OpenClaw CLI versions up to 2026.3.28 have a vulnerability where Discord slash commands bypass the group DM channel allowlist. This allows authorized Discord users to circumvent channel restrictions within group DMs. The issue is limited in scope and does not cross stronger trust boundaries. The vulnerability is rated medium severity with a CVSS score of 5.4. A patch is available in version 2026.3.31 and later.
A high-severity vulnerability (CVE-2026-41349) in the openclaw-cli package allows a large language model (LLM) agent to bypass agentic consent by silently disabling execution approval via the config.patch mechanism. This issue affects versions from 2026.1.29 up to but not including 2026.3.28. The vulnerability has been fixed in version 2026.3.28 and later.
The Openclaw CLI has a vulnerability (CVE-2026-41350) where the `session_status` command bypasses the configured `tools.sessions.visibility` setting for unsandboxed invocations. This issue affects versions prior to 2026.3.31 and allows a same-agent session-policy bypass but does not break host boundaries. The vulnerability has been patched in version 2026.3.31.
CVE-2026-41352 is a high-severity vulnerability in the openclaw-cli npm package where a device-paired node can bypass the node scope gate, potentially leading to remote code execution on the host. The issue affects versions from 2026.1.29 up to but not including 2026.3.31. The vulnerability requires device pairing or setup prerequisites but allows exposure of node commands without full node pairing. A fix was introduced in version 2026.3.31.
A vulnerability in the Openclaw CLI node browser proxy allows bypassing the `allowProfiles` restriction through persistent profile mutation and runtime profile selection. This issue affects versions prior to 2026.3.22 and has been fixed in version 2026.3.22 and later. The vulnerability is rated with high severity and involves privilege escalation with low attack complexity and no user interaction required.
OpenClaw CLI versions prior to 2026.4.2 have a vulnerability in the Zalo webhook replay deduplication mechanism. The dedupe keys were not sufficiently scoped across chat and sender dimensions, causing legitimate events from different conversations or senders to be incorrectly identified as duplicates and dropped. This results in silent message suppression and can disrupt bot workflows by causing availability issues in webhook event processing. The issue is fixed in version 2026.4.2.
The OpenClaw CLI has a vulnerability where the gateway command `device.token.rotate` does not terminate active WebSocket sessions after device tokens are rotated. This creates a post-compromise revocation gap, allowing existing authenticated WebSocket sessions to remain active despite credential rotation. The issue affects versions from 2026.1.29 up to but not including 2026.3.31. The vulnerability has a medium severity with a CVSS score of 5.4. A fix has been released in version 2026.3.31.
OpenClaw CLI versions prior to 2026.3.31 have a vulnerability where SSH-based sandbox backends pass unsanitized environment variables (process.env) to child processes. This can lead to local environment variable leakage in SSH child processes. Remote leakage requires non-default SSH environment forwarding, which is not common, so the severity is considered low. The issue is fixed in version 2026.3.31.
OpenClaw CLI versions prior to 2026.4.2 did not properly filter Slack thread context by the sender allowlist, allowing messages from non-allowlisted senders to be included in the agent context if an allowlisted user replied in the same thread. This vulnerability is a sender-access-control bypass affecting Slack thread context retrieval, not a direct channel authentication bypass. The issue is fixed in version 2026.4.2.
An authenticated user with operator.write privileges in the openclaw-cli package can escalate access to admin-level Telegram configuration and cron persistence settings via the send functionality. This vulnerability affects versions from 2026.1.29 up to but not including 2026.3.28. The issue has been addressed in version 2026.3.28 and later. The severity is rated as medium by maintainers, though the CVSS score is 7.1 (high).
OpenClaw CLI versions before 2026.4.2 have an approval-integrity vulnerability in the pnpm dlx command. The issue allows a local script approved via pnpm dlx to be replaced before execution without invalidating the approval, potentially enabling execution of modified script contents. This flaw affects versions from 2026.1.29 up to but not including 2026.4.2. The vulnerability is fixed in version 2026.4.2.
OpenClaw CLI had a Server-Side Request Forgery (SSRF) guard that incorrectly treated several IPv6 special-use address ranges as public, allowing requests to these normally restricted addresses. This could enable an attacker controlling a fetched URL to target internal or non-routable IPv6 addresses that should have been blocked. The issue was fixed in version 2026.3.28.
OpenClaw CLI versions from 2026.2.19 up to but not including 2026.3.31 have a vulnerability in the Zalo webhook replay-dedupe cache. The cache was shared too broadly across authenticated webhook targets in multi-account deployments, allowing a replay event on one account to suppress legitimate events on another account if event_name and message_id matched. This issue affects availability but does not allow cross-account authentication or data access. The vulnerability was fixed in version 2026.3.31 with further hardening in 2026.4.1.
A vulnerability in the Openclaw CLI's Feishu extension allows bypassing the configured localRoots sandbox during file upload path resolution. This flaw enables a caller restricted to workspace or localRoots paths to read arbitrary files on the host system via Feishu upload actions. The issue affects versions from 2026.2.6 through 2026.3.24 and is fixed in version 2026.3.28.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.31 contain a vulnerability in the SSH sandbox tar upload functionality. This vulnerability allows the upload process to follow symbolic links, enabling an attacker with SSH access to write arbitrary files on the remote host. The issue was fixed in version 2026.3.31 with a commit that added pre-upload symlink escape rejection. The vulnerability has a high severity rating with a CVSS score of 8.1.
OpenClaw CLI versions up to 2026.3.28 have a vulnerability where Microsoft Teams thread history accessed via the Graph API bypasses sender allowlists. This issue allows thread history to be fetched without proper sender filtering. The vulnerability is fixed in version 2026.3.31.
OpenClaw CLI versions before 2026.3.31 contain a vulnerability in the appendLocalMediaParentRoots function that allows self-whitelisting of media parent directories. This flaw enables model-initiated arbitrary file reads on the host and potential credential exfiltration, but only if the configuration already permits tool filesystem root expansion, narrowing the impact. The issue is patched in version 2026.3.31 and later.
OpenClaw CLI's Discord component interaction ingress failed to consistently enforce guild and channel policies that normally apply to inbound messages. This allowed users to trigger privileged component actions in contexts that should have been blocked by Discord channel policy. The vulnerability affects versions from 2026.2.14 up to but not including 2026.3.28. The issue was fixed in version 2026.3.28 by applying the correct policy gates to component interactions.
A vulnerability in openclaw-cli's jq safe-bin policy allowed environment variable disclosure via the $ENV filter, bypassing restrictions intended to block explicit env usage. This could expose sensitive environment data through operator-approved jq commands. The issue affects versions from 2026.1.29 up to but not including 2026.3.28. The vulnerability is fixed in version 2026.3.28.
OpenClaw CLI versions before 2026.3.31 have a vulnerability where the host execution environment sanitization does not properly exclude certain environment variables related to package, registry, Docker, compiler, and TLS overrides. This issue can lead to unintended exposure of sensitive environment variables during execution. The vulnerability has a medium severity rating and is fixed in version 2026.3.31.