How many CVEs were fixed in April 2026?

13 new CVEs with an average CVSS of 7.0. The highest is CVE-2026-35639 at CVSS 8.7.

Which OpenClaw versions are affected by April CVEs?

Any release older than 2026.4.5 is vulnerable. Most CVEs affect versions 2026.3.22 through 2026.4.2.

What can the April CVEs do?

Session hijack via sessionId manipulation (CVE-2026-35636) and sandbox escape via path traversal (CVE-2026-35668) allowing file reads outside the sandbox.

Are the April 2026 OpenClaw CVEs remotely exploitable?

Yes — CVE-2026-35639 and CVE-2026-35641 are remotely exploitable with no credentials on unauthenticated instances.

Who tracks OpenClaw CVEs?

Joel Gamblin maintains the public jgamblin/OpenClawCVEs GitHub tracker with 1,850+ stars, logging 137+ advisories between Feb-Apr 2026.

← Back to dashboard

clawsmith.com/signal/openclaw-april-2026-13-cves-privilege-escalation-batch

⚠ IssueWide OpenLive

OpenClaw April 2026 Security Batch: 13 New CVEs Including Privilege Escalation and RCE

April 2026 security batch contains 13 CVEs with CVSS 7.0 average (highest: CVE-2026-35639 at 8.7). Two break the 8.0 critical threshold. Session hijack via sessionId manipulation and sandbox escape via path traversal. Any version older than 2026.4.5 vulnerable.

Product Idea from this Signal

A background service that continuously monitors OpenClaw CVE disclosures, detects which affect your running instance, and auto-applies the minimal safe patch without requiring a full version upgrade

9.7k ▲

OpenClaw shipped 22+ CVEs in 60 days (9 in March, 13 in April 2026) while 135,000 instances sat exposed on the public internet with 63% running no authentication. Cisco released DefenseClaw for enterprise but it requires significant configuration and ops knowledge. Self-hosted operators (the majority of OpenClaw users) take days to weeks to apply patches. This service watches the OpenClaw advisory feed, maps CVEs to affected code paths in your running version, generates and tests a minimal patch, and applies it with automatic rollback on failure.

CLIOPEN-SOURCESECURITYSELF-HOSTEDDEVTOOL

CompetitiveView Opportunity →