Threat database

OpenClaw CLI versions up to 2026.4.1 have a vulnerability where existing WebSocket sessions survive shared gateway token rotation. This means that rotating the shared gateway token does not disconnect existing WebSocket sessions that use the shared token, potentially allowing continued access despite token rotation. The issue is specific to the OpenClaw trust model and does not assume a multi-tenant environment. A fix is available in version 2026.4.8.

OpenClaw CLI versions up to 2026.4.7 have a vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles, bypassing the intended device role-upgrade pairing process. This flaw could result in tokens preserving or granting roles/scopes without proper approval. The issue affects the OpenClaw user-controlled local assistant and does not involve multi-tenant service boundaries. A patch is available in version 2026.4.8.

CVE-2026-42423 is a vulnerability in the openclaw-cli package where the strictInlineEval explicit-approval boundary can be bypassed due to an approval-timeout fallback on gateway and node execution hosts. This fallback allows inline eval commands that should require explicit approval to execute without it. The issue affects openclaw versions up to 2026.4.2 and was fixed in version 2026.4.8.

OpenClaw CLI versions up to 2026.4.4 have a vulnerability where shared reply MEDIA paths are treated as trusted, allowing cross-channel local file exfiltration. This means a crafted shared reply MEDIA reference could cause another channel to read local files as if they were trusted media. The issue is fixed in version 2026.4.8.

OpenClaw CLI versions up to 2026.4.7 contain a vulnerability where the node.pair.approve method is incorrectly scoped to operator.write instead of the more restrictive operator.pairing scope. This misconfiguration allows unprivileged users with operator.write permissions to approve pairings, potentially leading to unauthorized control over exec-capable nodes. The issue affects local user-controlled assistants and does not assume multi-tenant environments. A fix is available in version 2026.4.8.

OpenClaw CLI versions before 2026.4.8 have a vulnerability where certain build tool environment variables (HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS) were missing from the execution environment denylist. This omission allows hostile environment variables to influence host execution commands, leading to potential remote code execution (RCE). The issue is fixed in version 2026.4.8.

A strict browser SSRF bypass vulnerability exists in the Playwright redirect handling within the OpenClaw CLI tool. This flaw allows navigation requests to private network targets to bypass SSRF protections. The issue affects OpenClaw versions from 2026.1.29 up to but not including 2026.4.8. A fix has been released in version 2026.4.8.

OpenClaw CLI versions up to 2026.4.1 contain a vulnerability where the node.invoke(browser.proxy) function bypasses the browser.request persistent profile-mutation guard, allowing mutation of persistent browser profiles. This issue affects user-controlled local assistant scenarios and does not assume multi-tenant service boundaries. The vulnerability is patched in version 2026.4.8.

CVE-2026-42432 is a vulnerability in the openclaw-cli package where a previously paired node can reconnect and execute commands with elevated privileges, bypassing the operator.admin scope requirement. This allows the node to perform exec-capable commands without requiring operator/admin re-pairing. The issue affects versions up to 2026.4.5 and was fixed in version 2026.4.8.

A vulnerability in openclaw-cli versions before 2026.4.10 allowed operator.write message tools to access and mutate Matrix profile configuration persistence without requiring admin-level authority. This issue was fixed in version 2026.4.10 and later.

OpenClaw CLI versions 2026.4.7 through 2026.4.9 contain a vulnerability allowing sandboxed agents to bypass sandbox routing by overriding the host to 'node', enabling execution routing to a remote node instead of the sandbox. This flaw was fixed in version 2026.4.10 and later.

OpenClaw CLI versions from 2026.2.22 up to but not including 2026.4.12 have a vulnerability where shell-wrapper detection missed certain environment variable assignment injection forms in argv. This could affect execution semantics by allowing high-risk shell environment variables to be manipulated. The issue was fixed in version 2026.4.12 and later.

OpenClaw CLI versions prior to 2026.4.14 have a vulnerability where browser snapshot and screenshot routes may expose internal page content after navigation. Authenticated users could exploit this by accessing snapshot, screenshot, or tab routes that do not properly validate the final browser target, potentially revealing content from internal or restricted pages. This issue is fixed in version 2026.4.14.

A vulnerability in the openclaw-cli package versions 2026.4.9 up to but not including 2026.4.10 allows the voice-call realtime WebSocket to accept oversized frames. This can lead to a remote availability impact by potentially disrupting service. The issue is fixed in version 2026.4.10 and later.

OpenClaw CLI versions 2026.4.9 up to but not including 2026.4.10 contain a vulnerability where sender and group-scoped read policies can be bypassed in host media attachment reads. This allows an unauthorized sender to trigger host-local file reads that should have been denied by policy, potentially disclosing local files accessible by the OpenClaw process. The issue arises from a mismatch in policy enforcement between global/agent-level read access and sender/group-level restrictions. The vulnerability was fixed in version 2026.4.10.

A vulnerability in openclaw-cli versions before 2026.4.10 allows the browser tabs action select and close routes to bypass the configured SSRF policy. This weakness undermines tab-level navigation protections by permitting operations on targets without enforcing SSRF restrictions. The issue has been fixed in version 2026.4.10 and later.

OpenClaw CLI versions before 2026.4.14 have a vulnerability in the browser SSRF policy where private-network navigation is allowed by default. This behavior exposes internal services or metadata endpoints to browser-driven requests where stricter restrictions were expected. The issue was fixed in version 2026.4.14 by preserving strict SSRF configuration semantics and disabling private-network access unless explicitly enabled.

A vulnerability in openclaw-cli versions before 2026.4.14 allows an authenticated gateway client with config read access to bypass redaction and obtain unredacted secrets via sourceConfig and runtimeConfig aliases. These secrets include provider API keys, gateway authentication material, and channel credentials. The issue was fixed in version 2026.4.14 by explicitly overwriting these alias fields with redacted copies.

OpenClaw CLI versions prior to 2026.4.10 contain a time-of-check to time-of-use (TOCTOU) race condition in the exec script preflight validator. The validator first validates a script's pathname and then reads the script file by that pathname, allowing an attacker with write access to the workspace path to swap the file between validation and read. This can cause the preflight analysis to inspect a different file than the one originally validated. The impact is limited to derived preflight content exposure and requires local write access to the workspace path. The issue is fixed in version 2026.4.10 by replacing the check-then-read flow with an atomic pinned file descriptor open and read, ensuring the file identity is consistent during validation and reading.

A vulnerability in openclaw-cli allows a malicious workspace .env file to inject runtime-control variables. This can affect update sources, gateway URLs, ClawHub resolution, browser executable paths, and related behaviors. The issue is fixed in openclaw version 2026.4.9 and later.