Alertas de Seguridad de la Información

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62192] OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord …

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip cross-provider requester authorization and execute restricted operations.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62194] OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin i…

OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62186] OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible…

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization policies and execute restricted operations.

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62187] OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-accoun…

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62188] OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerabi…

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. The issue is fixed in v…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

08/07/2026

[CVE-2026-59261] OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files …

OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials that should remain within trusted boundaries.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53866] OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing…

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands. A command request using shell inline-command forms could route through a parser case missing the expected allowlist decision, enabling shell content execution without intended approval prompts.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53863] OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers th…

OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a group ID to the policy resolver could trigger incorrect group-policy decisions for tool invocations, potentially bypassing intended access controls.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53864] OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environmen…

OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables to influence child processes or coverage output paths.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53865] OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that …

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations by manipulating workspace-derived environment paths.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53857] OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutabl…

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53858] OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .e…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53849] OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature i…

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53853] OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that …

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables on Linux and macOS systems. Attackers can bypass configured argPattern restrictions by directly invoking allowlisted executables with unrestricted arguments, potentially enabling unauthorized file access, network access, or…

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53855] OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operato…

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to place inline-eval content in shell carriers outside intended allowlist rules, enabling execution of unapproved shell-provided content.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53842] OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK_PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53843] OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-s…

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53846] OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows …

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53840] OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP se…

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers like API keys or tenant-routing credentials to attacker-controlled origins.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53834] OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash…

OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured access control policies are applied, potentially triggering command handling from blocked senders depending on operator configuration.

nvdaltovulnerabilidad CVSS 7.5 NVD