have occurred before you patched. CVE-2026-31992 specifically persists wrapper-level allowlist entries that survive restarts. If your deployment was exposed before the update, malicious allowlist entries could still be in your configuration. After updating, review your allowlist configuration, check for unexpected persistent entries, and audit logs for unusual command execution patterns.

Accepted Answer

Updating patches the vulnerability. It doesn't undo exploitation that may have occurred before you patched. CVE-2026-31992 specifically persists wrapper-level allowlist entries that survive restarts. If your deployment was exposed before the update, malicious allowlist entries could still be in your configuration. After updating, review your allowlist configuration, check for unexpected persistent entries, and audit logs for unusual command execution patterns.

Question 6

Why is there still a CVE with no details?
  CVE-2026-29607 has been assigned a CVE number and flagged by RedPacket Security, but the full technical disclosure hasn't been published. This is standard practice — CVE numbers are often reserved before details are made public, sometimes to give vendors time to patch. Until details are published, you can't assess whether your deployment is affected or what mitigation steps to take. (Update: CVE-2026-28461, previously listed as pending, has been confirmed as the Zalo webhook memory exhaustion flaw affecting versions before 2026.3.1.)

Accepted Answer

CVE-2026-29607 has been assigned a CVE number and flagged by RedPacket Security, but the full technical disclosure hasn't been published. This is standard practice — CVE numbers are often reserved before details are made public, sometimes to give vendors time to patch. Until details are published, you can't assess whether your deployment is affected or what mitigation steps to take. (Update: CVE-2026-28461, previously listed as pending, has been confirmed as the Zalo webhook memory exhaustion flaw affecting versions before 2026.3.1.)

Question 7

How does ManageMyClaw handle this volume of CVEs?
  ManageMyClaw Managed Care ($299/month) monitors all disclosed and pending CVEs, patches critical vulnerabilities within 24 hours of release, and conducts post-patch configuration audits including allowlist review. For the pending CVEs and the 5 awaiting fix versions, Managed Care clients are automatically covered when patches are published — no manual tracking required.

Accepted Answer

ManageMyClaw Managed Care ($299/month) monitors all disclosed and pending CVEs, patches critical vulnerabilities within 24 hours of release, and conducts post-patch configuration audits including allowlist review. For the pending CVEs and the 5 awaiting fix versions, Managed Care clients are automatically covered when patches are published — no manual tracking required.

Tag: CVE

OpenClaw’s New CVE Wave: 13+ More Vulnerabilities Disclosed Since February

OpenClaw CVE Tracker: Every Disclosed Vulnerability, What It Does, and Whether You’re Patched