OpenClaw CLI versions prior to 2026.4.15 have a critical vulnerability in Feishu webhook and card-action validation. The vulnerability allows unauthenticated webhook or card-action traffic to reach command dispatch due to fail-open validation paths when the encryptKey configuration is missing or when blank card-action callback tokens are accepted. The issue is fixed in version 2026.4.15, which enforces fail-closed validation, rejects invalid signatures, and refuses to start webhook mode without an encryptKey.
A vulnerability in OpenClaw CLI's QMD backend allowed reading arbitrary Markdown files within the workspace root, bypassing intended memory-path restrictions. This issue affected versions prior to 2026.4.15 and was fixed in that release by restricting reads to canonical or indexed QMD workspace paths only. Exploitation requires access to the memory tool interface and is limited to workspace Markdown files, resulting in a low severity impact.
Openclaw CLI versions up to 2026.4.21 contain a vulnerability where OpenShell filesystem bridge writes can be redirected outside the sandbox mount root due to a time-of-check/time-of-use (TOCTOU) race condition involving symlink swaps. This could allow unauthorized modification of files outside the intended sandbox. The issue is fixed in version 2026.4.22 by validating write paths against the mount root and rejecting unsafe symlinks.
CVE-2026-44113 is a medium severity vulnerability in the openclaw npm package (openclaw-cli) affecting versions from 2026.1.29 up to but not including 2026.4.22. It involves a time-of-check/time-of-use (TOCTOU) race condition in the OpenShell sandbox filesystem reads, where a symlink swap could allow reading bytes outside the intended mount root. The issue is fixed in version 2026.4.22 by enforcing no-follow semantics on file opens, validating file descriptors against the canonical mount root, rejecting unsafe hardlink/symlink cases, and using strict ancestor walks on platforms lacking fd-path readback. The fix is publicly available and verified in the npm package.
OpenClaw CLI versions before 2026.4.20 have a vulnerability where workspace .env files can override runtime-control environment variables prefixed with OPENCLAW_. This allows a malicious workspace to influence trusted OpenClaw runtime behavior by setting variables like OPENCLAW_GIT_DIR. The issue requires running OpenClaw from an attacker-controlled workspace. The vulnerability is rated with a CVSS score of 7.8 (high severity) and has been fixed in version 2026.4.20 by reserving the OPENCLAW_ namespace and rejecting conflicting dotenv entries.
OpenClaw CLI versions up to 2026.4.21 have a vulnerability where the exec allowlist analysis fails to reject shell expansions in unquoted heredocs. This flaw allows an approved command to appear safe while the shell evaluates potentially unsafe expansions at runtime. The issue is fixed in version 2026.4.22 by enhancing the exec command analyzer to properly track heredoc bodies and reject unquoted expansions.
OpenClaw CLI versions before 2026.4.20 contain a vulnerability in the QQBot direct media upload feature where attacker-controlled image URLs bypass SSRF validation. This flaw allows unintended forwarding of media delivery request URLs, but it is limited to outbound QQBot media handling and does not expose arbitrary local files. The issue is rated as medium severity and has been fixed in version 2026.4.20.
A vulnerability in openclaw-cli versions up to 2026.4.21 allows a non-owner loopback client to spoof owner context metadata via request headers. This could enable unauthorized access to owner-gated operations. The issue is fixed in version 2026.4.22 by issuing separate bearer tokens for owner and non-owner contexts and no longer trusting the spoofable sender-owner header.
OpenClaw CLI versions up to 2026.4.20 have a vulnerability where owner-enforced slash commands could be executed by non-owner senders if the channel plugin allowed wildcard inbound senders and no explicit owner allowance was configured. This flaw affects the authorization logic for commands such as /send, /config, and /debug, potentially allowing unauthorized command execution on affected channels. The issue does not grant broader administrative or host access. The vulnerability is fixed in version 2026.4.21.
OpenClaw CLI versions from 2026.4.7 up to but not including 2026.4.20 are vulnerable to an environment variable injection issue where a malicious workspace .env file can override the MINIMAX_API_HOST. This can redirect credentialed MiniMax API requests to an attacker-controlled server, exposing the API key in the Authorization header. The vulnerability requires running OpenClaw from an attacker-controlled workspace. The issue is fixed in version 2026.4.20.
A vulnerability in OpenClaw CLI versions before 2026.4.20 causes Feishu card-action callbacks to misclassify direct messages (DMs) as group conversations. This misclassification leads to skipping enforcement of restrictive DM policies, allowing senders in Feishu DMs to trigger card-action flows that should be blocked. The issue is specific to Feishu card-action handling and has been fixed in version 2026.4.20.
OpenClaw CLI versions up to 2026.4.21 have a vulnerability where the Gateway Control UI bootstrap config endpoint does not require Gateway authentication, potentially exposing sensitive configuration fields. This issue is fixed in version 2026.4.22 by enforcing authentication on the bootstrap config route, aligning it with other authenticated Control UI reads.
OpenClaw CLI versions before 2026.4.20 contain a vulnerability where the MCP stdio server environment can load dangerous startup variables from workspace configuration. This allows malicious workspaces to pass harmful environment variables like NODE_OPTIONS, LD_PRELOAD, or BASH_ENV to the MCP server process, potentially causing it to load attacker-controlled code. The risk is limited to local or workspace trust boundaries and requires the operator to run OpenClaw in a maliciously configured workspace. The issue is fixed in version 2026.4.20 by filtering unsafe environment variables before spawning MCP servers.
OpenClaw CLI versions before 2026.4.15 have a vulnerability where the webchat audio embedding feature could read local files without enforcing local-root containment. This allows an attacker who can influence media URLs in webchat replies to cause the system to read and embed local audio files into responses. The vulnerability requires the file to be readable by the gateway process, have an audio-like extension, and fit within a size limit. The issue was fixed in version 2026.4.15 and later.
OpenClaw CLI versions up to 2026.4.21 have a vulnerability where ACP child sessions do not properly inherit subagent security envelope constraints. This can cause restrictions such as depth limits, child-count limits, control scope, or target-agent restrictions to be bypassed in child sessions. The issue is fixed in version 2026.4.22, which enforces these constraints correctly for child ACP sessions.
OpenClaw CLI versions prior to 2026.4.20 contain a local agent policy enforcement bypass vulnerability. Bundled MCP and LSP tools could bypass restrictive tool policies configured by an operator, such as allow/deny lists or sandbox restrictions. This could allow tools that should have been denied by policy to remain available. The issue requires a configured bundled MCP or LSP tool source and restrictive local policy. It does not allow unauthenticated remote compromise. The vulnerability is fixed in version 2026.4.20.
OpenClaw CLI versions prior to 2026.4.20 improperly labeled isolated cron awareness events as trusted system events instead of untrusted. This trust-labeling flaw could increase the impact of prompt injections but does not bypass authentication, tool policies, or sandboxing. The issue is fixed in version 2026.4.20 by preserving untrusted labels for these events.
OpenClaw CLI versions prior to 2026.4.20 have a vulnerability where browser CDP profile creation skips strict-mode SSRF checks. This allows stored profiles to reference private-network or metadata endpoints even when strict SSRF policies are enabled, potentially exposing internal resources during profile status checks. The issue only affects deployments with strict SSRF mode enabled, as default trusted-operator behavior permits private-network CDP endpoints. The vulnerability is considered low severity and has been fixed in version 2026.4.20.
OpenClaw CLI versions prior to 2026.4.20 contain a vulnerability where the agent gateway configuration mutation process could bypass protections on operator-trusted settings. This allows a model with access to the owner-only gateway tool to persist unauthorized changes to sensitive settings such as sandbox policy, plugin enablement, gateway authentication/TLS, hook routing, MCP server configuration, SSRF policy, and filesystem hardening. The vulnerability is a model-to-operator guard bypass and does not allow remote unauthenticated compromise. The issue is fixed in version 2026.4.20.
OpenClaw CLI versions up to 2026.4.21 allow workspace dotenv files to override connector endpoint hosts for services like Matrix, Mattermost, IRC, or Synology. This could redirect runtime traffic away from the operator-configured endpoints. The issue is fixed in version 2026.4.22 by blocking these endpoint variables in workspace dotenv files while keeping trusted global dotenv loading separate.