OpenClaw Patches 13 New CVEs in April 2026 Including CVSS 8.7 Privilege Escalation and 8.4 Code Execution

OpenClaw published 13 security fixes on April 9-10 2026, including CVE-2026-35639 (CVSS 8.7 privilege escalation via device.pair.approve), CVE-2026-35641 (CVSS 8.4 code exec via .npmrc), CVE-2026-41296 (CVSS 8.2 sandbox escape TOCTOU race), CVE-2026-41297 (SSRF). 138 total CVEs tracked Feb-Apr 2026.

Product Idea from this Signal

A security service that auto-patches OpenClaw CVEs within hours of disclosure before attackers exploit them

460.5k ▲

OpenClaw shipped 9 CVEs in 4 days (March 2026) including a CVSS 9.9 privilege escalation affecting 135K+ exposed instances. Most operators have no way to know which CVEs affect their version, no automated patching, and no coordination between the flood of advisories (156+ total) and their actual attack surface. This tool continuously monitors CVE feeds, maps each advisory to your installed version and enabled features, and applies safe mitigations automatically while queuing risky patches for human approval.

SECURITYCLIDEVTOOLOPEN-SOURCESYSADMIN

CompetitiveView Opportunity →