OpenClaw CLI had an issue where authenticated non-owner users in direct message sessions could invoke certain owner-only gateway actions through a narrow tool invocation path. This vulnerability does not allow unauthenticated access or direct code execution. The root cause was inconsistent enforcement of owner-only access controls, relying on tool-name checks rather than comprehensive metadata-driven scopes. The issue affects openclaw versions up to 2026.2.17 and was fixed in version 2026.2.19 by refactoring scope mappings and centralizing owner-only enforcement.
OpenClaw CLI versions up to 2026.2.17 are affected by a vulnerability in the handling of remote iMessage attachments fetched via SCP. The issue stems from using trust-on-first-use host-key behavior and lack of strict validation of remote host tokens, which could allow a man-in-the-middle or DNS poisoning attack on first connection. The vulnerability is mitigated by enforcing strict SSH host key checking, validating remote host tokens, and adding argument barriers to SCP commands. A fix is available in versions 2026.2.19 and later.
OpenClaw CLI has a vulnerability where Unicode canonicalization drift in node metadata policy classification can cause a paired node to bypass intended command restrictions. This allows the paired node to supply Unicode-confusable platform or deviceFamily metadata that passes metadata pinning but is classified differently during command policy resolution, broadening node command allowlists beyond intended defaults. The issue affects versions up to 2026.2.26 and is fixed in version 2026.3.1 by hardening metadata canonicalization and making unknown platform defaults more restrictive.
OpenClaw CLI's system.run allowlist mode did not properly detect PowerShell encoded-command wrappers such as -EncodedCommand, -enc, or -e. This allowed callers with access to system.run to execute PowerShell inline payloads without the usual approval step required for equivalent -Command invocations. The issue was fixed in version 2026.3.7 by updating the shell-wrapper parsing to recognize these encoded-command aliases, ensuring allowlist mode enforces approval consistently.
OpenClaw CLI versions up to 2026.2.24 have a vulnerability where hardlink aliases inside a workspace can reference files outside the workspace boundary in certain workspace-only restricted configurations. This allows reading and modification of out-of-workspace files through these hardlink aliases. The issue affects deployments that enable workspace-only filesystem restrictions. A fix is available in version 2026.2.25, which rejects hardlinked final-file aliases during workspace boundary validation.
A vulnerability in the Openclaw CLI allowed sandboxed sessions using runtime="acp" to bypass sandbox inheritance and initialize host-side ACP runtime. This sandbox-boundary bypass could lead to high impact on confidentiality, integrity, and availability. The issue affects Openclaw versions from 2026.1.29 up to but not including 2026.3.2. A patch is available in version 2026.3.2 that denies ACP spawn from sandboxed requester sessions and rejects sandbox="require" for runtime="acp".
OpenClaw CLI versions up to 2026.2.21-2 have an authorization bypass vulnerability in Discord allowlists due to slug normalization collisions of user name/tags. This can cause unintended access when different Discord user tags normalize to the same slug, bypassing name-based allowlist checks. The issue is fixed in version 2026.2.22 by preferring resolved user IDs for authorization. Users are advised to prefer stable Discord user IDs in allowlists and run the security audit tool to identify and address warnings.
A vulnerability in the OpenClaw CLI's Windows system.run approval process allows trailing arguments after 'cmd.exe /c' to execute without proper approval or audit text reflection. This mismatch can lead to local command execution on a trusted Windows node under an authenticated operator context. The issue affects OpenClaw versions up to 2026.2.19-2 and is planned to be fixed in version 2026.2.21.
OpenClaw CLI versions up to 2026.2.21-2 have a vulnerability where adding 'sort' to the non-default safeBins configuration allows bypassing intended allowlist approval constraints via the --compress-program option. This can invoke an external helper, circumventing security controls. A patch is planned for version 2026.2.22.
A configuration-sensitive access-control mismatch in the BlueBubbles optional plugin for OpenClaw CLI allowed unauthorized direct message senders to bypass pairing or allowlist restrictions when the allowFrom list was empty or unset. This vulnerability affects BlueBubbles deployments where the DM policy is set to pairing or allowlist and the allowFrom configuration is empty, potentially permitting unknown senders to be treated as authorized. The issue is mitigated by a fix that changes the allowlist helper to fail closed on empty allowlists, restoring intended gating behavior.
OpenClaw CLI versions up to 2026.2.17 contain a path traversal vulnerability in the Feishu media download flow. Untrusted Feishu media keys were used directly to build temporary file paths, allowing writes outside the intended temporary directory. This arbitrary file write vulnerability could be exploited if an attacker controls the Feishu media key values returned to the client. The issue is fixed in version 2026.2.19 by removing key-derived temp-file naming and adding validation and isolation measures.
A logic flaw in OpenClaw gateway's WebSocket connection allowed shared-authenticated backend clients to self-declare elevated scopes without proper server-side validation. This flaw enabled such clients to gain unauthorized admin-level access. The vulnerability affects OpenClaw versions from 2026.1.29 up to but not including 2026.3.12. A patch fixing this issue was released in version 2026.3.12, which clears unbound scopes for non-Control-UI shared-auth connections.
A local process can capture the OpenClaw Gateway authentication token from Chrome CDP probe traffic sent over the loopback interface. This vulnerability affects openclaw-cli versions up to 2026.2.21-2 and is patched in version 2026.2.22 and later. The issue arises because the software injects an authentication header into loopback CDP URLs, which can be read by an attacker controlling the probed loopback port. This leads to local credential disclosure, with further impact depending on the deployment and enabled Gateway features. The vulnerability primarily affects non-standard shared-user or shared-host environments where untrusted local users can bind to the loopback relay port. The CVSS score is 5.7 (medium severity).
OpenClaw CLI versions before 2026.2.23 have a vulnerability where exec approvals in allowlist mode can be bypassed using unrecognized multiplexer shell wrappers such as busybox sh -c and toybox sh -c. This occurs because the wrapper detection treated these multiplexers as non-wrappers, causing the allowlist to persist the wrapper path rather than the inner executable. This allows arbitrary payloads executed via the same multiplexer wrapper to bypass the allowlist. The issue is fixed in version 2026.2.23 by improving wrapper detection and ensuring approvals bind to the intended inner executables.
OpenClaw CLI versions up to 2026.2.17 have a command injection vulnerability in the Windows Scheduled Task script generation process. The vulnerability arises because environment variable assignments in the generated batch script are unquoted, allowing Windows shell metacharacters in environment values to break out of the intended assignment context. This can lead to command execution when the scheduled task runs. The issue is patched in version 2026.2.19 and later. The risk is generally low for single-user, localhost-only setups but becomes significant when environment values come from less-trusted sources such as shared configs or automation scripts.
OpenClaw CLI versions up to 2026.2.19-2 allowed dangerous environment variables from configuration to propagate into the gateway service runtime environment. This flaw enabled startup-time code execution within the OpenClaw process context by injecting process-control environment variables such as NODE_OPTIONS and LD_*. The vulnerability is tracked as CVE-2026-22177 and has a high severity CVSS score of 8.8. A patch is available in version 2026.2.21 and later.
OpenClaw CLI versions up to 2026.2.17 are vulnerable to Regular Expression Denial of Service (ReDoS) and regex injection due to unescaped Feishu mention metadata used in RegExp construction. This flaw allows crafted input to cause catastrophic backtracking, blocking message processing, and unintended message content removal. The issue was fixed in version 2026.2.19.
OpenClaw CLI on macOS has a vulnerability in its system.run allowlist parsing when using security=allowlist mode. The flaw allows command substitution tokens inside double-quoted shell text to bypass the allowlist, enabling execution of non-allowlisted commands. This can lead to unintended command execution on the node host if certain conditions are met, such as using macOS node-host path with security=allowlist and an allowlisted benign executable in a shell wrapper. The issue is fixed in version 2026.2.22.
OpenClaw CLI versions up to 2026.3.1 have a vulnerability where strict URL fetch paths lose DNS pinning if environment proxy variables (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY) are configured. This allows attacker-influenced URLs to bypass strict destination checks and be routed through proxies, potentially accessing internal or private targets reachable via the proxy. The issue is fixed in version 2026.3.2. Operators can mitigate by clearing proxy environment variables or disabling certain web fetch features before upgrading.
OpenClaw CLI versions from 2026.2.22 up to 2026.2.22-2 contain a vulnerability in shell environment fallback logic that allows execution of attacker-controlled binaries if the runtime $SHELL environment variable can be influenced and a trusted prefix directory is writable. The vulnerability arises because the software accepts shells located in certain hardcoded trusted directories, which may be writable in some environments like Homebrew. The issue is fixed in version 2026.2.23 by removing the trusted-prefix fallback and only trusting shells explicitly listed in /etc/shells or falling back to /bin/sh.