A vulnerability in OpenClaw CLI on macOS allows combined POSIX inline-command flags to bypass the exec allowlist, potentially executing shell content outside intended restrictions. This affects versions from 2026.1.29 up to but not including 2026.5.6. The impact depends on the operator's configuration and whether untrusted input can reach the vulnerable code path. A patch is available in version 2026.5.6. Until patched, requiring approval for combined shell flag forms on macOS is recommended, along with general hardening such as narrowing allowlists and disabling the feature if not needed.
A vulnerability in openclaw-cli allows replay of bootstrap tokens to widen pending pairing scopes. An attacker with access to a pending bootstrap token can reuse it before approval to request broader scopes than originally intended. This issue affects versions from 2026.1.29 up to but not including 2026.5.12. The vulnerability depends on the operator's configuration and whether untrusted inputs can reach the affected feature. A fix is available in version 2026.5.12.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.4.25 contain a vulnerability where tool group policy callers could accept unvalidated group IDs. This may cause the application of incorrect group-policy decisions for tool invocations when the affected feature is enabled and accessible. The vulnerability does not alter the trusted-operator model of OpenClaw. A patch is available starting with version 2026.4.25. Until patched, it is recommended to avoid exposing group-policy controlled tools to untrusted senders and to apply configuration hardening measures.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.28 have a vulnerability where the host environment sanitizer misses two Node.js control variables. This allows lower-trust environment sources, such as workspace .env files or tool overrides, to pass these control variables through the sanitizer. The issue affects the environment of Node.js child processes launched under certain configurations, potentially influencing their behavior. The vulnerability does not alter the trusted-operator model of OpenClaw. A fix is available starting with version 2026.5.26. Mitigations include avoiding untrusted environment inheritance and restricting access through allowlists and disabling the affected feature if not needed.
A vulnerability in openclaw-cli allows a workspace-derived service PATH to influence the selection of the trash command during maintenance tasks. This could cause an unintended local executable to run if the operator's configuration allows lower-trust input to affect the PATH. The issue affects versions from 2026.1.29 up to but not including 2026.5.2. The vulnerability does not alter the trusted-operator model of OpenClaw. A fix is available in version 2026.5.2.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.12 have a vulnerability in shell inline-command parsing where an allowlist check can be bypassed. This allows shell commands to run without the intended approval or allowlist prompt if the affected feature is enabled and reachable. The vulnerability does not affect the trusted-operator model but depends on the operator's configuration and input trust levels. A patch is available in version 2026.5.12.
OpenClaw CLI's Zalo plugin had a missing authorization check for group senders, allowing unauthorized GROUP messages to bypass intended allowlist restrictions. This flaw permitted senders not on the configured group allowlist to trigger agent dispatch processing. The issue was fixed in version 2026.2.24 by adding explicit runtime group-policy evaluation and fail-closed behavior for missing configurations.
OpenClaw CLI versions up to 2026.2.1 contain a server-side request forgery (SSRF) vulnerability in the Image tool's remote fetch functionality. This flaw allows attackers to make HTTP requests to internal or restricted network targets by supplying crafted URLs. The vulnerability is patched in version 2026.2.2 and later. Exploitation requires attacker control over the Image tool invocation and is limited by media-type validation and request constraints. The SSRF can enable internal network probing and access to unauthenticated internal HTTP endpoints.
OpenClaw CLI has a vulnerability in its hook authentication rate limiter where IPv4 and IPv4-mapped IPv6 client addresses are treated as distinct, allowing attackers to bypass rate limits. This flaw enables an attacker to double the number of allowed failed authentication attempts within a 60-second window by splitting attempts across both address forms. The issue affects versions up to and including 2026.2.21-2 and is fixed in the planned release 2026.2.22.
OpenClaw CLI versions from 2026.1.5 up to and including 2026.2.21-2 contain a vulnerability in the shell environment fallback mechanism. The issue involves trusting environment variables such as SHELL, HOME, and ZDOTDIR during startup, which could allow execution of attacker-influenced login shell startup paths before environment keys are loaded. This can lead to local code execution if an attacker can influence environment or configuration input. The vulnerability is not exploitable remotely and depends on crossing local trusted operator boundaries. A fix is available in the mainline and planned for release in version 2026.2.22, which hardens environment variable handling and sanitizes the shell fallback execution environment.
The OpenClaw CLI has a vulnerability in its webhook transform modules where path validation only uses lexical checks. This allows a symlink within the allowed transform directory to resolve outside the intended directory, enabling dynamic import of unintended JavaScript code. The issue affects versions up to and including 2026.2.21-2 and is planned to be fixed in version 2026.2.22. Exploitation requires that hook transforms are enabled and reachable, and that an attacker can influence the transform path resolution to reference a symlink escape to attacker-controlled code. The vulnerability could lead to execution of unauthorized code with gateway-process privileges.
OpenClaw CLI versions up to 2026.3.2 have a vulnerability where non-POST HTTP requests to the /hooks/* endpoint are counted toward the authentication failure limit, allowing an unauthenticated attacker to trigger a temporary lockout of webhook delivery. This can cause temporary denial of service for legitimate webhook-triggered automation. The issue is fixed in version 2026.3.7, which correctly rejects unsupported HTTP methods with a 405 status without incrementing the auth failure count.
OpenClaw CLI versions up to 2026.2.22-2 contain a vulnerability where exec.approval requests for host=node were not bound to a specific nodeId. This allowed an operator's approval for a system.run request on one node to be replayed on a different node within the same gateway fleet. The issue is fixed in version 2026.2.23 by requiring and persisting nodeId for approval requests and rejecting execution if the node binding does not match. Users should upgrade to 2026.2.23 or later to remediate this issue.
OpenClaw CLI versions up to 2026.2.22-2 have a vulnerability where the exec allowlist and safe-bins policy evaluation can diverge from actual runtime execution due to how GNU env -S wrapper commands are interpreted. This mismatch allows an attacker who can influence command text to bypass allowlist restrictions and execute unintended commands. The issue is fixed in version 2026.2.23 by enforcing stricter execution planning and policy checks.
OpenClaw CLI versions up to 2026.2.22-2 contain a vulnerability in a non-default configuration where the autoAllowSkills setting is enabled. This flaw allows a skill-name collision to bypass the 'ask=on-miss' execution approval prompt, potentially permitting execution without operator confirmation. The issue arises because the allowlist evaluator matches skill names by basename, allowing path-scoped executables to bypass prompts. The vulnerability is fixed in version 2026.2.23 by requiring pathless invocation tokens and trusted resolved executable paths for auto-allow matching.
A vulnerability in the openclaw npm package (openclaw-cli) affects Microsoft Teams media fetch paths by bypassing the shared SSRF guard model. This inconsistency in host and DNS enforcement across redirect and fetch hops could lead to SSRF boundary policy drift. The issue is fixed by unifying fetch paths through a shared SSRF-guarded mechanism with centralized hostname allowlist policies. Versions up to 2026.2.25 are affected, with a patch planned in version 2026.2.26.
OpenClaw CLI versions up to 2026.2.26 contain a time-of-check/time-of-use (TOCTOU) vulnerability in sandbox media handling. This flaw allows a symlink attack to cause media reads outside the intended sandbox root directory, potentially exposing host files. The issue arises because media paths are validated at one point and read later through a different path, allowing a race condition. The vulnerability is fixed in version 2026.3.1 by consolidating media read paths to be root-scoped and boundary-safe, eliminating the TOCTOU gap.
OpenClaw CLI versions prior to 2026.4.2 contain a vulnerability in the QQ Bot structured media payload handling that allows reading arbitrary local files on the host. This occurs because crafted payloads can escape the intended media root directories, leading to unauthorized file reads. The issue is fixed in version 2026.4.2 by restricting local path access in structured payloads.
OpenClaw CLI versions from 2026.1.20 through 2026.2.17 contain a Server-Side Request Forgery (SSRF) guard bypass vulnerability. The SSRF protection failed to detect ISATAP embedded IPv4 addresses within IPv6 literals, allowing crafted URLs to bypass private IP filtering. This weakness permits SSRF attempts targeting internal or private network addresses via URL fetching paths. The issue is rated medium severity and has been fixed in version 2026.2.19 by adding ISATAP IPv4 detection and centralizing hostname/IP blocking.
OpenClaw CLI versions up to 2026.2.26 have an authorization bypass vulnerability allowing unauthorized senders to trigger stop-like abort commands and access the /models command output without proper sender authorization. This could disrupt active sessions and expose model and authorization metadata that should be restricted. The issue is fixed in version 2026.3.1 by enforcing sender authorization on these command paths.