A vulnerability in the openclaw-cli package (versions up to 2026.3.24) allows Feishu raw card send surface to mint legacy card callbacks that bypass DM pairing, enabling unpaired recipients to reach callback handling. This issue was fixed in version 2026.3.25 by rejecting legacy raw-card command payloads to enforce normal paired callback paths.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.24 contain an incomplete fix for CVE-2026-32011. The Feishu webhook handler still accepts large request bodies (up to 1MB) with a long timeout (30 seconds) before verifying the webhook signature, allowing unauthenticated attackers to perform slow-body denial-of-service attacks by exhausting server connection resources. The issue was fixed in OpenClaw 2026.3.24 by tightening pre-auth body parsing limits. The vulnerability has a medium severity with a CVSS score of 5.3 and no known exploits in the wild.
OpenClaw CLI versions prior to 2026.3.22 contain a vulnerability where the system.run allowlist can be bypassed by using an unregistered time dispatch wrapper. This occurs because the allow-always exec approvals did not unwrap /usr/bin/time, allowing an attacker to reuse approval state for the inner command. The issue is fixed in version 2026.3.22 and later.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.24 contain a path traversal vulnerability that allows sandboxed agents to bypass sandbox restrictions and read arbitrary files from other agents' workspaces. This occurs because the `mediaUrl` and `fileUrl` parameter keys are not validated by the sandbox enforcement function, and the dispatch context omits necessary root path restrictions. The vulnerability is fixed in version 2026.3.24.
A vulnerability in the OpenClaw CLI gateway plugin HTTP authentication allowed any caller to receive an unrestricted operator.admin runtime scope. This issue affected versions up to 2026.3.24 and was fixed in version 2026.3.25 by restricting runtime scopes to the least privilege and preserving caller scope boundaries.
A vulnerability in the OpenClaw CLI's Synology Chat integration allows reply delivery to be rebound through username-based user resolution instead of the stable numeric user_id. This issue affects versions prior to 2026.3.22 and was fixed in version 2026.3.22. The fix ensures replies remain bound to the stable webhook user identifier unless an explicit opt-in for username rebinding is enabled.
A vulnerability in OpenClaw CLI's browser debug/export routes allows reuse of already-open blocked private-network tabs without enforcing the expected SSRF policy. This could lead to unauthorized export or inspection of content that should be protected by browser network policies. The issue affects versions from 2026.1.29 up to but not including 2026.4.29. A fix is available starting with version 2026.4.29. Mitigations include closing blocked tabs before using debug/export features and restricting access to browser debug routes until patched.
A vulnerability in openclaw-cli allows scoped Gateway clients with operator.write scope to bypass admin command scope gates via inherited external chat.send routes. This enables execution of commands requiring higher privileges such as operator.approvals or operator.admin. The issue affects versions from 2026.1.29 up to but not including 2026.5.18. A patch is available in version 2026.5.18. Until upgraded, avoid granting operator.write tokens to clients that can deliver commands into sessions with external routes unless fully trusted.
OpenClaw CLI contains a path traversal vulnerability in its canvas tool's a2ui_push action, allowing authenticated users to read arbitrary files on the gateway filesystem. The vulnerability arises because the jsonlPath parameter is used directly in a file read operation without any path validation or restriction. This can lead to sensitive information disclosure, such as reading system files or credentials. A proof-of-concept demonstrates reading /etc/passwd and exfiltrating its contents to a connected node client. A patch is available for this issue.
CVE-2026-3690 is an authentication bypass vulnerability in OpenClaw CLI's canvas endpoints. The vulnerability arises because the OpenClaw gateway grants access to canvas endpoints based solely on the client's private IP address if any WebSocket client from the same IP is authenticated. This allows unauthenticated attackers sharing the same private IP (e.g., behind NAT or in containerized environments) to access canvas resources without their own authentication token. The issue affects OpenClaw versions prior to 2026.7.1 and has a CVSS score of 7.4 (high severity). A patch is available to address this vulnerability.
The OpenClaw macOS app beta onboarding flow exposed the OAuth PKCE code_verifier value via the OAuth state parameter in the front-channel URL. This vulnerability affected OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.25. The issue was limited to the macOS beta onboarding OAuth path and did not affect the core CLI or gateway onboarding paths. The exposure could allow an attacker to obtain sensitive OAuth authorization artifacts if they intercepted the state parameter during the flow. The vulnerability has been patched by removing Anthropic OAuth sign-in from the macOS onboarding flow and replacing it with a setup-token-only authentication method. The fix is available starting with version 2026.2.25.
The OpenClaw CLI vulnerability (CVE-2026-40037) involves the `fetchWithSsrFGuard` function replaying unsafe request bodies across cross-origin redirects. This could cause guarded fetch operations to resend unsafe request bodies or headers when following redirects to different origins. The issue affects the openclaw npm package versions from 2026.1.29 up to but not including 2026.4.8. A patch is available in version 2026.4.8 that fixes this behavior.
OpenClaw CLI versions up to 2026.4.1 on Android accepted cleartext ws:// remote gateway endpoints and sent stored gateway credentials over these unencrypted connections. This vulnerability allows an attacker to obtain stored credentials if a user connects to a maliciously crafted discovery beacon or setup code that directs the client to a cleartext remote endpoint. The issue is fixed in version 2026.4.2 by requiring TLS for remote Android gateway endpoints.
The OpenClaw CLI had a vulnerability in the applySkillConfigEnvOverrides function where environment variables from skill configurations were copied into the host process environment without proper safety checks. This allowed injection of dangerous process-level variables like NODE_OPTIONS, potentially affecting runtime and child process behavior. The vulnerability requires an attacker to have the ability to modify local OpenClaw configuration files. A fix was released in version 2026.2.21 that sanitizes these environment overrides and blocks dangerous keys.
CVE-2026-4040 is an information disclosure vulnerability in the OpenClaw CLI's safeBins file-existence oracle. The vulnerability allowed attackers to infer the presence of files on the host filesystem by observing differences in command allow/deny behavior based on file existence. This could enable filesystem enumeration and aid in planning further attacks. The issue affects openclaw versions up to and including 2026.2.17. A patch is available in version 2026.2.18 that changes the safe-bin validation to avoid file-existence checks and blocks file-oriented flags in safe-bin mode.
OpenClaw CLI versions up to 2026.3.24 have a vulnerability where the current working directory's .env file is loaded before the trusted configuration directory. This allows an attacker with control over the workspace to inject environment variables that override runtime configuration and security-sensitive settings. The issue is fixed in version 2026.3.28 and later.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.31 contain a critical sandbox escape vulnerability due to a time-of-check to time-of-use (TOCTOU) race condition in the remote filesystem bridge's readFile operation. This flaw allows an attacker with limited privileges to bypass sandbox restrictions, potentially leading to full compromise of the sandboxed environment. The vulnerability is fixed starting with version 2026.3.31.
OpenClaw CLI versions prior to 2026.3.31 contain a vulnerability where the marketplace plugin download functionality follows redirects without Server-Side Request Forgery (SSRF) protection. This flaw allows an attacker with limited privileges to cause the application to make unintended network requests, potentially leading to high confidentiality impact and partial integrity impact. The issue is fixed in version 2026.3.31.
OpenClaw CLI versions up to 2026.4.1 contain an authorization vulnerability where read-scoped identity-bearing HTTP clients could terminate active sessions via the POST /sessions/:sessionKey/kill endpoint. This flaw allows a caller with only read permissions to perform a write-class operation, disrupting delegated work. The issue is fixed in version 2026.4.2 by enforcing proper HTTP scope checks on session termination requests.
OpenClaw CLI had a vulnerability in its chat.send gateway where ACP-only provenance fields were controlled by self-declared client metadata from the WebSocket handshake instead of verified authorization. This allowed authenticated operator clients to spoof ACP identity labels and inject reserved provenance fields meant only for the ACP bridge. The issue was fixed in version 2026.3.28.