Threat database

A vulnerability in openclaw-cli versions 2026.4.7 through 2026.4.9 allows Discord event cover images to bypass sandbox media normalization. This flaw permits host-local media references to reach a channel action path that expects normalized media, potentially exposing sensitive local media. The issue is fixed in version 2026.4.10 and later.

A vulnerability in the openclaw CLI's QQBot media tags allows reading arbitrary local files via reply text. This occurs because outbound media tags can reference local file paths outside the intended media storage boundary, leading to local file disclosure. The issue affects openclaw versions before 2026.4.10 and was fixed in version 2026.4.10 and later.

Openclaw CLI versions before 2026.4.10 contain a vulnerability where agent hook events can enqueue trusted system events from unsanitized external input. This allows untrusted input to be treated as higher-trust context within the agent. The issue is fixed in version 2026.4.10 and later.

A vulnerability in openclaw-cli versions before 2026.4.14 allows collect-mode queue batches to reuse the last sender's authorization context. This causes messages from different senders to be processed with the authorization context of the final sender in the batch, potentially granting earlier messages elevated privileges. The issue is fixed in version 2026.4.14 by ensuring batches are split by sender authorization context before dispatch.

Openclaw CLI versions from 2026.4.7 up to but not including 2026.4.14 contain a vulnerability where the heartbeat owner downgrade logic fails to properly handle untrusted webhook wake events. This flaw allows the preservation of an owner-like execution context when it should have been downgraded, potentially leading to unauthorized elevated privileges during webhook processing. The issue is fixed in version 2026.4.14.

A vulnerability in the openclaw CLI tool allowed the screen_record feature's output path (outPath) to bypass the workspace-only filesystem guard. This flaw permitted an authorized tool call to write files outside the intended workspace boundary. The issue affects openclaw versions prior to 2026.4.10 and was fixed in version 2026.4.10 and later.

A vulnerability in openclaw-cli versions 2026.4.7 through 2026.4.9 allows write-scoped operator commands to modify persistent memory dreaming configuration settings, which should require admin privileges. This issue was fixed in version 2026.4.10.

A vulnerability in openclaw-cli versions before 2026.4.9 allows non-interactive onboarding to auto-enable untrusted workspace provider plugins due to auth choice selection. This could lead to untrusted plugins being enabled without explicit user consent. The issue is fixed in version 2026.4.9 and later.

OpenClaw CLI versions before 2026.4.10 have a vulnerability where channel setup catalog lookups could include untrusted workspace plugin shadows. This can cause setup-time plugin loading without the intended trust gate, potentially leading to high impact on confidentiality, integrity, and availability. The issue is fixed in version 2026.4.10 and later.

A vulnerability in the openclaw CLI package affects Microsoft Teams SSO invoke handler, which missed sender authorization checks. This flaw allows processing of SSO signin invokes from senders without applying the usual allowlist checks. Versions from 2026.4.10 up to but not including 2026.4.14 are affected. The issue was fixed in version 2026.4.14 by routing SSO invoke handling through the proper Teams sender authorization path and adding coverage for denied senders. Users should upgrade to version 2026.4.14 or later to remediate this vulnerability.

A vulnerability in the openclaw-cli package versions from 2026.2.21 up to but not including 2026.4.10 allows unauthenticated access to the sandbox noVNC helper route, exposing interactive browser session credentials. This issue was fixed in version 2026.4.10 by requiring bridge authentication for access to this route.

Openclaw CLI versions before 2026.4.5 have a vulnerability where the Chrome DevTools Protocol (CDP) /json/version WebSocket URL can redirect to untrusted hosts, allowing a second-hop SSRF-style pivot. This could cause a browser profile to trust a malicious WebSocket URL pointing to a different host. The issue is fixed in version 2026.4.5 and later.

OpenClaw CLI versions before 2026.4.9 contain a vulnerability where browser interaction routes can pivot into the local Chrome DevTools Protocol (CDP) origin, allowing unauthorized creation or reading of local file:// pages despite navigation guards. This issue was fixed in version 2026.4.9 and later.

A vulnerability in openclaw-cli versions 2026.3.31 up to but not including 2026.4.10 allows local async execution completion events to be missed by the heartbeat owner downgrade detection. This can result in a process continuing to run with higher privileges than intended after processing untrusted completion content. The issue is fixed in version 2026.4.10 and later.

A vulnerability in the Openclaw CLI Nostr plugin allowed profile mutation routes to persist profile configuration without requiring admin authority. This issue affects versions prior to 2026.4.10 and was fixed by enforcing the operator.admin scope for these routes. Users should upgrade to version 2026.4.10 or later to mitigate this vulnerability.

OpenClaw CLI versions before 2026.4.10 have a vulnerability where certain browser press/type interaction routes lack complete navigation guard coverage. This flaw allows some interactions to trigger navigation without fully enforcing the server-side request forgery (SSRF) policy. The issue was fixed in version 2026.4.10 and later.

OpenClaw CLI versions prior to 2026.4.10 contain a vulnerability where browser SSRF hostname validation can be bypassed via DNS rebinding. This allows the browser navigation policy to incorrectly validate hostnames or IP addresses, potentially enabling SSRF pivots. The issue was fixed in version 2026.4.10 and later.

A vulnerability in openclaw-cli versions 2026.4.10 through 2026.4.13 allows delivery queue recovery to lose group tool-policy context for media replay. This can cause recovered outbound media to be replayed without enforcing the original session's group tool policy, weakening channel media restrictions after a restart or recovery. The issue is fixed in version 2026.4.14.

A vulnerability in openclaw-cli versions before 2026.4.10 allows operator-supplied environment variables related to interpreter startup to bypass the exec environment denylist. This can influence downstream execution or network behavior. The issue is fixed in version 2026.4.10 and later.

OpenClaw CLI versions prior to 2026.4.15 have a vulnerability where the gateway HTTP and WebSocket handlers cache bearer token authentication at startup. After a SecretRef rotation intended to revoke old tokens, the gateway could continue accepting the old bearer token until the process is restarted. This allows an old token to remain valid longer than intended, posing a high security risk. The issue is fixed in version 2026.4.15 by re-resolving bearer authentication from the current runtime secret snapshot on each request and WebSocket upgrade.