Threat database

OpenClaw CLI versions up to 2026.2.24 have a low-severity vulnerability where Slack reaction and pin non-message events were processed without consistent sender-policy checks. This could allow events from senders outside the configured policy to be added to system-event context. The issue is fixed in version 2026.2.25 by enforcing sender authorization checks including DM policies and channel user allowlists.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.4 contain a vulnerability where authorized non-owner chat senders can issue device-pairing bootstrap codes via the /pair command. This allows them to enroll devices with operator/node capabilities, which retain persistent credentials until removed. The vulnerability requires the attacker to already have permission to send commands through a configured chat channel and does not affect unauthenticated users. The issue is fixed in version 2026.5.4.

OpenClaw CLI versions up to 2026.3.2 have a vulnerability in the fetchWithSsrFGuard function where custom authorization headers are forwarded across cross-origin redirects. This can expose sensitive headers like X-Api-Key or Private-Token to unintended origins. The issue is fixed in version 2026.3.7 by replacing a narrow denylist with a safe allowlist for headers forwarded during redirects.

OpenClaw CLI versions up to 2026.3.11 have a vulnerability where non-owner users with command authorization could access privileged /config and /debug command surfaces intended only for owners. This flaw allowed unauthorized reading or modification of sensitive configuration and debugging settings. The issue is fixed in version 2026.3.12 by enforcing owner checks on these privileged commands.

A critical authorization bypass vulnerability exists in openclaw CLI versions 2026.3.7 through 2026.3.10. The plugin subagent runtime dispatches gateway methods with synthetic admin scopes, allowing plugin-owned routes to perform admin-only actions without proper authorization. This flaw enables unauthenticated external requests to execute privileged gateway operations such as deleting or reading session data and triggering agent execution. The issue is fixed in version 2026.3.11.

OpenClaw CLI versions up to 2026.3.12 contain a vulnerability where unsanitized iMessage attachment paths are used in SCP remote-path commands. This allows an attacker to inject shell metacharacters via a crafted iMessage attachment filename, potentially leading to command execution on a configured remote host. The issue is fixed in version 2026.3.13 by validating and rejecting remote paths containing shell metacharacters before invoking SCP.

The Openclaw CLI's built-in session_status tool failed to enforce session visibility boundaries, allowing sandboxed subagents to access or modify session state outside their own sandbox. This vulnerability affects versions from 2026.1.29 up to but not including 2026.3.11. It was fixed in version 2026.3.11 and later. The flaw permits a sandboxed child session to read or update parent or sibling session data, violating intended isolation.

A vulnerability in openclaw-cli versions up to 2026.3.10 allows users with operator.write permissions to reset conversation sessions via the agent interface, bypassing the intended admin-only restriction on session resets. This occurs because the agent slash commands /new and /reset internally reuse admin-only reset logic without proper scope enforcement. The issue is fixed in version 2026.3.11.

OpenClaw CLI versions up to 2026.3.11 automatically load workspace plugins from the .openclaw/extensions/ directory in the current workspace without requiring explicit trust. This behavior allows a maliciously crafted repository to include a plugin that executes arbitrary code when OpenClaw is run from that directory. The vulnerability is fixed in version 2026.3.12, which requires explicit trusted state before loading workspace plugins.

OpenClaw CLI versions up to 2026.3.7 have a vulnerability in the system.run approval flow where mutable script operands were not properly bound across approval and execution. This allowed an attacker to modify the script content after approval but before execution, causing different code to run under an approved command shape. The issue was fully fixed in version 2026.3.8 by binding approved script operands to on-disk file snapshots, preventing post-approval script drift.

OpenClaw CLI versions prior to 2026.3.11 contain an authorization bypass vulnerability in Discord guild reaction ingestion. The vulnerability allows reaction events from non-allowlisted guild members to be accepted and processed as trusted system events, bypassing configured users and roles allowlists. This could lead to unauthorized reaction text injection into session contexts. The issue was fixed in version 2026.3.11 by enforcing the same allowlist checks on reaction ingress as on normal guild messages.

A vulnerability in openclaw-cli versions 2026.1.29 up to but not including 2026.3.12 allows Feishu reaction events to bypass group authorization and mention gating. This occurs because reaction events missing the 'chat_type' field are misclassified as direct messages rather than group messages, causing authorization checks to be bypassed. The issue is fixed in version 2026.3.12.

A vulnerability in openclaw CLI versions up to 2026.3.10 causes local authentication SecretRefs that are configured but unavailable to fall back to remote credentials in local mode. This fallback occurs because the system treats unavailable local credentials as if they were unset, potentially leading to the use of incorrect credential sources. The issue is fixed in version 2026.3.11.

OpenClaw CLI versions up to 2026.3.10 have an approval integrity vulnerability where node-host system.run approvals display misleading shell payloads instead of the exact executed command line arguments. This discrepancy could allow an attacker to execute local code after an operator approves a command based on incomplete or misleading approval text. The issue is fixed in version 2026.3.11.

An authorization mismatch in OpenClaw CLI allowed users with operator.write privileges to persist admin-only browser profile changes via the browser.request endpoint. This vulnerability enabled write-scoped operators to create or modify browser profiles and store attacker-chosen remote CDP endpoints without requiring operator.admin privileges. The issue affects OpenClaw versions from 2026.1.29 up to but not including 2026.3.11. The vulnerability has been fixed in version 2026.3.11 and later releases.

OpenClaw CLI versions before 2026.3.11 have a flaw in their exec allowlist pattern matching on POSIX paths. The matching function overmatches due to lowercasing normalization and glob pattern handling, allowing the '?' wildcard to match path separators. This can cause unintended commands or executable paths to be approved by the operator. The issue is fixed in version 2026.3.11 and later.

OpenClaw CLI versions before 2026.3.12 allowed Feishu webhook mode deployments configured only with a verificationToken but without an encryptKey. This weaker configuration permitted acceptance of forged inbound events due to insufficient cryptographic verification. An unauthenticated attacker with network access to the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution based on local agent policies. The vulnerability is fixed in version 2026.3.12, which enforces the presence of encryptKey and rejects missing or invalid signatures.

OpenClaw CLI versions up to 2026.3.11 have a vulnerability in the Zalouser allowlist authorization where mutable group names were accepted instead of stable group IDs. This allowed different groups with the same display name to be mistakenly authorized, weakening channel authorization and potentially allowing messages from unintended groups to reach the agent. The issue is fixed in version 2026.3.12 by requiring stable group identifiers for allowlist authorization.

A vulnerability in openclaw-cli versions up to 2026.3.10 allows channel commands to bypass account-scoped configWrites restrictions. This enables an authorized sender on one account to modify protected configuration of sibling accounts within the same gateway deployment. The issue is fixed in version 2026.3.11.

A race condition vulnerability in openclaw-cli's sandbox file system bridge writeFile commit step allows an attacker to bypass sandbox boundaries by redirecting file writes outside the validated sandbox path. This affects versions prior to 2026.3.11 and is fixed in that version.