#OpenClaw
All CosmicBytez Labs articles tagged #OpenClaw, across news, security advisories, how-to guides, and projects.
- News
More Malicious OpenClaw Skills Threaten AI Supply Chain
Unit 42 researchers identified five persistent malicious skill packages on ClawHub — OpenClaw's AI agent marketplace — including infostealers disguised as...
- Security
CVE-2026-32973: OpenClaw Exec Allowlist Bypass via Glob
A critical CVSS 9.8 vulnerability in OpenClaw allows attackers to bypass the exec allowlist by exploiting improper glob pattern normalization where the ?...
- Security
CVE-2026-32975: OpenClaw Zalouser Weak Authorization via Mutable Group Display Names
A critical CVSS 9.8 authorization bypass in OpenClaw's Zalouser allowlist mode matches mutable group display names instead of stable identifiers, letting...
- Security
CVE-2026-32987: OpenClaw Bootstrap Code Replay Enables
A critical CVSS 9.8 vulnerability in OpenClaw allows attackers to replay a valid bootstrap setup code multiple times before approval, escalating device...
- Security
CVE-2026-32922: OpenClaw Privilege Escalation via Token
A critical CVSS 9.9 privilege escalation vulnerability in OpenClaw allows operators with limited pairing scope to mint tokens with unrestricted admin...
- Security
CVE-2026-32924: OpenClaw Authorization Bypass via Feishu
A critical CVSS 9.8 authorization bypass in OpenClaw allows attackers to circumvent groupAllowFrom and requireMention protections in group chats by...
- Security
CVE-2026-22172: OpenClaw Critical Authorization Bypass via WebSocket Scope Elevation
A critical CVSS 9.9 authorization bypass in OpenClaw allows authenticated users to self-declare elevated scopes over WebSocket connections without...
- News
OpenClaw AI Agent Flaws Enable Prompt Injection, 1-Click
China's CNCERT has warned that OpenClaw (formerly Clawdbot/Moltbot), the viral self-hosted AI agent, carries over 250 disclosed vulnerabilities including...
- News
Cline CLI Supply Chain Attack Installs Unauthorized
A compromised npm publish token was used to inject a malicious postinstall script into Cline CLI version 2.3.0 on February 17, 2026, silently installing...