Alertas de Seguridad de la Información

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62195] OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP…

OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks through configured input paths to execute or persist actions beyond their intended permissions.

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62196] OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where What…

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62197] OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accept…

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

nvdaltovulnerabilidad CVSS 8.5 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62199] OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss in…

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions beyond the caller's intended authorization.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62200] OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow…

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62189] OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync featu…

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62190] OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper…

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62191] OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message …

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62192] OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord …

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip cross-provider requester authorization and execute restricted operations.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62194] OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin i…

OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62186] OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible…

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization policies and execute restricted operations.

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62187] OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-accoun…

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62188] OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerabi…

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. The issue is fixed in v…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

08/07/2026

[CVE-2026-59261] OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files …

OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials that should remain within trusted boundaries.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53866] OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing…

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands. A command request using shell inline-command forms could route through a parser case missing the expected allowlist decision, enabling shell content execution without intended approval prompts.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53863] OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers th…

OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a group ID to the policy resolver could trigger incorrect group-policy decisions for tool invocations, potentially bypassing intended access controls.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53864] OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environmen…

OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables to influence child processes or coverage output paths.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53865] OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that …

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations by manipulating workspace-derived environment paths.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53857] OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutabl…

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53858] OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .e…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.

nvdaltovulnerabilidad CVSS 7.1 NVD