A vulnerability in OpenClaw CLI versions up to 2026.2.24 allows reaction-only inbound Signal events to enqueue status events before sender access checks are applied. This flaw is limited to reaction notifications and does not affect normal direct message delivery or command execution. The issue was fixed in version 2026.2.25 by enforcing access checks before enqueuing reaction notifications.
An authorization mismatch in OpenClaw CLI allowed authenticated users with write-scoped agent access to invoke owner-only tools such as gateway and cron. This flaw permitted control-plane actions beyond the intended write scope. The issue affects versions up to 2026.2.26 and was fixed in version 2026.3.1 by enforcing consistent owner-only gating and tightening tool scope classification.
OpenClaw CLI versions up to 2026.2.23 contain a vulnerability in the system.run shell-wrapper where positional argv parameters can execute hidden commands that are not visible in the displayed approval text. This discrepancy allows execution of commands under misleading operator-visible text. The issue is fixed in version 2026.2.24.
OpenClaw CLI versions before 2026.2.23 have a vulnerability where Twilio webhook replay events could bypass the voice-call manager's deduplication mechanism. This happens because normalized event IDs were randomized on each parse, allowing replayed events to be treated as new and potentially causing duplicate or stale call-state transitions. The issue is fixed in version 2026.2.23 by preserving provider event IDs during normalization, adding bounded replay deduplication in webhook validation, and enforcing per-call turn-token checks.
OpenClaw CLI versions up to 2026.2.25 contain a workspace boundary bypass vulnerability. This flaw allows a symlink inside the workspace pointing to a non-existent target outside the workspace to bypass path validation on the first write, potentially creating files outside the intended workspace boundary. The issue is fixed in version 2026.2.26 by improving canonical path resolution to correctly evaluate missing leaf aliases. The vulnerability has a high severity with a CVSS score of 7.6.
OpenClaw CLI versions up to 2026.2.21-2 are vulnerable to an environment injection flaw that allows attacker-controlled shell startup files to execute before system.run's allowlist commands. This occurs because environment sanitization does not block certain startup override keys like HOME and ZDOTDIR, enabling remote code execution via crafted shell environments. A fix is available in version 2026.2.22 and later.
OpenClaw CLI versions up to 2026.2.24 have a trusted-proxy Control UI pairing bypass vulnerability (CVE-2026-32057). This flaw allows a websocket client with a node role to bypass pairing by setting client.id to 'control-ui', enabling unauthorized access to node event methods. The issue arises because the bypass did not require the operator role, weakening the authorization boundary. The vulnerability is patched in version 2026.2.25 by enforcing the operator role requirement for this bypass.
A medium-severity vulnerability in OpenClaw CLI affects approval-enabled workflows using host=node for system.run commands. The issue arises because system.run approvals did not enforce strict, versioned execution-context binding, allowing a previously approved request to be reused with altered environment input in certain configurations. The vulnerability requires specific conditions including exec approvals enabled, system.run usage via host=node, and access to an approval ID in the same context. A fix is planned in version 2026.2.26 that enforces versioned binding and removes legacy fallback matching.
OpenClaw CLI versions up to 2026.2.13 contain a path traversal vulnerability in the apply_patch feature that can write or delete files outside the intended workspace directory if filesystem sandbox containment is not enabled. This occurs because the path resolution does not enforce workspace containment when apply_patch is enabled and the agent runs without sandboxing. The vulnerability is fixed in version 2026.2.14. The impact depends on deployment specifics and who can trigger the tool execution. Mitigations include disabling apply_patch if not needed, keeping workspaceOnly containment enabled, and restricting tool execution permissions.
OpenClaw CLI versions up to 2026.2.15 are vulnerable to a path traversal issue in the config $include directive, allowing arbitrary local file reads outside the intended config directory. This can expose sensitive local files readable by the OpenClaw process user, such as secrets and credentials. The vulnerability requires the attacker to have the ability to modify the OpenClaw configuration or create symlinks within the config directory. The issue is patched in version 2026.2.17.
OpenClaw voice-call media-stream WebSocket connections accepted upgrades before validating streams, allowing unauthenticated pre-start sockets to remain open and increase resource usage. This vulnerability affects openclaw versions up to 2026.2.21-2 and @openclaw/voice-call versions up to 2026.2.21. The issue is patched in version 2026.2.22. The vulnerability can lead to resource exhaustion and degraded service availability under sustained abuse.
OpenClaw CLI contains a local command injection vulnerability in its systemd unit file generation on Linux. The vulnerability arises because attacker-controlled environment variable values are not properly sanitized for newline characters, allowing injection of additional systemd directives. When the service is restarted, these injected directives execute arbitrary commands with the privileges of the OpenClaw gateway service user. This affects Linux deployments using systemd user services where an attacker can influence the environment variables and trigger service reinstall or install. A fix for this vulnerability is available.
OpenClaw CLI versions up to 2026.2.24 have a vulnerability in the system.run approval process where the displayed command for approval can differ from the actual executed command due to trimming of whitespace in the approval identity but not in execution. This allows an attacker who can influence command arguments and reuse an approval context to bypass approval integrity and execute unexpected commands. The issue is fixed in version 2026.2.25.
OpenClaw CLI versions up to 2026.2.25 have an authorization bypass vulnerability in multi-account setups. The flaw allows a pairing approval from one account to authorize the same sender on another account without explicit approval. This issue affects the account-scoped access control for device message pairing stores. A fix is planned for version 2026.2.26, which enforces stricter account-scoped pairing policies to prevent cross-account authorization bleed.
A vulnerability in openclaw CLI versions before 2026.3.11 allows browser-originated WebSocket connections to bypass origin validation when gateway.auth.mode is set to trusted-proxy. This enables untrusted web origins to obtain authenticated operator.admin access via a trusted reverse proxy, potentially exposing sensitive configuration and privileged operations.
OpenClaw CLI versions up to 2026.3.24 contain a path traversal vulnerability in media parsing that allows arbitrary file read. This vulnerability is fixed in version 2026.3.28 and later. The flaw enables an attacker with limited privileges to read files outside the intended directory. No known exploits are reported in the wild. The vulnerability has a CVSS 4.0 vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. Users should upgrade to version 2026.3.28 or later to remediate this issue.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.26 have a vulnerability in Slack system event handling where sender authorization is inconsistently enforced for certain member and message subtype events. This could allow unauthorized senders to enqueue system events if deployments rely on Slack DM allowlists or per-channel user allowlists. A patch is available in version 2026.2.26 that enforces sender authorization and fails closed when sender identity cannot be resolved.
CVE-2026-32896 is a medium severity vulnerability in the OpenClaw CLI's optional BlueBubbles beta iMessage plugin webhook authentication. The flaw allowed a passwordless fallback authentication path in certain reverse-proxy or local routing setups, potentially permitting unauthenticated webhook events. This affects deployments using the BlueBubbles plugin without configured webhook password authentication. The issue is fixed in version 2026.2.21 and later by enforcing a single authentication codepath requiring a matching webhook token/password.
OpenClaw CLI versions up to 2026.2.21-2 reuse the gateway authentication token as a fallback secret for hashing the owner ID prompt when certain configuration settings are unset. This results in dual-use of a secret across authentication and prompt metadata hashing domains, potentially exposing hash outputs to third-party model providers. No direct plaintext token disclosure occurs. A fix is planned in version 2026.2.22 that removes this fallback and generates a dedicated secret for owner-display hashing.
The OpenClaw ACP client had a vulnerability allowing auto-approval of tool calls based on untrusted metadata and permissive name heuristics. This flaw could let a malicious or compromised tool bypass interactive approval prompts for read-class operations. The issue was fixed in version 2026.2.23 by requiring trusted core tool IDs for auto-approval and scoping read approvals more strictly.