Threat database

OpenClaw CLI versions up to 2026.4.1 have a vulnerability in the Gemini OAuth flow where the PKCE verifier is reused as the OAuth state parameter. This causes the verifier to be exposed in the redirect URL alongside the authorization code. An attacker who can capture the redirect URL could obtain both values, defeating the PKCE protection and enabling token redemption. The issue is fixed in version 2026.4.2 by separating the OAuth state from the PKCE verifier.

A vulnerability in openclaw-cli allows the HTTP route /sessions/:sessionKey/kill to reach an admin kill path without properly binding the action to the requester's ownership or granted operator scopes. This means any bearer-authenticated request was previously treated as admin-eligible, potentially allowing unauthorized session termination. The flaw has been addressed by removing the bearer-token admin fallback and restricting remote session kills to local-admin or requester-owned sessions only.

Openclaw CLI versions prior to 2026.3.23 contain a vulnerability in the Plivo V2 verification path where query-only variants of the same signed request were incorrectly treated as distinct verified requests. This occurs because the replay key was derived from the full verification URL including query parameters, allowing unsigned query changes to bypass replay identity stability. The issue was fixed in version 2026.3.23 by stabilizing the replay key derivation to exclude query parameters.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.24 contain an authorization bypass vulnerability on the HTTP /v1/models endpoint. This endpoint accepts bearer tokens but does not enforce the required operator.read scope, unlike the WebSocket RPC path which correctly enforces scope checks. As a result, operators with only operator.approvals scope can enumerate model metadata via HTTP, bypassing intended access controls. This inconsistency weakens least-privilege enforcement for operators. The issue is fixed in OpenClaw 2026.3.24.

CVE-2026-35621 is a privilege escalation vulnerability in openclaw-cli versions >=2026.1.29 and <2026.3.24. It allows a gateway client with operator.write scope to persistently modify channel authorization allowlists, a capability intended only for operator.admin scope. This occurs because the /allowlist command does not enforce the required admin-level privilege before writing configuration changes, unlike other config mutation commands. The issue is fixed in version 2026.3.24.

A vulnerability in the openclaw CLI's Google Chat app-url webhook verification allowed acceptance of add-on principals outside the intended deployment binding. This issue was fixed in version 2026.3.22. The flaw could lead to improper authentication acceptance, impacting integrity but not availability or confidentiality significantly. The CVSS score is 5.9 (medium severity).

The Openclaw CLI's BlueBubbles webhook authentication lacked rate limiting on password guesses, allowing brute-force attempts against weak webhook passwords. This vulnerability affects versions up to 2026.3.24 and was fixed in version 2026.3.25 by adding throttling on repeated incorrect password attempts.

Nextcloud Talk room authorization in the OpenClaw CLI package matched on collidable room names instead of stable room tokens, causing policy confusion across similarly named rooms. This vulnerability was fixed in version 2026.3.22 and later. The issue allowed authorization policies to be incorrectly applied due to reliance on display names rather than stable room tokens.

OpenClaw CLI versions up to 2026.3.24 contain a vulnerability where a local shared-auth reconnect can silently escalate privileges from operator.read to operator.admin. This escalation allows a paired device to gain higher privileges without explicit user approval, potentially leading to remote code execution on the reach node. The issue is fixed in version 2026.3.25 by blocking silent reconnect scope upgrades and requiring explicit pairing approval for scope changes.

OpenClaw CLI versions prior to 2026.3.22 are vulnerable to unauthenticated resource exhaustion via its voice call webhook handling. The vulnerability arises because the webhook handler buffers request bodies before verifying provider signatures, allowing attackers to consume resources without authentication. This issue was fixed in version 2026.3.22 and later.

OpenClaw CLI versions prior to 2026.3.22 handle inbound Nostr direct messages (DMs) by performing cryptographic operations before enforcing sender and pairing policies. This allows unauthorized pre-authentication cryptographic work, potentially leading to resource misuse. The vulnerability is fixed in version 2026.3.22 and later.

OpenClaw CLI versions up to 2026.3.24 have a vulnerability in the Telegram webhook authentication mechanism where repeated incorrect secret guesses are not rate-limited. This allows an attacker to brute-force weak webhook secrets. The issue is fixed in version 2026.3.25 by adding throttling on repeated guess attempts.

An SSRF (Server-Side Request Forgery) vulnerability exists in multiple channel extensions of the openclaw-cli package due to unguarded use of configured base URLs in raw fetch() calls. This is an incomplete fix for a previous vulnerability (CVE-2026-28476). The issue affects versions up to and including 2026.3.24 and was fixed in version 2026.3.25 by routing outbound requests through a guarded fetch function to prevent rebinding to blocked internal destinations.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.23 contain a symlink traversal vulnerability in the agents.create and agents.update handlers. These handlers append data to the IDENTITY.md file without checking for symlinks, allowing an attacker who can place a symlink in the agent workspace to append arbitrary content to files outside the workspace. This can lead to remote code execution or unauthorized access if sensitive files like /etc/crontab or ~/.ssh/authorized_keys are targeted. A patch is available that blocks this symlink traversal.

A vulnerability in openclaw-cli before version 2026.3.23 allowed local-direct loopback requests to bypass Canvas HTTP and WebSocket authentication. This occurred because the authorization function treated local-direct requests as automatically authorized without verifying bearer tokens or capabilities. The issue was fixed in version 2026.3.23 by requiring authentication for Canvas routes.

OpenClaw CLI versions prior to 2026.3.22 contain a vulnerability in the Synology Chat multi-account configuration where webhook paths can collide. This collision allows route ownership to be replaced, bypassing direct message (DM) policy separation between accounts. The issue is fixed in version 2026.3.22 and later.

A vulnerability in openclaw-cli versions 2026.3.11 through 2026.3.24 allows sandboxed sessions to bypass intended session-tree visibility restrictions via the session_status sessionId resolution. This flaw permits sandboxed child sessions to access parent or sibling sessions that should be blocked. The issue was fixed in version 2026.3.25 by enforcing visibility checks after sessionId resolution.

OpenClaw CLI had a vulnerability where cite expansion occurred before channel and direct message authorization was complete, allowing content handling prior to final authorization. This issue was fixed in version 2026.3.22 and later. The fix defers cite expansion until after authorization checks are completed.

The OpenClaw CLI vulnerability CVE-2026-35639 involves the device.pair.approve function allowing an operator with pairing approval privileges to approve device requests for broader operator scopes than authorized. This leads to privilege escalation from operator.pairing to operator.admin. The issue affects openclaw versions prior to 2026.3.22 and was fixed in version 2026.3.22. The fix ensures that requested operator scopes do not exceed those held by the approver.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.24 contain a vulnerability where a maliciously crafted .npmrc file in a local plugin or hook directory can hijack the Git executable path during npm install. This allows an attacker to execute arbitrary code locally during the installation phase of plugins or hooks. The issue is fixed in OpenClaw 2026.3.24.