Threat database

OpenClaw CLI versions before 2026.3.31 have a vulnerability in the exec allowlist feature where shell init-file options like --rcfile, --init-file, and --startup-file could bypass allowlist checks. This allows an attacker to execute attacker-chosen initialization scripts despite the allowlist, but only when exec allowlist or allow-always behavior is enabled and the attacker can control the shell-wrapper command shape. The issue was fixed in version 2026.3.31.

OpenClaw CLI for macOS has a vulnerability where its Wide-Area Discovery component accepts arbitrary Tailnet peers as DNS authorities and can exfiltrate operator credentials. Exploitation requires the attacker to be on the same Tailnet, be a CA-trusted endpoint, and rely on user selection, resulting in a medium severity rating. The issue affects versions from 2026.1.29 up to but not including 2026.3.31. A patch is available in version 2026.3.31.

OpenClaw CLI versions up to 2026.3.28 have unauthenticated plugin-auth HTTP routes that receive operator runtime scopes, potentially allowing unauthorized access to privileged plugin runtime actions. This vulnerability has been assigned CVE-2026-41394 and is rated with a high severity CVSS score of 8.2. The issue is fixed in version 2026.3.31 and later.

OpenClaw CLI's Plivo V3 webhook replay key generation used the raw verification URL without sorting query parameters, allowing attackers to replay signed webhook events by reordering query parameters. This flaw was fixed in version 2026.3.28 by canonicalizing the replay key.

The OpenClaw CLI has a vulnerability where a workspace .env file can override the bundled plugin trust root. This issue affects versions from 2026.1.29 up to but not including 2026.3.31. The vulnerability is rated high severity with a CVSS score of 7.8. A fix is available starting from version 2026.3.31.

OpenClaw CLI's OpenShell Mirror Sync feature has a critical vulnerability (CVE-2026-41397) that allows sandbox escape via unrestricted file synchronization combined with symlink traversal. Versions of the openclaw package up to 2026.3.28 are affected. The issue involves a mirror-boundary bug that was partially addressed in commit c02ee8a3 but fully fixed in version 2026.3.31 with commit 3b9dab0. The vulnerability has a high CVSS score of 9.6, indicating critical severity.

OpenClaw CLI's gateway component allowed unlimited unauthenticated WebSocket upgrade requests before enforcing session limits, leading to a denial of service condition. This vulnerability could be exploited by an unauthenticated attacker to exhaust socket and worker resources, disrupting WebSocket availability for legitimate users. The issue affects versions from 2026.1.29 up to but not including 2026.3.28. A fix is available in version 2026.3.28 and later.

A vulnerability in the openclaw-cli package allows a Zalo webhook replay cache cross-target messageId scope bypass. This issue affects versions from 2026.1.29 up to but not including 2026.3.31. The vulnerability is considered medium severity with a CVSS score of 4.2. The problem is scoped to authenticated sibling-target delivery paths and does not allow arbitrary unauthenticated attackers to exploit it. A fix has been released in version 2026.3.31.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.31 contain an incomplete scope-clearing vulnerability in the trusted-proxy authentication mode. This flaw allows an attacker with limited privileges to escalate to operator.admin by retaining self-declared operator scopes on a real identity-bearing authentication path. The issue was fixed in version 2026.3.31. The vulnerability is rated with high severity based on the CVSS 4.0 vector provided.

OpenClaw CLI versions before 2026.3.31 have a vulnerability in the MS Teams webhook handling where the webhook parses the JSON body before validating the JWT token. This flaw allows unauthenticated attackers to cause resource exhaustion. The issue is fixed in version 2026.3.31 and later.

OpenClaw CLI versions up to 2026.3.28 have a vulnerability where Feishu thread history and quoted messages bypass the sender allowlist. This allows fetched quoted, root, or thread context to circumvent sender restrictions. The issue is fixed in version 2026.3.31 and later.

OpenClaw CLI versions before 2026.4.2 contained a timing side channel vulnerability in shared-secret comparison call sites. The issue arose because some code paths used early length-mismatch checks instead of a constant-time fixed-length comparison helper, leaking secret length information through timing differences. This vulnerability has low severity and does not directly allow authentication bypass. The flaw was fixed in version 2026.4.2 by reusing the shared secret comparison helper consistently.

OpenClaw CLI versions before 2026.4.20 contain a vulnerability in the assistant-media route where trusted-proxy callers were authenticated but the enforcement of operator scopes was missing. This allowed callers without the required operator.read scope to access assistant-media files and metadata within allowed media roots. The route still required gateway authentication and media-root checks, limiting the impact. The issue is fixed in version 2026.4.20.

OpenClaw CLI versions prior to 2026.4.20 contain a vulnerability where paired-device pairing actions were not restricted to the caller device. This allowed a paired device session with limited scope to enumerate global pairing states and act on pairing requests belonging to other devices within the same gateway. The issue is limited to same-gateway paired-device authorization and is not remotely exploitable without authentication. The vulnerability has been fixed in version 2026.4.20 by restricting pairing management actions to the caller device.

OpenClaw CLI versions up to 2026.4.1 have a vulnerability where the /allowlist endpoint does not enforce owner-only restrictions for cross-channel allowlist writes. This allows an authorized non-owner sender to attempt modifications to the allowlist of a different channel. The issue is fixed in version 2026.4.8.

A vulnerability in the openclaw npm package (versions >=2026.1.29 and <2026.4.8) allows Feishu document uploads to bypass the workspace-only filesystem policy. This enables reading of local files outside the intended restricted workspace boundary when processing docx upload blocks. The issue affects the OpenClaw local assistant under its trust model and does not assume multi-tenant service boundaries. The vulnerability has been patched in version 2026.4.8.

OpenClaw CLI versions up to 2026.4.7 contain a vulnerability that allows browser SSRF policy bypass via interaction-triggered navigation. This means that certain user interactions can cause navigations that circumvent the normal server-side request forgery (SSRF) navigation checks. The issue is specific to the OpenClaw trust model and does not assume multi-tenant service boundaries. The vulnerability has been fixed in version 2026.4.8.

OpenClaw CLI versions up to 2026.3.30 have a vulnerability where Git plumbing environment variables such as GIT_DIR were not removed from the execution environment denylist. This omission could allow redirection of Git operations within the local assistant context. The issue was fixed in version 2026.4.8.

OpenClaw CLI versions up to 2026.4.1 have a vulnerability where the resolvedAuth closure becomes stale after a configuration reload. This causes newly accepted gateway connections to potentially use outdated authentication state. The issue is specific to the OpenClaw trust model and does not involve multi-tenant service boundaries. A fix is available in version 2026.4.8.

OpenClaw CLI versions up to 2026.4.7 contain multiple code paths where base64 decoding operations do not properly enforce pre-allocation size limits. This can lead to allocation issues during base64 decoding. The vulnerability affects local user-controlled instances of OpenClaw and does not assume multi-tenant service boundaries. A patch fixing these issues is available in version 2026.4.8.