Threat database

A vulnerability in openclaw-cli versions up to 2026.3.24 allows BlueBubbles group reaction events to bypass the requireMention gate and enqueue agent-visible system events in groups that should be mention-gated. This issue was fixed in version 2026.3.25 by applying the reaction path to the same mention gate as normal group messages.

OpenClaw CLI versions prior to 2026.3.22 contain a vulnerability in the Android Canvas WebView component that allows arbitrary code execution via an unvalidated JavascriptInterface bridge. This occurs when WebView pages from untrusted origins invoke the bridge and inject instructions into the app. The issue is fixed in version 2026.3.22 and later.

OpenClaw CLI versions prior to 2026.3.22 could expose credentials embedded in channel baseUrl and related endpoint fields through read-scoped gateway snapshots. This vulnerability allows sensitive credential information to be inadvertently revealed. The issue was fixed in version 2026.3.22 by redacting credential-bearing URL fields while preserving safe context.

The Openclaw CLI had a vulnerability in its Gateway Plugin Subagent fallback deleteSession function, which used a synthetic operator.admin scope when no request-scoped client existed. This allowed deletion operations to be performed with elevated privileges. The issue was fixed in version 2026.3.25 by binding deletion to the caller's scope instead of minting an admin scope.

A vulnerability in the openclaw-cli package (Synology Chat webhook) allows an attacker to bypass pre-authentication rate limiting on webhook token validation. This enables brute-force guessing of weak webhook tokens. The issue affects versions up to 2026.3.24 and was fixed in version 2026.3.25 by adding throttling on repeated invalid token guesses.

A vulnerability in openclaw-cli versions up to 2026.3.24 allows Matrix verification notices to bypass direct message (DM) access policies and reply to unpaired or unauthorized DM peers. This issue was fixed in version 2026.3.25 by gating verification notices on DM access before sending.

OpenClaw CLI versions prior to 2026.3.22 had an issue where queued node actions were not revalidated against the current command policy upon delivery. This allowed stale allowlists or declarations to persist even after policy tightening, potentially permitting actions that should have been disallowed under updated policies. The vulnerability was fixed in version 2026.3.22 and later versions.

A vulnerability in the openclaw CLI (CVE-2026-35649) allowed explicit empty allowlists in Tlon settings reconciliation to be treated as unset, which could silently bypass intended deny-all revocations. This issue was fixed in version 2026.3.22 and later. The fix ensures that explicit empty allowlists are honored as authoritative deny-all configurations.

A vulnerability in the OpenClaw CLI's Mattermost interactive callback dispatch allowed action handlers to run before sender authorization checks were completed. This could enable unauthorized actions to be executed. The issue affects versions prior to 2026.3.22 and was fixed in version 2026.3.22. The fix ensures callback authorization is required before dispatching actions, aligning with normal sender and allowlist policies.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.24 contain an authorization vulnerability (CVE-2026-35653) where authenticated users with operator.write access to the browser.request method can perform a POST /reset-profile request. This allows them to reset persistent browser profiles, which includes stopping the browser, closing connections, and moving profile data to Trash. The issue is a residual incomplete fix following a prior advisory and is rated high severity with a CVSS score of 8.1. The vulnerability is fixed in OpenClaw version 2026.3.24.

The Openclaw CLI package versions up to 2026.3.24 contain a vulnerability where Microsoft Teams feedback invocation bypasses sender allowlists, allowing unauthorized senders to record session feedback. This issue was fixed in version 2026.3.25 by applying direct message and group authorization checks to feedback invokes.

A vulnerability in the openclaw CLI tool allowed conflicting tool identity hints from raw input and metadata to bypass dangerous-tool prompting, potentially enabling unsafe tool execution. This issue was fixed in version 2026.3.22 by enforcing a fail-closed behavior when conflicting tool identities are detected. The vulnerability has a medium severity with a CVSS score of 5.7.

A vulnerability in the openclaw CLI prior to version 2026.3.22 allows spoofed loopback hops in forwarding headers to bypass the gateway.trustedProxies origin detection. This can weaken downstream authentication and rate-limiting decisions that rely on accurate client origin identification. The issue is fixed in version 2026.3.22 and later.

The OpenClaw CLI has a vulnerability in its HTTP /sessions/:sessionKey/history route that allows bypassing the operator read scope check. This route authenticated bearer tokens but did not enforce the operator.read permission, unlike the WebSocket chat.history route. This flaw was fixed in version 2026.3.25 by requiring operator scopes and rejecting unauthorized history reads.

A vulnerability in the OpenClaw CLI image tool allowed bypass of the tools.fs.workspaceOnly filesystem boundary. This flaw enabled image-path resolution to traverse sandbox bridge mounts outside the designated workspace, potentially exposing files from mounted directories that other file tools would block. The issue affects openclaw versions prior to 2026.3.2 and was fixed in version 2026.3.2.

A vulnerability in the openclaw CLI allows Bonjour and DNS-SD TXT metadata to influence CLI routing even when service resolution fails. This means unresolved hints could steer the CLI to unintended targets. The issue affects openclaw versions prior to 2026.3.22. A fix was released in version 2026.3.22 and remains in subsequent versions.

A vulnerability in the openclaw CLI prior to version 2026.3.23 allowed callers with only operator.write privileges to reset admin sessions via the Gateway agent's /reset and /new RPC endpoints. This bypassed the intended operator.admin requirement enforced by the direct sessions.reset RPC. The issue was fixed in version 2026.3.23 by enforcing the operator.admin guard on these agent RPC calls.

A vulnerability in the openclaw-cli package (versions up to 2026.3.24) allows Telegram direct message (DM)-scoped inline button callbacks to bypass normal DM pairing authorization and mutate session state. This flaw was fixed in version 2026.3.25 by enforcing proper DM authorization for callback queries.

OpenClaw CLI versions prior to 2026.3.22 contain a vulnerability where leaf subagents can bypass controlScope restrictions to send messages to child sessions. This flaw allows subagents with narrower controlScope than 'children' to still perform send actions to controlled child sessions. The issue was fixed in version 2026.3.22 and remains resolved in subsequent releases.

A vulnerability in openclaw-cli versions from 2026.1.29 up to but not including 2026.3.28 allows non-admin operator scopes to self-claim the operator.admin scope via Gateway Backend Reconnect. This occurs because backend-labeled reconnects could bypass pairing and request broader scopes than authorized. The issue is fixed in version 2026.3.25 by requiring pairing when requested scopes exceed the approved baseline.