OpenClaw CLI versions up to 2026.2.21-2 have a vulnerability in the tools.exec.safeBins feature where a generic fallback safe-bin profile allowed interpreter-style binaries to execute inline payloads in allowlist mode. This issue requires explicit operator configuration to add such binaries, limiting impact to misconfigured deployments. A fix is planned in version 2026.2.22 that removes the generic fallback and requires explicit safe-bin profiles.
OpenClaw Gateway's authenticated HTTP endpoint /tools/invoke allowed invocation of high-risk session orchestration tools by default, enabling escalation from single-tool invocation to session spawning and control. Additionally, ACP clients could auto-approve risky permission requests without sufficient user interaction, increasing risk of silent execution or mutation. The vulnerability affects OpenClaw versions prior to 2026.2.14 and has been fixed in 2026.2.14 with hardened default behaviors and stricter permission handling.
In sandboxed runs of the openclaw-cli package, native prompt image auto-load did not respect the optional hardening setting tools.fs.workspaceOnly=true. This allowed prompt text to reference and load image files from mounted paths outside the intended workspace, potentially exposing sensitive image data to vision-capable model inputs. This issue affects versions before 2026.2.24 and requires specific conditions including sandbox mode, the workspaceOnly setting enabled, an out-of-workspace mount, and active vision-capable model paths. The vulnerability has been fixed in version 2026.2.24.
OpenClaw CLI versions up to 2026.2.21-2 contain a symlink traversal vulnerability in the gateway session metadata handling. A crafted local avatar path can follow symlinks outside the agent workspace, allowing an attacker to read arbitrary local files and return their contents as base64 data URLs in gateway responses. This leads to local file disclosure within the gateway process context. A patch is planned in version 2026.2.22 to fix this issue.
OpenClaw CLI versions up to 2026.3.2 have a vulnerability in the system.run allowlist persistence logic where shell comment semantics were not properly honored. This allowed non-executed command tails following unquoted '#' characters to be stored as trusted commands, potentially leading to unintended allowlist persistence. The issue was fixed in version 2026.3.7 by improving shell tokenization to correctly handle unquoted shell comments.
The Openclaw CLI's Google Chat integration allows authorization based on mutable email principals in its allowlist, weakening identity binding. This can lead to spoofing access if an attacker has Google Workspace or IdP administrative control to reassign email addresses. The issue is low severity because requests are authenticated via Google Chat tokens, and exploitation requires high privilege access. The vulnerability affects openclaw versions from 2026.1.29 up to but not including 2026.2.14. A patch is available that deprecates treating 'users/<email>' as an email allowlist entry and recommends using immutable user IDs instead.
OpenClaw CLI had a security hardening update addressing canvas route access in mixed-trust or network-visible deployments. Previously, fallback authorization behavior could allow broader access than intended. The update requires explicit token or session-capability authorization and removes shared-IP fallback paths, tightening access controls. The risk is mainly for deployments exposing canvas routes beyond loopback or trusted hosts. Versions up to 2026.2.19-2 are vulnerable, with a patch targeted for 2026.2.21.
OpenClaw CLI versions up to 2026.2.21-2 have an authorization issue where the elevated allowFrom configuration accepted broader identity signals than intended, potentially allowing elevated sender approval based on less strict identity matching. The fix in version 2026.2.22 tightens identity matching to sender-scoped fields only and requires explicit prefixes for mutable metadata. This vulnerability is considered an authorization hardening issue in the context of 1:1 or trusted group chats.
OpenClaw CLI plugins run in-process with the same OS privileges as the main process, and runtime command execution helpers are part of the trusted plugin boundary. This advisory clarifies that these helpers do not introduce a new sandbox boundary. Users should only install trusted plugins and use explicit plugin ID pinning. A fix is planned in version 2026.2.19.
OpenClaw CLI versions prior to 2026.2.13 log certain WebSocket request headers without sanitization or length limits when connections close before completing the handshake. This can allow unauthenticated clients to inject crafted header values into logs. If these logs are later processed by AI-assisted debugging tools or LLMs, this may lead to indirect prompt injection (log poisoning). The issue is fixed in version 2026.2.13 by sanitizing and truncating header values before logging.
OpenClaw CLI versions up to 2026.2.25 have a vulnerability in the voice-call Twilio webhook path where replay detection could be bypassed by manipulating an unsigned idempotency header. This allowed replayed webhook events to be accepted as fresh events. The issue is fixed in version 2026.2.26 by binding replay deduplication to authenticated request identity rather than mutable unsigned headers.
OpenClaw CLI versions up to 2026.4.2 have a vulnerability where lower-trust background runtime output is incorrectly injected into trusted System events. This flaw allows potentially untrusted output to be promoted to trusted status, enabling prompt injection into subsequent agent operations. The issue affects the OpenClaw trust model in a local assistant context and does not involve multi-tenant service boundaries. A patch is available in version 2026.4.8.
A vulnerability in the openclaw CLI package causes a mismatch in authorization scope for LINE group allowlists. Sender IDs approved via direct message (DM) pairing could improperly satisfy group allowlist checks, allowing broader group sender access than intended. This is due to group allowlist composition inheriting entries from the DM pairing store. The issue affects versions up to 2026.2.25 and is fixed starting from version 2026.2.26.
OpenClaw CLI versions up to 2026.2.23 have a vulnerability where inbound media in Telegram direct messages is downloaded and written to disk before sender authorization checks are completed. This allows unauthorized senders to trigger media download and disk write operations even when direct message access should be denied. The issue affects versions from 2026.1.29 up to but not including 2026.2.24. The vulnerability is fixed in version 2026.2.24, which enforces authorization before media handling.
OpenClaw CLI versions up to 2026.2.24 have an SSRF IP classification bypass where IPv6 multicast addresses (ff00::/8) were not treated as blocked or private. This allowed these multicast addresses to pass SSRF preflight checks. The issue was addressed in version 2026.2.25. The vulnerability is considered low severity as it is a defense-in-depth hardening issue and network fetches are limited to HTTP/HTTPS.
A vulnerability in the openclaw CLI allows a gateway client with operator.write privileges to perform persistent configuration changes via the chat.send command interface, which was intended to be restricted to operator.admin users. This issue arises from an authorization mismatch in the handling of /config set and /config unset commands routed through chat.send. The vulnerability was patched in version 2026.3.7. Exploitation requires an authenticated gateway client with specific permissions and enabled command support. The severity is rated medium due to the scoped nature of the privilege escalation and the requirement for prior authentication.
OpenClaw CLI versions from 2.0.0-beta3 up to but not including 2026.2.12 have a vulnerability where the POST /hooks/agent endpoint accepts an externally supplied sessionKey for routing messages. This allows an authenticated hook token holder to inject messages into targeted sessions by overriding session keys. The vulnerability impacts message integrity and can persist poisoned context in sessions. Confidentiality impact is secondary and depends on other weaknesses. The issue is fixed in version 2026.2.12 by restricting sessionKey acceptance and adding configuration options to control session routing securely.
The openclaw npm package prior to version 2026.2.25 contains a vulnerability in the MS Teams file-consent flow where pending uploads could be completed or canceled across different conversations due to missing conversation binding verification. This allows an attacker with a valid uploadId to manipulate pending uploads in other conversations. The issue is fixed in version 2026.2.25 by enforcing conversation ID matching before processing upload acceptance or cancellation.
OpenClaw CLI versions up to 2026.3.2 contain a vulnerability in the system.run environment override sanitization that allows dangerous environment variable overrides to bypass allowlist and approval mechanisms. This enables an attacker with existing system.run invocation rights to influence subprocess behavior via environment variables like GIT_SSH_COMMAND and GIT_CONFIG_*, causing helper-command execution or config loading outside the reviewed command semantics. The issue is fixed in version 2026.3.7.
OpenClaw CLI versions up to 2026.4.2 contain a vulnerability where authenticated `/hooks/wake` and mapped `wake` payloads are incorrectly promoted into the trusted `System:` prompt channel instead of being treated as untrusted events. This issue affects the OpenClaw trust model in a local user-controlled context and does not assume multi-tenant service boundaries. The vulnerability has been fixed in version 2026.4.8.