Skip to content

vulnerability-tracker.md

Latest commit

 

History

History
50 lines (38 loc) · 3.36 KB

vulnerability-tracker.md

File metadata and controls

50 lines (38 loc) · 3.36 KB
Raw

OpenClaw Vulnerability Tracker

Version: v0.1
Updated: 2026-03-12

1. Purpose

This tracker records OpenClaw-related vulnerabilities and security signals that should influence product detection, remediation, or reporting.

2. Status Legend

  • tracked: known issue, not yet mapped to a detector or remediator
  • planned: mapped to planned product work
  • implemented: detector or mitigation support exists
  • monitoring: no immediate action, but kept under observation

3. Tracked Items

ID Disclosure Category Risk Product Relevance Planned Product Handling Status
CVE-2026-25157 2026-01 Command injection via SSH handling Critical Detect vulnerable versions and risky SSH execution paths Version matching, config checks, remediation guidance planned
CVE-2026-26319 2026-02 Webhook auth fail-open High Permission and trust-chain auditing Webhook signature checks, permission-chain report section planned
CVE-2026-26320 2026-02 Deep-link approval mismatch High Approval integrity and user-trust workflow Permission-chain checks, warning content in report planned
CVE-2026-26321 2026-02 Arbitrary file read via media path handling High File exfiltration and path control checks Path-scope checks, safe-path remediation guidance planned
CVE-2026-26322 2026-02 SSRF via gatewayUrl High URL validation and internal exposure checks SSRF rule, private-address checks, config guidance planned
CVE-2026-26324 2026-02 SSRF bypass via IPv6-mapped addresses High Address normalization correctness Canonical IP checks, SSRF hardening recommendation planned
CVE-2026-26325 2026-02 Allowlist bypass via normalization mismatch High Permission and approval-chain validation Command normalization checks, approval consistency logic planned
CVE-2026-26326 2026-02 Secrets disclosure via skills.status High Secrets exposure detection Status-endpoint checks, secrets report section planned
CVE-2026-26329 2026-02 Path traversal in browser upload flow High Host file exposure auditing Browser integration checks, path traversal guidance planned
CVE-2026-27009 2026-02 Control UI XSS Medium UI hardening awareness and version matching Version matching, upgrade recommendation planned
EXP-2026-0001 2026-01-31 Public internet exposure on TCP/18789 Critical Exposure discovery and hardening Bind-address checks, reachability checks, remediation workflow planned
SUP-2026-0001 2026-02 Malicious ClawHub skills Critical Supply-chain trust checks Skill provenance rules, suspicious origin detection planned
SUP-2026-0002 2026-02-09 Fake OpenClaw installer malware campaign Critical Installer trust and provenance warnings Installer origin checks, integrity verification guidance planned

4. Tracker Workflow

When a new issue appears:

  1. Add a tracker row
  2. Link the public advisory
  3. Map the issue to one or more detection mechanisms
  4. Decide whether remediation should be automatic, guided, or advisory-only
  5. Update requirements and design documents if scope changes

5. Source References

  • Censys public exposure research
  • NVD and GitHub Advisory entries for listed CVEs
  • Huntress reporting on fake installers
  • Public reporting on malicious ClawHub skills