Alertas de Seguridad de la Información

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62227] OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser s…

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks to reach network destinations that should have been blocked.

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62228] OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that a…

OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node environments. Attackers can exploit mismatched environment configurations to persist or execute actions that exceed the caller's approved permissions.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62229] OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob match…

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended authorization. Attackers can craft input paths that traverse the allowlist glob patterns to execute or persist unauthorized actions when the affected feature is enabled.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62222] OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of unt…

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level.

nvdaltovulnerabilidad CVSS 7.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62223] OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval …

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured input paths to execute or persist unauthorized actions when the affected feature is enabled and reachable.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62226] OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act…

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks.

nvdaltovulnerabilidad CVSS 8.5 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62215] OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas resp…

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks.

nvdaltovulnerabilidad CVSS 8.0 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62217] OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals…

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing non-allowlisted senders to perform unauthorized operations.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62218] OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair…

OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management checks. Attackers can perform actions requiring stronger authorization by reaching the affected feature through configured input paths.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62219] OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allow…

OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or policy checks.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62207] OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-t…

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools. Attackers can perform actions requiring stronger authorization by exploiting insufficient policy checks on configured input paths.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62209] OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack…

OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62212] OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. W…

OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configu…

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62201] OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-…

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that should have been restricted by configured policies.

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62202] OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated …

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in the affected cron feature.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62203] OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host ex…

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization level.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62205] OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in …

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower…

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62206] OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderatio…

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62195] OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP…

OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions.

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62196] OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where What…

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.

nvdaltovulnerabilidad CVSS 8.3 NVD