OpenClaw CLI versions before 2026.4.23 contain a vulnerability where the bundled plugin setup resolver could execute arbitrary JavaScript from an attacker-controlled setup-api.js file located in the current working directory. This occurs when a user runs OpenClaw commands from a directory containing malicious setup files, leading to code execution under the user's privileges. The vulnerability requires user interaction and local access but does not depend on network exposure. The issue is fixed in version 2026.4.23 by restricting setup resolution to the canonical package root and excluding process.cwd().
OpenClaw CLI versions before 2026.4.23 have a vulnerability where webhook route secrets backed by SecretRef remain cached after rotation and reload, allowing old secrets to remain valid until a plugin or gateway restart. This weakens credential rotation by permitting continued use of stale secrets for webhook authentication. The issue is fixed in version 2026.4.23, which reloads route secrets on each request, immediately invalidating rotated secrets without requiring restarts. The severity is medium, as exploitation requires prior possession of a valid secret.
OpenClaw CLI's gateway config mutation guard used a denylist to protect sensitive configuration paths, but the growing config schema outpaced this denylist, allowing unsafe model-driven config writes. This vulnerability enables a compromised or prompt-injected model with access to the owner-only gateway tool to persist unsafe configuration changes crossing security boundaries. These changes could affect command execution, network behavior, credentials, telemetry, and operator policies, and survive restarts. The issue affects openclaw versions from 2026.1.29 up to but not including 2026.4.23. The vulnerability is rated high severity with a CVSS score of 8.8. A fix is available in version 2026.4.23, which replaces the denylist with a fail-closed allowlist restricting config changes to narrow, safe paths.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.6 have a vulnerability where Telegram interactive callbacks can bypass the commands.allowFrom sender allowlist. This allows a Telegram user invoking an affected callback to mark the callback as authorized before the allowlist check is applied. The impact depends on the operator's configuration and whether untrusted input can reach the affected feature. A fix is available in version 2026.5.6. Until patched, restricting Telegram command callbacks to trusted chats and narrowing allowlists is recommended.
A vulnerability in the OpenClaw CLI Skill Workshop apply flow allows an agent tool call to override a pending approval state, applying changes prematurely. This affects versions from 2026.1.29 up to but not including 2026.5.6. The issue does not alter the trusted-operator model but could impact configurations where lower-trust inputs reach the affected path. The vulnerability has a medium severity with a CVSS score of 5.3.
A vulnerability in OpenClaw CLI's bundled MCP loopback allows bypassing an execution denylist during session spawn. This flaw enables broader command execution than intended when the affected feature is enabled and reachable. The issue affects versions from 2026.1.29 up to but not including 2026.5.12. The vulnerability does not alter OpenClaw's trusted-operator model but requires careful operator configuration to mitigate risk. A fix is available in version 2026.5.12.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.18 have a vulnerability in trusted-proxy Control UI mode where WebSocket clients could declare operator scopes before these were properly authorized. This allows an unpaired or restricted trusted-proxy client to gain operator.admin privileges on a live WebSocket connection, enabling admin-level Gateway RPCs until the connection ends or is revalidated. The issue does not affect shared-secret Control UI sessions. A fix is available in version 2026.5.18.
A vulnerability in OpenClaw CLI's Slack integration allows the 'allowFrom' policy to bind to mutable Slack display names. This means a Slack account that can change its display name metadata might match a policy entry incorrectly, potentially receiving agent access intended for another Slack identity. The issue affects versions from 2026.1.29 up to but not including 2026.5.4. The vulnerability does not alter OpenClaw's trusted-operator model. A fix is available starting with version 2026.5.3. Until patched, using stable Slack user IDs in allowlists and narrowing channel and tool allowlists are recommended mitigations.
A vulnerability in OpenClaw CLI's memory-wiki ingest feature allows a Gateway caller with operator.write access to read arbitrary local files instead of being restricted to intended ingest sources. This issue affects versions from 2026.1.29 up to but not including 2026.5.12. The vulnerability requires authenticated operator privileges and does not alter the trusted-operator security model of OpenClaw. The practical impact depends on the configuration and whether untrusted input can reach the vulnerable path. A patch is available to address this issue.
A vulnerability in openclaw-cli allows a sandboxed session spawn to expose the real workspace path to child prompts. This occurs when a child session is spawned from a sandboxed parent, potentially revealing the host workspace location or related memory context. The issue affects versions from 2026.1.29 up to but not including 2026.4.26. The vulnerability does not alter the trusted-operator model of OpenClaw. A fix is available in version 2026.4.26. Until patched, users should avoid spawning child sessions from sensitive sandboxed workspaces and apply recommended hardening measures.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.2 have a vulnerability where message.action forwarding can send Gateway credentials to model-supplied loopback URLs. This occurs when model-controlled action metadata selects a loopback Gateway URL, potentially exposing tokens and action payloads to a local listener. The vulnerability depends on the operator's configuration and whether untrusted input can reach this path. A patch is available in version 2026.5.2. Mitigations include restricting message action forwarding, avoiding model-supplied loopback targets until patched, and narrowing allowlists.
A vulnerability in OpenClaw CLI allows native command authorization to bypass owner-only command enforcement. This means that a sender able to trigger native command handling could execute commands reserved for owners without proper authorization. The issue affects versions from 2026.1.29 up to but not including 2026.5.6. The vulnerability does not affect the overall trusted-operator model but depends on specific feature enablement and configuration. A patch is available in version 2026.5.6. Until patched, limiting native command access to trusted senders and narrowing allowlists are recommended mitigations.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.18 have a vulnerability where the exec approval UI truncates long commands, potentially hiding parts of the command that will execute. This can cause an approver to unknowingly approve a command with a hidden suffix that may perform unintended operations. The issue affects deployments with exec approval enabled and authenticated users able to submit long exec requests. The vulnerability does not allow unauthenticated access or change the local trust model. A fix is available in version 2026.5.18.
OpenClaw CLI on POSIX nodes has a vulnerability in its system.run safe-bin allowlist where shell expansion can widen the approved commands, allowing unintended file operands. This affects configurations using safe-bin or allowlist auto-approval with commands that include shell-expanded values. A lower-privilege operator could exploit this to read node-local files not intended by policy, potentially exposing sensitive configuration or local information. The issue is a policy enforcement gap in argument validation, not a general flaw in safe-bin commands. The vulnerability is patched in OpenClaw version 2026.5.18 and later.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.18 have a vulnerability where same-host trusted-proxy deployments could accept locally forged identity headers. This allows a local caller on the same host who can access the proxy-facing Gateway port to supply identity headers normally reserved for the trusted proxy. The vulnerability affects operator identity handling when the feature is enabled and reachable. A patch is available in version 2026.5.18. Mitigations include restricting access to the trusted-proxy ingress behind a proxy and firewall, narrowing allowlists, avoiding sharing Gateways between untrusted users, and disabling the feature if not needed.
A vulnerability in OpenClaw CLI's QQBot streaming command allows mutation of configuration without requiring an explicit allowFrom whitelist entry. This can lead to unauthorized configuration changes when the feature is enabled and accessible. The issue affects versions from 2026.1.29 up to but not including 2026.4.29. A patch is available in version 2026.4.29. Mitigations include disabling the command or restricting it to trusted senders until patched.
A vulnerability in OpenClaw CLI's QQBot pre-dispatch slash commands allows these commands to bypass configured allowFrom policy checks. This means that a QQBot sender with the ability to invoke slash commands could dispatch commands before the policy restricting command sources is applied. The issue affects versions from 2026.1.29 up to but not including 2026.4.27. The vulnerability does not alter the trusted-operator model of OpenClaw, and its impact depends on specific operator configurations and exposure of the affected feature. A fix is available starting with version 2026.4.27.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.12 have a vulnerability where PowerShell encoded-command aliases may bypass execution allowlist checks. This allows encoded PowerShell commands to run without proper allowlist validation if abbreviated alias forms are used. The vulnerability affects configurations where the feature is enabled and reachable, potentially allowing execution of unauthorized encoded PowerShell content. The issue does not alter the trusted-operator model of OpenClaw. A patch is available starting with version 2026.5.12. Until patched, it is recommended to avoid allowlisting PowerShell wrapper forms and require approval for encoded commands. Additional mitigations include narrowing allowlists, avoiding shared Gateways between untrusted users, and disabling the affected feature if not needed.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.6 have a vulnerability where Mattermost event handlers may improperly process events missing channel type metadata, bypassing intended direct message (DM) policy enforcement. This could allow events that should be restricted by channel policy to be processed when the affected feature is enabled. The vulnerability does not affect the overall trusted-operator model of OpenClaw. A patch is available in version 2026.5.6. The CVSS score is 3.7, indicating low severity.
A vulnerability in OpenClaw CLI allows node pairing reconnection to confuse the approval scope state, potentially broadening node authority beyond operator intent. This affects versions from 2026.1.29 up to but not including 2026.5.28. The issue arises when a paired or reconnecting node session mutates pairing state, impacting approval scope decisions. The vulnerability does not alter the trusted-operator model but can present increased authority if the affected feature is enabled and reachable. A fix is available starting with version 2026.5.27. Operators are advised to revoke unexpected node pairings and re-pair only trusted nodes until patched, and to harden configurations by narrowing allowlists and disabling the feature if not needed.