1 CRIT · 6 HIGH · 1 INFO · THREAT RED · 8 items · Generated in 525s
Missing authentication on API endpoints allows unauthenticated memory read/write/delete, potentially leading to data exposure and unauthorized access.
Vulnerability allows authenticated users to bypass experiment-level authorization controls, exposing sensitive data and allowing unauthorized modifications.
An attacker can access the Telegram account represented by the default session file without knowing a generated bearer token.
Fail-open authorization in the MCP tool layer allows malicious agents to perform cross-task and cross-session mutations.
A vulnerability in OpenClaw could allow non-owner callers to skip owner-only tool policy, potentially leading to unauthorized behavior.
A caller with the hook token could cause the spawned CLI runtime to see or call MCP tools that should have been owner-only.
A vulnerability in OpenClaw could allow an attacker to bypass denylists and gain broader command reach.
A challenge to hack an AI assistant was run, with 6,000 attempts failing to leak secrets.