A vulnerability in openclaw-cli allows trusted retry endpoint checks to match hostname prefixes, potentially causing authentication material to be sent to unintended endpoints. This issue affects versions from 2026.1.29 up to but not including 2026.5.7. The vulnerability arises when a retry endpoint URL chosen by lower-trust input passes validation by resembling a trusted host via hostname prefix matching. The impact depends on the operator's configuration and exposure of the affected feature. A patch is available in version 2026.5.7. Until patched, retry endpoints should be pinned to exact trusted origins, and the affected feature should be disabled if not needed.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.12 have a vulnerability where custom headers configured for MCP Streamable HTTP servers may be forwarded to a different origin if the MCP endpoint issues a cross-origin redirect. This can expose sensitive headers such as API keys or tenant-routing headers to unintended recipients. The issue only affects deployments using streamable-http transport with custom headers and MCP endpoints that can redirect cross-origin. A fix is available starting with version 2026.5.12.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.12 export session HTML that may retain unsafe markdown links such as javascript: or data: URLs. This can lead to browser-side script execution if a trusted operator opens the exported file and activates such a link. The vulnerability affects the exported session HTML feature and depends on operator configuration and input trust levels. A fix is available in version 2026.5.12. Users are advised not to open exported session HTML from untrusted content in privileged browser profiles until patched and to limit sharing of Gateways between untrusted users.
A vulnerability in openclaw-cli allows a workspace .env file to influence which Python runtime the gcloud command uses via the CLOUDSDK_PYTHON environment variable. This can affect the Gmail setup process when run by a trusted operator. The issue exists in versions from 2026.1.29 up to but not including 2026.5.2. The vulnerability does not alter the trusted-operator model but could lead to unintended Python execution paths if lower-trust input reaches the affected feature. A fix is available in version 2026.5.2.
A vulnerability in openclaw-cli allows a device with a surviving pairing-scoped session to regain node token authority after that token has been revoked. This undermines the intended revocation mechanism, potentially allowing continued node-level access without renewed approval. The issue affects devices that already had legitimate pairing and session footholds. The vulnerability is patched in openclaw-cli version 2026.5.26 and later.
A vulnerability in OpenClaw CLI's memory-wiki shared search feature allows bypassing session visibility checks, potentially exposing memory entries to unauthorized sessions. This issue affects versions from 2026.1.29 up to but not including 2026.4.29. The vulnerability requires the affected feature to be enabled and reachable, and its impact depends on operator configuration and trust boundaries. A fix is available starting with version 2026.4.29. Until patched, limiting shared memory search to trusted operators and narrowing allowlists are recommended mitigations.
A vulnerability in OpenClaw CLI allows skill-command dispatch to skip before-tool-call hooks, potentially bypassing hook-based auditing or policy enforcement. This affects versions from 2026.1.29 up to but not including 2026.5.6. The issue does not alter the trusted-operator model but may impact security depending on configuration and input trust levels. A patch is available in version 2026.5.6. Users are advised to avoid relying solely on hook enforcement for skill commands until patched and to apply general hardening measures such as restricting allowlists and disabling the affected feature if not needed.
A vulnerability in OpenClaw CLI allows a Gateway caller with operator.write access to mutate global configuration without requiring operator.admin privileges. This issue affects versions from 2026.1.29 up to but not including 2026.5.6. The vulnerability depends on the affected feature being enabled and reachable, and the practical impact varies based on operator configuration and input trust levels. The vendor has released a patch in version 2026.5.6. Until patched, limiting Active Memory write access to trusted operators and narrowing allowlists are recommended mitigations.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.28 have a vulnerability where the exec allowlist may not detect side effects caused by transparent command wrappers. This can lead to unintended wrapper-level side effects executing outside the intended allowlisted command. The issue affects configurations where the vulnerable feature is enabled and reachable. The vulnerability does not alter OpenClaw's trusted-operator model. A fix is available starting with version 2026.5.26. Mitigations include careful review and approval of shell-like wrapper commands, narrowing allowlists, avoiding shared Gateways among untrusted users, and disabling the affected feature if not needed.
A vulnerability in OpenClaw CLI's Discord allowFrom feature allows binding to mutable display names. This can cause a Discord account that can change display or global name metadata to match a policy entry incorrectly. The issue affects versions from 2026.1.29 up to but not including 2026.5.7. The vulnerability could allow an attacker to receive agent access intended for another Discord identity, depending on configuration. A patch is available in version 2026.5.7. Until patched, using stable Discord user IDs in allowlists is recommended, along with narrowing allowlists and disabling the feature if not needed.
The OpenClaw CLI 'focus' command could bypass controlScope enforcement in affected versions, allowing the command to run without enforcing the expected control scope. This vulnerability affects versions from 2026.1.29 up to but not including 2026.4.25. The impact depends on the operator's configuration and whether lower-trust inputs can reach the vulnerable command path. The issue does not alter OpenClaw's trusted-operator model, meaning trusted Gateway operators and installed plugins remain trusted unless other security boundaries are crossed. A fix is available in version 2026.4.25. Until patched, restricting access to the focus command to trusted operators is recommended, along with narrowing allowlists and disabling the feature if not needed.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.12 have a vulnerability where Slack reaction events could bypass reaction notification settings, causing these events to be processed even when disabled. This issue affects the Slack reaction event handling feature and does not alter the trusted-operator security model of OpenClaw. The vulnerability may lead to unintended agent processing depending on configuration and trust boundaries.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.4.25 contain a vulnerability where an empty-scope device re-pairing request can bypass intended scope containment controls. This may allow broader access scopes than intended during device re-pairing. The vulnerability affects configurations where the feature is enabled and reachable, with impact depending on operator setup and input trust levels. A patch is available in version 2026.4.25. Mitigations include revoking unexpected device sessions, requiring fresh pairing for suspicious devices, narrowing allowlists, avoiding shared Gateways between untrusted users, and disabling the affected feature if not needed.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.12 on Linux and macOS have a vulnerability where exec allowlist entries using argPattern to restrict executable arguments are bypassed. This allows disallowed arguments to be executed without approval prompts, potentially enabling unintended file, network, or command access. The issue does not affect Windows or path-only allowlist entries. A fix is available in version 2026.5.12.
A vulnerability in openclaw-cli allows shell positional parameters to weaken strict inline-eval checks. This can enable shell-provided content to execute outside the intended allowlist rules when the affected feature is enabled. The issue affects versions from 2026.1.29 up to but not including 2026.4.2. The vulnerability has a high severity with a CVSS score of 8.1. A patch is available in version 2026.4.2. Mitigations include avoiding allowlisting shell carrier patterns and requiring approval for shell wrappers until patched.
A vulnerability in openclaw-cli's config recovery feature could restore the openclaw.json configuration file with overly broad file permissions. This may expose sensitive local configuration data to other users on the same host if OS permissions allow. The issue affects versions from 2026.4.23 up to but not including 2026.4.24. The vulnerability does not alter the trusted-operator model of OpenClaw but could increase local exposure when the feature is enabled. A fix is available in version 2026.4.24.
A vulnerability in OpenClaw's Zalo allowFrom feature allows binding to mutable display names, potentially causing agent responses to be misdirected to another Zalo identity. This affects versions from 2026.1.29 up to but not including 2026.5.4. The issue depends on operator configuration and the trust level of inputs reaching the affected feature. A fix is available starting with version 2026.5.3. Mitigations include using stable Zalo identifiers, restricting friend access, narrowing allowlists, avoiding shared Gateways between untrusted users, and disabling the feature if not needed.
A vulnerability in openclaw-cli allows a workspace .env file to influence the STATE_DIRECTORY environment variable, potentially causing bundled runtime dependencies to be loaded from unintended local paths. This affects versions from 2026.1.29 up to but not including 2026.5.2. The issue requires the affected feature to be enabled and reachable and depends on operator configuration and trust boundaries. The vulnerability does not alter the trusted-operator model of OpenClaw. A patch is available in version 2026.5.2. Mitigations include avoiding opening untrusted workspace .env files before patching and restricting access via allowlists and disabling the feature if not needed.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.28 have a vulnerability where hostname checks treat trailing-dot hosts inconsistently. This can allow requests with trailing-dot hostnames to bypass blocklist comparisons, potentially reaching destinations that operators intended to block. The vulnerability affects features that accept model- or workspace-derived URLs and depends on operator configuration and input trust levels. A patch is available starting with version 2026.5.26. Until patched, network-level blocking of private-network and metadata destinations is recommended, along with minimizing allowlists and disabling the affected feature if not needed.
BlueBubbles sender policy in OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.7 could match mutable conversation identifiers instead of stable sender identities. This allows a participant who can influence conversation-level identifiers to bypass intended sender restrictions. The vulnerability affects configurations where the feature is enabled and reachable, potentially allowing agent responses to be received by unintended senders. The issue does not affect the trusted-operator model of OpenClaw. A patch is available in version 2026.5.7. Mitigations include preferring stable sender identifiers, restricting BlueBubbles groups, narrowing allowlists, avoiding shared Gateways between untrusted users, and disabling the affected feature if not needed.