OpenClaw's optional Nostr plugin exposes unauthenticated HTTP endpoints that allow remote attackers to read and modify Nostr profile data and persist changes to the gateway configuration. This affects deployments with the Nostr plugin installed and enabled, where the gateway HTTP port is accessible beyond localhost. The vulnerability is fixed in version 2026.2.12 by requiring gateway authentication for plugin HTTP requests. Until upgraded, restricting gateway HTTP exposure is recommended.
OpenClaw CLI versions before 2026.2.14 contain two Server-Side Request Forgery (SSRF) vulnerabilities in the Feishu extension. These vulnerabilities occur in the sendMediaFeishu(mediaUrl) function and in processing Feishu DocX markdown image URLs, allowing attacker-controlled remote URL fetching without SSRF protections. An attacker able to influence tool calls could trigger requests to internal services and re-upload responses as Feishu media. The issue is fixed in version 2026.2.14 by routing media fetching through hardened runtime helpers enforcing SSRF policies and size limits.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.14 are vulnerable to a denial of service caused by unguarded archive extraction. The vulnerability allows specially crafted ZIP or TAR archives with high expansion ratios to consume excessive CPU, memory, and disk resources during install or update operations. This can disrupt service availability. The issue is fixed by enforcing strict resource budgets on archive extraction, including limits on entry count, extracted bytes, and compressed archive size for ZIP files.
OpenClaw CLI versions before 2026.2.14 contain a Zip Slip path traversal vulnerability in TAR archive extraction. This flaw allows crafted TAR archives to write files outside the intended extraction directory, potentially leading to configuration tampering or code execution if untrusted archives are installed. The issue is fixed in version 2026.2.14.
OpenClaw CLI versions up to 2026.1.30 have a critical vulnerability (CVE-2026-28454) in Telegram webhook mode where, if no webhook secret is configured, unauthenticated HTTP POST requests can be accepted. This allows attackers to forge Telegram updates and impersonate allowlisted senders, potentially executing privileged bot commands. The vulnerability is patched in version 2026.2.1 by requiring a webhook secret and adding multiple defense-in-depth measures.
OpenClaw Gateway versions from 2026.1.29 up to 2026.2.13 contain a vulnerability where unsafe handling of hook module paths allows an attacker with configuration modification privileges to execute arbitrary code. This occurs because the gateway does not sufficiently restrict module paths before dynamically importing them. The vulnerability is patched in version 2026.2.14. Users should upgrade to the fixed version and avoid exposing configuration endpoints to untrusted networks.
OpenClaw CLI versions before 2026.2.14 contain a path traversal vulnerability in the sandbox skill mirroring feature. This flaw allows a crafted skill name with traversal sequences or absolute paths to cause files to be written outside the intended sandbox workspace directory. The vulnerability requires an attacker to supply a malicious skill package and the victim to run OpenClaw with sandbox and skill mirroring enabled. A fix is available in version 2026.2.14 and later.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.1 have a vulnerability in the Browser Relay /cdp WebSocket endpoint that lacks authentication. This allows a website running in the browser to connect to the local relay via loopback WebSocket and potentially access cookies from other open tabs or execute JavaScript in their context. The issue is fixed in openclaw version 2026.2.1 by requiring a per-instance shared secret header and restricting WebSocket upgrades based on the Origin header.
OpenClaw CLI versions prior to 2026.2.12 contain a vulnerability where an authenticated gateway client can specify an arbitrary file path for session transcript data. This allows creation and appending of files outside the intended sessions directory, potentially causing configuration corruption or denial of service. The issue does not enable remote code execution by itself. The vulnerability is fixed in version 2026.2.12 and later.
OpenClaw CLI versions up to 2026.2.21-2 have a vulnerability in the system.run allowlist mode where shell-wrapper analysis can be bypassed using a shell line-continuation command substitution technique. This allows execution of non-allowlisted subcommands despite the allowlist restrictions. The issue affects deployments using tools.exec.security=allowlist with ask=on-miss or off. A fix is planned in version 2026.2.22. Temporary mitigations include setting tools.exec.ask=always or tools.exec.security=deny.
OpenClaw CLI versions up to 2026.2.26 have an unauthenticated denial-of-service vulnerability in the Zalo webhook endpoint. Attackers can cause unbounded memory growth by sending requests with varying query-string keys to the same webhook path, leading to potential process instability or out-of-memory conditions. This issue is fixed in version 2026.3.1 by normalizing keys and bounding the tracking state to prevent unbounded growth.
OpenClaw CLI versions prior to 2026.2.13 contain a path traversal vulnerability in the browser control API. This flaw allows user-supplied output paths for trace and download files to escape the intended temporary directories, potentially enabling arbitrary file writes depending on filesystem permissions. The issue affects versions from 2026.1.29 up to but not including 2026.2.13. The vulnerability has been fixed in version 2026.2.13 and later by enforcing strict path constraints on relevant API endpoints.
OpenClaw CLI versions before 2026.2.14 have a vulnerability in the exec-approvals allowlist feature where safe binaries intended to be stdin-only can bypass restrictions via shell expansion. This allows authorized but untrusted users to cause the gateway or node process to read arbitrary local files when host execution is enabled in allowlist mode. The issue arises because the allowlist validation checks tokens before shell expansion, but execution uses a real shell that expands globs and environment variables. A fix is available in version 2026.2.14 that forces argv tokens to be treated as literal text, preventing this bypass.
OpenClaw CLI versions prior to 2026.2.12 have a vulnerability in the hooks authentication mechanism where token comparison is not performed in constant time. This timing side-channel flaw could allow an attacker with network access to the hooks endpoint to infer the authentication token by measuring response times over many requests. The vulnerability requires the hooks endpoint to be exposed to an untrusted network and is complicated by real-world network latency and jitter. The issue is fixed in version 2026.2.12 and later.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.14 contain a critical remote code execution vulnerability (CVE-2026-28466) in the gateway-to-node invocation path. An authenticated gateway client could bypass node exec approval controls by injecting internal approval fields into the node.invoke parameters, enabling arbitrary command execution on connected node hosts. This can lead to full compromise of developer workstations, CI runners, and servers running the node host. The vulnerability is patched in OpenClaw version 2026.2.14.
OpenClaw CLI versions prior to 2026.2.2 are vulnerable to a server-side request forgery (SSRF) via attachment or media URL hydration. An attacker able to control the media URL can cause the gateway to fetch arbitrary HTTP(S) URLs, including internal network endpoints, and send the fetched content as an outbound attachment. This vulnerability allows data exfiltration from internal or cloud metadata services but does not enable code execution or system compromise. The issue is fixed in version 2026.2.2 by implementing SSRF protections such as blocking private IP ranges, DNS pinning, and redirect handling.
OpenClaw CLI versions from 2026.1.29-beta.1 up to but not including 2026.2.14 contain an authentication bypass vulnerability in the sandbox browser bridge server. This local-only vulnerability allows any process on the same machine to access the bridge server without authentication, enabling full browser session compromise including tab enumeration, navigation, JavaScript execution, and data exfiltration. The issue is patched in version 2026.2.14. Users should upgrade or disable the sandboxed browser to mitigate the risk.
OpenClaw CLI versions prior to 2026.2.14 have a vulnerability in Google Chat webhook handling where multiple webhook targets registered on the same HTTP path can cause cross-account policy misrouting. This occurs because the system routes inbound webhook events to the first matching target that verifies the request, potentially processing events under the wrong account context. The issue is fixed in OpenClaw version 2026.2.14. Users of the deprecated clawdbot package should migrate to OpenClaw and upgrade accordingly. A workaround is to ensure each webhook target uses a unique path to avoid ambiguous routing.
OpenClaw CLI versions from 2026.1.14-1 up to but not including 2026.2.2 have a vulnerability in the Matrix DM allowlist matching logic. The allowlist can be bypassed due to identity confusion caused by matching on attacker-controlled display names and localparts of Matrix IDs without homeserver parts. This allows a remote Matrix user to impersonate an allowed identity and bypass allowlist restrictions. The issue affects deployments with the optional Matrix plugin enabled. A fix is available in version 2026.2.2 and later.
OpenClaw CLI versions up to 2026.2.1 have a vulnerability in the gateway WebSocket connect handshake that allows skipping device identity checks if an auth.token is present but not validated. This could enable unauthorized clients to connect without proper device identity or pairing, potentially granting operator access depending on configuration. The issue is fixed in version 2026.2.2 by requiring validated shared-secret authentication for skipping device identity. The gateway should be restricted to trusted networks and users to mitigate risk.