EUVD-2026-17915Published

OpenClaw - Approval Bypass via Environment Variable Normalization

cve-program · CVE-2026-34426

Published

OpenClaw

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "OpenClaw",
                    "product": "OpenClaw",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "b57b680c0c34de907d57f60c38fb358e82aef8f7",
                            "versionType": "git"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:npm/openclaw"
                }

Original source record · Cite this exact observation · Complete original publisher JSON

cve-program · CVE-2026-34510

Published

OpenClaw

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "OpenClaw",
                    "product": "OpenClaw",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "2026.3.22",
                            "versionType": "semver"
                        },
                        {
                            "status": "unaffected",
                            "version": "2026.3.22",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:npm/openclaw"
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-17915

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Apr 1, 2026, 3:29:35 PM

dateUpdated: Sep 24, 2026, 2:17:30 PM

1 related source bulletins · separate from aliases

WID-SEC-W-2026-0856: OpenClaw: Mehrere Schwachstellen

CVE-2026-34510 · CVE-2026-35618 · CVE-2026-35622 · CVE-2026-35624 · CVE-2026-35626 · CVE-2026-35627 · CVE-2026-35631 · CVE-2026-35633 · CVE-2026-35634 · CVE-2026-35635 · CVE-2026-35637 · CVE-2026-35638 · CVE-2026-35639 · CVE-2026-35643 · CVE-2026-35644 · CVE-2026-35648 · CVE-2026-35649 · CVE-2026-35652 · CVE-2026-35655 · CVE-2026-35656 · CVE-2026-35658 · CVE-2026-35659 · CVE-2026-35660 · CVE-2026-35666 · CVE-2026-35670

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-18491

Published

Original publisher date fields

datePublished: Apr 2, 2026, 6:25:14 PM

dateUpdated: Nov 8, 2026, 2:02:06 PM

1 related source bulletins · separate from aliases

WID-SEC-W-2026-0980: OpenClaw: Mehrere Schwachstellen

CVE-2026-34425 · CVE-2026-34426 · CVE-2026-34511 · CVE-2026-41295 · CVE-2026-41298 · CVE-2026-41301 · CVE-2026-41339 · CVE-2026-41346 · CVE-2026-41348 · CVE-2026-41351 · CVE-2026-41352 · CVE-2026-41354 · CVE-2026-41358 · CVE-2026-41360 · CVE-2026-41362 · CVE-2026-41372 · CVE-2026-41383 · CVE-2026-41388 · CVE-2026-41398 · CVE-2026-41400 · CVE-2026-41407

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-34426

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-184

Original publisher date fields

published: 2026-04-02T19:21:31.727

lastModified: 2026-07-24T21:10:00.143

1 source CPE criteria · context only

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-34510

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-41

Original publisher date fields

published: 2026-04-01T16:23:50.567

lastModified: 2026-06-17T10:39:08.683

1 source CPE criteria · context only

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-98ch-45wp-ch47

Published

openclaw

npm

SEMVER · introduced 0 → fixed 2026.4.2

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-h3x4-hc5v-v2gm

Published

openclaw

npm

SEMVER · introduced 0 → fixed 2026.3.22

Original source record · Cite this exact observation · Complete original publisher JSON