Threat database

OpenClaw CLI versions prior to 2026.2.3 with Slack integration enabled are vulnerable to remote code execution via system prompt injection. Slack channel metadata such as topics or descriptions can be incorporated into the model's system prompt, increasing the risk of prompt injection. This vulnerability is relevant only when Slack integration is enabled and tool execution is allowed, potentially leading to unintended tool invocations or data exposure. A patch is available in version 2026.2.3. Users not using Slack do not need to take action.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.1 have a vulnerability in Telegram webhook mode where missing the configuration of 'channels.telegram.webhookSecret' allows acceptance of webhook HTTP requests without verifying Telegram's secret token header. This can enable attackers who can reach the webhook endpoint to send forged Telegram updates, potentially causing unintended bot actions. Telegram webhook mode is not enabled by default and requires explicit configuration. A patch is available in version 2026.2.1 and later.

Openclaw CLI contains a local file inclusion vulnerability in the isValidMedia() function that improperly validates file paths. This allows an agent to read arbitrary files on the system by specifying paths with absolute, home directory, or directory traversal sequences. Sensitive files such as SSH keys, cloud credentials, and system files can be accessed and exfiltrated. A fix exists but is not yet merged, leaving production versions vulnerable.

A vulnerability in openclaw-cli's optional BlueBubbles iMessage channel plugin allows webhook authentication bypass when requests originate from loopback addresses. This occurs if the webhook secret is missing or incorrect, enabling unauthenticated webhook event injection. The issue affects versions prior to 2026.2.13 when BlueBubbles is installed and enabled. The default iMessage integration is not impacted. A fix is available in version 2026.2.13.

OpenClaw macOS desktop client versions 2026.2.6 through 2026.2.13 have a vulnerability in the handling of openclaw://agent deep links without an unattended key. The confirmation dialog truncates the displayed message to 240 characters, but executes the full message, allowing an attacker to conceal malicious commands by padding the message with whitespace. This social engineering vulnerability could lead to arbitrary command execution if a user approves the prompt. The issue is fixed in version 2026.2.14.

OpenClaw CLI versions prior to 2026.2.14 contain a local file disclosure vulnerability in the Feishu extension's sendMediaFeishu function. This flaw allows attacker-controlled mediaUrl parameters to be treated as local filesystem paths, enabling unauthorized reading of local files. The vulnerability is fixed in version 2026.2.14 by removing direct local file reads and enforcing local-root restrictions through hardened media loading helpers.

OpenClaw CLI's Gateway tool allowed an unrestricted override of the gatewayUrl parameter, enabling the host to attempt outbound WebSocket connections to arbitrary user-specified targets. This vulnerability affects openclaw versions before 2026.2.14 and requires the ability to invoke tools that accept gatewayUrl overrides, typically limited to authenticated or trusted users. The issue can lead to outbound connection attempts, network reachability probing, and potential interaction with reachable WebSocket targets. A patch restricting gatewayUrl overrides to loopback or the configured gateway remote URL is planned for version 2026.2.14.

OpenClaw CLI contains a command injection vulnerability in the maintainer script `scripts/update-clawtributors.ts` that processes Git commit author metadata. This flaw affects contributors or maintainers who run this script on source checkouts containing maliciously crafted commit author emails. The vulnerability does not affect normal CLI usage or installed versions, as the script is not part of the shipped CLI. The issue is fixed in version 2026.2.14.

OpenClaw CLI versions before 2026.2.14 have a Server-Side Request Forgery (SSRF) protection bypass vulnerability. The SSRF guard fails to block requests using full-form IPv4-mapped IPv6 addresses such as 0:0:0:0:0:ffff:7f00:1, which maps to the loopback address 127.0.0.1. This allows potentially unauthorized access to loopback, private network, or link-local metadata endpoints. The issue is fixed in version 2026.2.14.

A vulnerability in openclaw-cli's node host system.run handler allows bypassing allowlist enforcement and approval prompts due to a mismatch between rawCommand and command[]. This affects deployments using node host execution with allowlist-based exec policy and approval prompting on allowlist misses. An attacker invoking system.run can supply an allowlisted rawCommand but execute a different command[], bypassing security controls. The issue affects openclaw versions from 2026.1.29 up to but not including 2026.2.14. A patch is planned in version 2026.2.14 to enforce consistency between rawCommand and command[].

The OpenClaw CLI's skills.status method could leak sensitive configuration secrets to clients with operator.read permissions by exposing raw resolved config values. This vulnerability affects versions up to 2026.2.13 and was fixed in version 2026.2.14 by removing raw config values from the output and narrowing config requirements. The issue could expose secrets such as Discord bot tokens to unauthorized read-scoped clients.

OpenClaw CLI versions before 2026.2.14 allow unauthenticated discovery TXT records to influence routing and TLS pinning decisions. This vulnerability affects clients on shared or untrusted LANs where an attacker can advertise rogue services to redirect connections and override TLS pins. The impact is mainly on iOS and Android clients in alpha or testing phases, limiting exposure. A fix is planned in version 2026.2.14 that changes clients to prefer SRV and A/AAAA records over TXT records and requires explicit user confirmation for TLS pinning on mobile platforms.

A vulnerability in openclaw-cli allows iMessage group authorization under groupPolicy=allowlist to be satisfied by sender identities from the DM pairing store. This broadens trust from direct messages into group contexts, weakening boundary separation between DM pairing and group allowlist authorization. The issue affects openclaw versions from 2026.1.29 up to but not including 2026.2.14. A fix is available in later versions.

OpenClaw CLI versions prior to 2026.2.14 contain a path traversal vulnerability in the browser upload functionality that allows authenticated users to read arbitrary files on the Gateway host. This occurs because the server passes user-supplied file paths directly to Playwright's file input APIs without restricting them to a safe directory. Exploitation requires valid authentication and permission to use the browser tool, limiting exposure to authorized users. The vulnerability is fixed in version 2026.2.14 by restricting upload paths to a designated temporary directory and rejecting traversal sequences.

OpenClaw CLI versions from 2026.1.29 up to 2026.2.12 contain a path traversal vulnerability in the browser download functionality. This flaw allows authenticated users with CLI or gateway RPC token access to write files outside the intended temporary downloads directory. The vulnerability is fixed in version 2026.2.13 by restricting download paths to a designated directory.

OpenClaw CLI versions up to 2026.2.14 contain a configuration injection vulnerability that allows dangerous Docker options to be applied in the sandbox environment. This can enable container escape or unauthorized access to host data by mounting sensitive host paths, using host networking, or disabling security profiles. The issue is fixed in version 2026.2.15 by blocking unsafe Docker settings and validating configuration schemas.

OpenClaw CLI versions up to 2026.2.14 log Telegram bot tokens in error messages and stack traces without redaction, potentially exposing these tokens in logs, crash reports, CI outputs, or support bundles. This exposure allows attackers to impersonate the bot and gain unauthorized Bot API access. The issue is fixed in version 2026.2.15. Users should upgrade to this version and rotate any potentially exposed Telegram bot tokens.

OpenClaw CLI versions up to 2026.2.14 have a session visibility configuration issue in multi-user shared-agent deployments, potentially exposing session transcript content across peers. Additionally, Telegram webhook mode lacked fallback to per-account webhook secrets, risking secret misconfiguration. The vulnerability mainly affects less-trusted, multi-user environments, with limited impact in single-agent or trusted setups. A patch is planned in version 2026.2.15 to enforce session visibility scoping and fix Telegram webhook secret fallback.

OpenClaw CLI versions up to 2026.2.14 have a configuration integrity vulnerability where the sandbox configuration hash normalization incorrectly sorted primitive arrays, causing order-sensitive configuration changes to be ignored. This leads to stale sandbox containers being reused instead of recreated when array order changes. The issue is fixed in version 2026.2.15 by preserving array order during hash normalization.

A vulnerability in openclaw-cli versions up to 2026.2.14 allows the admin-only skills installation process to write files outside the intended sandbox directory due to insufficient validation of the target directory path. This could lead to unauthorized file writes outside the per-skill tools directory. A fix is planned for version 2026.2.15.