OpenClaw CLI versions prior to 2026.2.2 have an authorization bypass vulnerability where clients with only 'operator.write' permissions can approve or deny exec requests by sending the '/approve' chat command. This bypasses intended permission scoping, allowing unauthorized approval actions. The issue mainly affects multi-client setups with scoped tokens. A fix is available in version 2026.2.2 that enforces proper permission checks for the '/approve' command.
The openclaw-cli package is affected by a server-side request forgery (SSRF) vulnerability in its optional Tlon (Urbit) extension authentication. This vulnerability arises because the extension accepted a user-provided base URL for authentication and used it to make outbound HTTP requests without sufficient validation. Only deployments that have installed and configured the Tlon extension and allow attackers to influence the Urbit URL are impacted. The issue is fixed in version 2026.2.14, which introduces URL validation and an SSRF guard blocking private/internal hosts by default.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.14 have a vulnerability in the manual Chutes OAuth login flow. This flaw allows bypassing OAuth CSRF state validation if an attacker convinces a user to paste attacker-controlled OAuth callback data. As a result, the attacker can cause OpenClaw to exchange an authorization code and persist tokens for the wrong Chutes account. The automatic local callback flow is not affected. A fix is available that enforces full redirect URL validation including state verification.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.13 contain a vulnerability where multiple webhook handlers accept and buffer request bodies without strict unified byte or time limits. This allows a remote unauthenticated attacker to send oversized payloads, causing memory pressure and degrading service availability, resulting in a denial of service (DoS). A patch is available that adds bounded request-body handling and stream guards to mitigate this issue.
OpenClaw CLI versions up to 2026.2.14 used the deprecated SHA-1 hashing algorithm for sandbox identifier cache keys. This hashing was used to determine if existing sandbox containers could be safely reused. Because SHA-1 is vulnerable to collisions, this posed a risk of cache poisoning and unsafe sandbox state reuse. The vulnerability is fixed in version 2026.2.15 by replacing SHA-1 with SHA-256 for these hashes, restoring collision resistance.
OpenClaw CLI versions before 2026.2.14 allowed Telegram allowlist authorization based on mutable usernames instead of immutable numeric sender IDs. This flaw could let unauthorized users gain access if a username is recycled or changed hands. The vulnerability has been fixed by requiring numeric Telegram sender IDs only and rejecting username-based allowlist entries. A security audit warning and a fix command are provided to help migrate legacy configurations.
OpenClaw CLI versions up to 2026.1.30 have a vulnerability in the MS Teams extension where bearer tokens used for authorization can be leaked to allowlisted suffix domains during attachment downloads. This occurs because the default allowlist uses suffix matching, potentially sending tokens to untrusted but allowlisted hosts. The issue is fixed in version 2026.2.1. Users not using MS Teams are not affected. Mitigation includes upgrading to 2026.2.1 or disabling the MS Teams extension if not needed.
OpenClaw CLI versions up to 2026.2.9 have a path traversal vulnerability due to unsanitized session IDs and session file paths used in transcript file operations. An authenticated attacker with access to the gateway can exploit this to read or write files outside the intended sessions directory. The vulnerability is fixed in version 2026.2.12 by validating session IDs and enforcing directory containment.
OpenClaw CLI versions from 2026.1.16-2 up to but not including 2026.2.14 contain a path traversal (Zip Slip) vulnerability in archive extraction during explicit installation commands. This flaw allows crafted archives to write files outside the intended extraction directory, potentially enabling arbitrary file writes as the current user. The vulnerability affects commands such as 'openclaw skills install', 'hooks install', 'plugins install', and 'signal install' when run against untrusted archives. It does not affect normal gateway operations or message receipt. The issue is fixed in version 2026.2.14.
A signature verification bypass vulnerability exists in the OpenClaw CLI's Twilio voice-call webhook extension when the ngrok free-tier loopback compatibility option is enabled. This optional voice-call extension is disabled by default, and the bypass only occurs if the specific configuration option 'tunnel.allowNgrokFreeTierLoopbackBypass' is explicitly enabled. Exploitation requires the webhook endpoint to be publicly reachable, typically via a public ngrok URL used during development. An attacker could send forged webhook requests without a valid Twilio signature, potentially causing unauthorized webhook event handling and request flooding. The issue affects OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.14. A fix is available in version 2026.2.14, which removes the signature verification bypass while preserving trusted forwarded headers for correct signature validation.
OpenClaw CLI versions up to 2026.2.21-2 have a vulnerability in the allow-always wrapper persistence mechanism that can bypass future command approvals in allowlist mode. This flaw allows an attacker to execute commands without re-approval by exploiting persistent wrapper-level allowlist entries. The issue affects execution approval persistence flows and is fixed in version 2026.2.22. Until patched, stricter execution policies can mitigate the risk.
OpenClaw CLI version 2026.3.1 contains a vulnerability in its node system.run approval wrapper that causes a semantic drift in command execution. The wrapper rewrites the command arguments in a way that the approved command text shown to the operator can differ from the actual executed command, potentially running unintended local scripts. This occurs when the wrapper argv is rewritten, causing the shell to interpret an extra positional argument as a script path. The issue is fixed in version 2026.3.2.
OpenClaw CLI versions prior to 2026.2.14 have a denial of service vulnerability caused by unbounded memory allocation when fetching URL-backed media. The issue arises because the entire response payload is buffered in memory before enforcing the maximum allowed size, allowing attackers to exhaust memory with oversized responses. This can lead to availability loss. A patch is available in version 2026.2.14.
OpenClaw CLI versions before 2026.2.14 are vulnerable to command hijacking due to unsafe PATH handling. This allows an attacker with certain access to cause OpenClaw to execute unintended binaries by manipulating the PATH environment variable. The vulnerability arises in two scenarios: one involving remote node-host PATH overrides and another involving local project directory PATH bootstrapping. The issue is mitigated in version 2026.2.14 and later by disabling project-local PATH bootstrapping by default and ignoring request-scoped PATH overrides on the node host.
OpenClaw CLI versions before 2026.2.14 contain a Local File Inclusion (LFI) vulnerability in the BlueBubbles media path handling. This flaw allows an attacker to specify arbitrary local filesystem paths via the mediaPath parameter, enabling reading and exfiltration of local files accessible to the OpenClaw process. The vulnerability is fixed in version 2026.2.14 by enforcing explicit allowlisting of trusted directories and canonical path containment checks.
OpenClaw CLI versions before 2026.2.14 have a denial of service vulnerability caused by decoding large base64 media inputs into buffers before enforcing size limits. This can lead to excessive memory allocation and memory pressure, resulting in service disruption. The vulnerability is primarily a local or authorized DoS risk when the gateway is bound to loopback with authentication. Exposure to untrusted networks or weakened authentication increases the risk severity. A fix is planned in version 2026.2.14.
OpenClaw CLI versions before 2026.2.12 have a webhook authentication bypass vulnerability in the BlueBubbles webhook handler when the gateway is behind a reverse proxy. The handler incorrectly treats requests from loopback addresses as authenticated, allowing attackers who can reach the proxy endpoint to inject unauthorized BlueBubbles events. This affects deployments exposing the BlueBubbles webhook endpoint through a reverse proxy. A patch is available in version 2026.2.12 that removes this bypass and requires the webhook secret for authentication.
OpenClaw CLI versions up to 2026.2.26 have a server-side request forgery (SSRF) vulnerability in the Gemini web_search citation redirect feature. This vulnerability allows an attacker who can control citation redirect targets to cause the OpenClaw host to make requests to internal or loopback network addresses. The issue arises because the citation redirect resolution used a private-network-allowing SSRF policy. The vulnerability is fixed in version 2026.3.1 by enforcing a strict SSRF policy that blocks localhost and private/internal redirect targets.
The OpenClaw CLI contained a vulnerability in the stageSandboxMedia function that allowed destination symlink traversal during media staging. This flaw could enable overwriting files outside the intended sandbox workspace by following symlinks in the destination path. The issue affected openclaw versions up to 2026.3.1 and was fixed in version 2026.3.2 by enforcing safe write primitives that prevent symlink traversal escapes.
OpenClaw CLI versions up to 2026.2.25 contain an authorization bypass vulnerability in Signal group allowlist enforcement. When groupPolicy is set to allowlist, sender identities approved via direct message (DM) pairing-store could improperly bypass group allowlist checks. This occurs because DM pairing approvals leak into group allowlist evaluation, weakening the authorization boundary between DM pairing and group membership controls. The issue is fixed in version 2026.2.26 by isolating DM pairing-store entries to DM-only and enforcing explicit group allowlist boundaries.