A vulnerability in the openclaw CLI allows an endpoint discovered during remote onboarding to persist even after the trust is declined by the operator. This results in gateway credentials being routed to the attacker-discovered endpoint if the operator accepts the prefilled prompt. The issue affects versions prior to 2026.3.31 and has been fixed in version 2026.3.31.
OpenClaw CLI versions from 2026.3.24 up to but not including 2026.3.31 have a vulnerability in the Nostr DM ingress path where forged direct messages could create a pairing state before signature verification. This could allow an unauthenticated remote sender to consume shared pairing capacity and trigger limited relay or logging activity. The issue does not allow message decryption, pairing approval, or broader authorization bypass. The vulnerability was fixed in version 2026.3.31 and later.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.31 contain a Server-Side Request Forgery (SSRF) vulnerability due to an unguarded fetch() function used in the Marketplace Plugin Download and Ollama Model Discovery features. This vulnerability has been assigned CVE-2026-41302 and has a medium severity with a CVSS score of 6.3. The issue was fixed in version 2026.3.31. The Ollama-related SSRF is considered less critical due to operator configuration and overlapping weaker trust models. No known exploits are reported in the wild.
A vulnerability in openclaw-cli allowed Discord text approval commands to bypass the configured approver allowlist, enabling non-approved users to resolve pending execution approvals. This flaw affected versions from 2026.1.29 up to but not including 2026.3.28. The issue was fixed in version 2026.3.28 by enforcing approver checks for text approvals.
A critical vulnerability in the openclaw-cli package (CVE-2026-41329) allows a sandbox bypass via heartbeat context inheritance using senderIsOwner escalation. Versions from 2026.1.29 up to but not including 2026.3.31 are affected. The issue has been fixed in version 2026.3.31. The vulnerability enables an attacker with limited privileges to escalate permissions and bypass sandbox restrictions.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.31 have a vulnerability where host execution environment overrides do not apply proxy, TLS, Docker, and Git TLS controls. This issue was fixed in version 2026.3.31. The vulnerability has a medium severity rating with a CVSS score of 4.4.
A vulnerability in the openclaw-cli package allows unauthorized Telegram group senders to trigger audio preflight transcription, causing resource consumption. The issue affects versions from 2026.1.29 up to but not including 2026.3.31. The impact is limited to resource or billing consumption without direct data exposure or host compromise. A patch is available in version 2026.3.31.
OpenClaw CLI versions up to 2026.3.24 did not block the environment variables GIT_TEMPLATE_DIR and AWS_CONFIG_FILE in its host execution environment sanitization. These variables can redirect trusted tools like git and AWS CLI to attacker-controlled content, potentially allowing execution of untrusted code or loading of attacker-selected credentials. The issue is fixed in version 2026.3.28 and later.
CVE-2026-41333 is a low severity vulnerability in the openclaw-cli package where a fake DeviceToken can bypass shared authentication rate limiting. This affects versions from 2026.1.29 up to but not including 2026.3.31. The issue primarily impacts deployments using weak shared passwords, while strong shared tokens remain resistant to brute force attacks. The vulnerability has been fixed in version 2026.3.31.
The OpenClaw CLI image pixel-limit guard can fail to enforce limits on the sips command, allowing decompression-bomb denial-of-service (DoS) attacks. This vulnerability affects openclaw versions from 2026.1.29 up to but not including 2026.3.31. The issue was fixed in version 2026.3.31. The flaw allows attackers to cause an availability impact by processing images with oversized pixel counts that bypass the guard.
OpenClaw CLI versions prior to 2026.3.31 contain an information disclosure vulnerability in the Gateway Control Interface. This vulnerability allows exposure of version information and assistant agent IDs via the Control UI bootstrap JSON. The issue is considered low severity as it primarily enables fingerprinting or limited information disclosure. The vulnerability was fixed in version 2026.3.31 by trimming the exposed payload.
CVE-2026-41337 is a vulnerability in the openclaw-cli package where a voice-call Plivo replay can mutate the in-process callback origin before the replay is rejected. This issue affects versions from 2026.1.29 up to but not including 2026.3.31. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 2026.3.31 and later.
OpenClaw CLI versions prior to 2026.3.31 have a sandbox file operation vulnerability where check-then-act logic bypasses file descriptor-based TOCTOU (Time-Of-Check to Time-Of-Use) defenses. This issue affects workspace-only apply_patch, remove, and mkdir operations within the sandbox workspace mutation boundary. The vulnerability is addressed in version 2026.3.31 and later.
A vulnerability in the openclaw-cli package (CVE-2026-41340) involves a legacy Telegram 'allowFrom' migration that improperly extends default-account trust to all named accounts. This is an authentication boundary issue classified with low severity. Versions prior to 2026.3.31 are affected, with the issue fixed in version 2026.3.31.
A vulnerability in the Openclaw CLI component interaction misclassifies Group Direct Messages (DMs) as Direct Messages, affecting policy or session handling. This issue is present in versions from 2026.1.29 up to but not including 2026.3.31. The vulnerability has a medium severity with a CVSS score of 5.4. A fix has been released in version 2026.3.31.
The OpenClaw CLI's LINE webhook handler in versions before 2026.3.31 lacks a shared pre-authentication concurrency budget before signature verification. This flaw can cause transient availability loss but does not impact confidentiality or integrity. The vulnerability has been assigned CVE-2026-41343 with a medium severity rating and a CVSS score of 5.3. A patch is available in version 2026.3.31 and later.
A vulnerability in openclaw-cli allows write-scoped authorized users to persist verbose output session overrides via the chat.send path, which should be restricted to admin-only access through sessions.patch. This could lead to unintended exposure of verbose output or tool reasoning beyond intended operator limits. The issue affects versions from 2026.1.29 up to but not including 2026.3.28. The vulnerability is fixed in version 2026.3.28.
OpenClaw CLI versions up to 2026.3.28 have a vulnerability where media downloads follow cross-origin redirects while retaining Authorization headers. This behavior can lead to credential leakage across origins. The issue is classified with medium severity and has been fixed in version 2026.3.31.
OpenClaw CLI versions from 2026.2.26 up to but not including 2026.3.31 enforced pending pairing-request caps per channel file rather than per account. This caused a denial of service condition where requests from one account could exhaust the shared pending window, blocking new pairing challenges on other accounts within the same multi-account channel. The issue impacts availability only and does not allow unauthorized access or cross-account approvals. The vulnerability was fixed in version 2026.3.31.
OpenClaw CLI versions prior to 2026.3.31 have a vulnerability where HTTP operator endpoints do not validate browser-origin headers in trusted-proxy mode. This can lead to a cross-site request forgery (CSRF) or browser-origin validation gap. The issue is considered medium severity by the maintainer but is rated high based on CVSS 3.1 scoring. The vulnerability depends on deployments using identity-bearing trusted-proxy browsers rather than shared-secret HTTP operator models. A fix is available in version 2026.3.31 and later.