Threat database

OpenClaw CLI versions prior to 2026.3.31 have a vulnerability where Tlon media downloads can bypass core safety limits, leading to disk exhaustion. This is a resource exhaustion issue affecting availability only. The vulnerability is patched in version 2026.3.31. The severity is rated medium with a CVSS score of 6.5.

CVE-2026-41913 is a vulnerability in the openclaw CLI where concurrent asynchronous shared-secret authentication attempts can bypass the intended rate-limit budget on Tailscale-capable paths. This allows multiple authentication attempts to race the per-key rate-limit, potentially circumventing restrictions. The issue affects openclaw versions up to 2026.4.2 and was fixed in version 2026.4.4. The vulnerability has a low CVSS score of 3.7 and does not assume a multi-tenant service boundary.

OpenClaw CLI's QQ Bot Extension had missing Server-Side Request Forgery (SSRF) protection on all media fetch paths, allowing user-controlled local assistants to bypass SSRF guard and allowlist policies. This vulnerability affects openclaw npm package versions from 2026.1.29 up to but not including 2026.4.8. The issue was fixed in version 2026.4.8 with targeted regression tests verifying the fix.

OpenClaw CLI versions up to 2026.4.1 do not enforce integrity verification on ClawHub package downloads, allowing installation of plugin archives without validating archive or per-file integrity metadata. This vulnerability affects the local user-controlled assistant OpenClaw and does not involve multi-tenant service boundaries. The issue has been fixed in version 2026.4.8.

OpenClaw CLI contains a vulnerability in its gateway plugin HTTP authentication mechanism where requests with identity-bearing operator.read permissions are incorrectly expanded to operator.write permissions at runtime. This affects the openclaw npm package versions from 2026.1.29 up to but not including 2026.4.8. The issue has been fixed in version 2026.4.8. The vulnerability is scoped to the OpenClaw trust model and does not assume multi-tenant service boundaries.

A vulnerability in openclaw-cli versions before 2026.4.12 allows QQBot reply media URL handling to trigger server-side request forgery (SSRF) and re-upload fetched bytes. This occurs because QQBot media URLs were treated as trusted sources, enabling SSRF fetches whose responses were then re-uploaded. The issue is fixed in version 2026.4.12 and later.

A vulnerability in openclaw-cli versions 2026.2.23 up to but not including 2026.4.12 weakens the exec approval binding for opaque multi-call binaries such as busybox and toybox. This issue could allow obscured execution of applets or script-like behaviors, potentially leading to high impact on confidentiality, integrity, and availability. The vulnerability is fixed in version 2026.4.12 and later.

OpenClaw CLI versions from 2026.3.24 up to but not including 2026.4.7 contain a symlink traversal vulnerability. This flaw allows attackers to escape the intended repository root directory by supplying crafted symbolic link paths in remote marketplace repository handling. The vulnerability can lead to unauthorized read access to files outside the expected repository directory.

Openclaw CLI versions before 2026.4.10 have a vulnerability where existing-session browser interaction routes bypass SSRF policy enforcement. This allows these routes to interact with or navigate targets without the SSRF navigation guard applied to guarded browser routes. The issue was fixed in version 2026.4.10 and later.

A vulnerability in openclaw-cli versions before 2026.4.12 allows empty approver lists to grant explicit approval authorization. This could enable an unauthorized sender to resolve pending approvals if they know an approval ID. The issue is fixed in version 2026.4.12 and later.

OpenClaw CLI versions before 2026.4.10 have a vulnerability where the sandbox browser CDP relay could expose the Chrome DevTools Protocol on all network interfaces (0.0.0.0), potentially allowing unintended external access. This exposure occurs because the CDP relay binds too broadly instead of restricting access to local or sandboxed sources. The issue is fixed in version 2026.4.10 and later, which enforce source-range restrictions by default to prevent broad exposure.

OpenClaw CLI versions before 2026.4.22 contain a vulnerability where the Zalo plugin could forward attacker-controlled outbound photo URLs to the Zalo Bot API without proper SSRF validation. This issue was fixed in version 2026.4.22 by enforcing SSRF hostname validation on outbound photo URLs.

OpenClaw CLI versions before 2026.4.20 have a vulnerability where hook mapping templates could bypass the intended session-key opt-in control. This flaw allows a hook mapping to produce an externally influenced session key even when the configuration to disallow request session keys is enabled. The issue affects webhook routing isolation but does not enable host execution by itself. The vulnerability is fixed in version 2026.4.20.

Mattermost slash token revocation in OpenClaw CLI could lag until the monitor refreshes, allowing brief acceptance of revoked tokens. This affects versions from 2026.1.29 up to but not including 2026.4.24. The issue occurs only when the affected feature is enabled and reachable, with impact depending on operator configuration and trust boundaries. A patch is available in version 2026.4.24. Mitigation includes restarting or refreshing the Mattermost monitor after token rotation until patched, and applying configuration hardening such as narrow allowlists and disabling the feature if not needed.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.4.22 have a vulnerability where Slack and Zalo webhook secrets may remain active after a secrets.reload operation. This allows a caller with an old webhook secret to continue sending webhook events during a brief stale-secret window after revocation. The issue affects only the named feature and does not alter the trusted-operator security model. The vulnerability has a medium severity rating with a CVSS score of 6.5. A patch is available starting from version 2026.4.22. Operators are advised to restart the affected channel runtime after rotating webhook secrets as a mitigation until they apply the patch.

A vulnerability in OpenClaw CLI's Feishu dynamic-agent bindings allows sender-created bindings to bypass configured config-write enforcement. This can lead to changes in sender-agent binding state beyond intended policy when the feature is enabled and reachable. The issue affects versions from 2026.1.29 up to but not including 2026.5.6. The vulnerability has a low severity score and does not affect confidentiality or availability, only integrity to a limited extent. A patch is available in version 2026.5.6. Mitigations include disabling sender-created Feishu dynamic-agent bindings if not needed and restricting channel and tool allowlists.

A vulnerability in openclaw-cli allows a workspace .env file to influence the npm_execpath used during bundled runtime dependency installation. This can cause an unintended local package-manager executable to run if a trusted operator opens a repository containing such a .env file. The issue affects versions from 2026.1.29 up to but not including 2026.4.29. A patch is available in version 2026.4.29. The impact depends on the operator's configuration and trust boundaries. Mitigations include installing dependencies only from trusted workspaces and restricting access via allowlists and disabling the affected feature when not needed.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.4.25 contain a vulnerability where internal or webchat command authorization can inherit a wildcard ownerAllowFrom state across channel boundaries. This may allow owner-style command behavior to be executed beyond its intended channel scope. The impact depends on the operator's configuration and whether lower-trust inputs can access the affected paths. A patch is available in version 2026.4.25. Until patched, explicit per-channel owner command allowlists and narrow allowlists are recommended, along with disabling the affected feature if not needed.

OpenClaw CLI versions from 2026.2.13 up to 2026.3.1 allowed node camera URL payloads to be fetched by the gateway or agent host without restricting downloads to the resolved node host. This could enable a malicious or compromised paired node to cause the gateway to fetch URLs from off-node destinations, potentially facilitating internal network probing or fetch pivots. The issue is considered medium severity and has been fixed in version 2026.3.2 by enforcing hostname matching and SSRF-guarded fetches.

OpenClaw CLI versions prior to 2026.2.23 had a vulnerability in the command authorization logic where conversation identifiers in the allowlist could authorize unintended participants. This occurred because the system treated conversation identities as valid senders, broadening command execution permissions beyond the intended sender. The issue was fixed in version 2026.2.23 by restricting authorization checks to sender-only identities and excluding conversation identifiers except as a fallback in direct-message contexts.