OpenClaw CLI versions up to 2026.3.28 contain a path traversal vulnerability in the ACP dispatch component that allows reading arbitrary files outside intended directories. This issue arises because the attachment path is not properly restricted, enabling access beyond the guarded attachment-cache or root directories. The vulnerability is fixed in version 2026.3.31 and later.
A vulnerability in Openclaw CLI's OpenClaw Gateway allows a user with write permissions to reset sessions via the chat.send command, which should be restricted to admin-only operations. This flaw enables unauthorized session rotation and transcript archiving without admin privileges. The issue affects versions from 2026.1.29 up to but not including 2026.3.28. The vulnerability has been fixed in version 2026.3.28.
OpenClaw CLI versions before 2026.4.2 have a vulnerability where trailing-dot localhost CDP hosts (e.g., 'localhost.') bypass loopback-host normalization. This allows a remote CDP discovery response to redirect authenticated browser control to a localhost endpoint, weakening loopback protections and potentially exposing localhost browser state. The issue is fixed in version 2026.4.2.
OpenClaw CLI versions before 2026.3.31 contain an incomplete host environment security policy that allows an untrusted model to override compiler binaries via environment variables during approved host execution requests. This vulnerability requires an existing approved host-exec request within the trusted execution domain and is rated medium severity. The issue is fixed in version 2026.3.31.
OpenClaw CLI versions prior to 2026.3.31 perform Discord audio preflight transcription before member authorization, which can lead to resource consumption without proper access control. This issue has been assigned CVE-2026-41374 and is considered a medium severity vulnerability. The problem was fixed in version 2026.3.31.
The Openclaw CLI versions from 2026.1.29 up to but not including 2026.3.28 contain a vulnerability where the `/phone arm` and `/phone disarm` commands bypass the `operator.admin` scope check for external channels. This issue was fixed in version 2026.3.28. The vulnerability is classified with medium severity and has no known exploits in the wild.
OpenClaw CLI versions up to 2026.3.28 contain a vulnerability where the Matrix thread root and reply context bypass sender allowlists. This allows fetched thread-root or reply context to circumvent sender restrictions. The issue is fixed in version 2026.3.31 and later.
CVE-2026-41377 is a vulnerability in the openclaw-cli package where a security scan failure does not block plugin installation, resulting in a fail-open condition. This issue affects versions from 2026.1.29 up to but not including 2026.3.31. The vulnerability requires user interaction to install an untrusted package, and the scan failure is visible to the operator. The issue is rated as medium severity with a CVSS score of 4.6. A fix is available in version 2026.3.31 and later.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.31 contain a vulnerability where a paired node with the role 'node' can escalate privileges to execute code on the gateway via unrestricted node.event agent dispatch. This requires a trusted paired node foothold, limiting the criticality. The issue is fixed in version 2026.3.31.
OpenClaw CLI versions up to 2026.3.24 contain a vulnerability where the allow-always persistence mechanism over-trusts positional wrapper carrier executables instead of the actual target executable. This can cause a broader execution allowlist entry than intended, weakening execution approval boundaries. The issue is fixed in version 2026.3.28.
The OpenClaw CLI package contains a vulnerability where the Discord voice manager bypasses the channel-level member access allowlist. This access-control bug allows Discord voice ingress before proper channel allowlist authorization is enforced. The issue affects versions from 2026.1.29 up to but not including 2026.3.31. The vulnerability has been fixed in version 2026.3.31.
OpenClaw CLI versions prior to 2026.3.31 contain a vulnerability (CVE-2026-41382) that allows bypassing Discord voice ingress authorization due to gaps in channel, name, and stale-role validation. This issue permits bypassing channel/member allowlists but does not result in a broader critical authentication break. The vulnerability has been patched in version 2026.3.31.
OpenClaw CLI versions prior to 2026.4.2 contain a vulnerability in the OpenShell mirror backend where arbitrary absolute remote directory paths could be specified for cleanup and overwrite operations. This flaw allows an attacker who can influence these configuration values to cause deletion of unintended remote directories and replace their contents with workspace data. The issue is fixed in version 2026.4.2.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.24 contain a high-severity vulnerability (CVE-2026-41384) involving environment variable injection via workspace configuration. This issue is an incomplete fix of a previous vulnerability (CVE-2026-4039) and allows malicious workspace configurations to inject environment variables into the CLI backend runner. The vulnerability is fixed starting with version 2026.3.24.
OpenClaw CLI versions before 2026.3.31 have a vulnerability where the Nostr privateKey is stored as a plain string and can be leaked via the config.get method, bypassing intended redaction. This exposure allows an attacker with access to configuration views to obtain the plaintext signing key. The issue is fixed in version 2026.3.31.
OpenClaw CLI versions up to 2026.3.13-1 contain a vulnerability where bootstrap setup codes are not properly bound to device roles and scopes. This flaw allows privilege escalation during the initial pairing process. The issue is fixed in versions 2026.3.22 and later. The vulnerability has a critical severity with a CVSS score of 9.8.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.24 have an incomplete sanitization of host environment variables related to package-manager overrides. This flaw allows an attacker to redirect package resolution or runtime bootstrap processes to malicious infrastructure, potentially executing trojanized content. The vulnerability is fixed in version 2026.3.22 and later.
OpenClaw CLI versions from 2026.4.7 up to but not including 2026.4.15 contain a vulnerability in the webchat media embedding feature. This flaw allows crafted tool-result media references to bypass local-root containment policies, potentially causing the host to read local files or access Windows UNC/network paths. The vulnerability could lead to disclosure of host files or exposure of network credentials on Windows systems. The issue is mitigated in version 2026.4.15 by rejecting remote-host file URLs and network paths before filesystem access and enforcing local-root containment.
OpenClaw CLI versions up to 2026.3.24 contain a vulnerability where the allow-always persistence mechanism does not unwrap wrapper binaries like /usr/bin/script before storing trust decisions. This allows a user approval for one wrapped command to persist trust for the wrapper binary, which could later execute a different underlying program without additional user approval. The issue is fixed in version 2026.3.28.
The OpenClaw CLI tool has a vulnerability where the environment variables PIP_INDEX_URL and UV_INDEX_URL can bypass host execution environment sanitization, allowing redirection of Python package-index traffic. This issue affects versions from 2026.1.29 up to but not including 2026.3.31. The vulnerability has been assigned CVE-2026-41391 and is rated with medium severity. A fix is available in version 2026.3.31 and later.