OpenClaw CLI is vulnerable to local file exfiltration via injection of MEDIA: directives in MCP tool result content. A malicious or compromised MCP tool server can specify arbitrary file paths within allowed directories such as the OS temporary directory, causing OpenClaw to read and send those files to external messaging channels like Discord, Slack, Telegram, and WhatsApp without user awareness. This vulnerability affects all OpenClaw versions up to and including 2026.7.1. The flaw arises from unvalidated extraction of MEDIA: tokens, an overly broad default allowlist including os.tmpdir(), and delivery of file contents to external channels. Secondary attack vectors include fallback on image content paths and support for file:// URI schemes. The impact includes theft of sensitive temporary files and silent exfiltration to attacker-controlled channels. A patch is available to remediate this issue.
A path traversal vulnerability in the OpenClaw CLI ZIP extraction logic allowed writes outside the intended extraction directory when a pre-existing symlink was present in the destination path. This could lead to arbitrary file writes outside the extraction root. The issue affects openclaw versions up to and including 2026.2.21-2 and is fixed in version 2026.2.22. The vulnerability requires attacker-controlled archive extraction and a pre-existing symlink in the destination path.
OpenClaw CLI has an authentication inconsistency in its local Chrome extension relay feature. The /extension WebSocket endpoint accepts unauthenticated connections on the local loopback interface, while other relay endpoints require authentication. This allows a local process on the same machine to connect without a token and interfere with extension-relay behavior. No remote exploitation is possible. A fix is available that enforces token authentication on all relay endpoints.
OpenClaw CLI versions before 2026.3.7 contain a cross-account sender authorization scoping vulnerability in the `/allowlist ... --store` command. The issue arises because writes to the allowlist store did not properly scope the accountId, causing entries intended for one account to authorize senders on the default account. Exploitation requires an already-authorized user with permission to run `/allowlist` edits. The vulnerability is fixed in version 2026.3.7.
A sandbox boundary validation flaw in openclaw-cli versions up to 2026.2.25 allowed certain workspace-only write operations to bypass the sandbox boundary via dangling symlink alias handling. This could result in writes occurring outside the intended workspace or sandbox root, potentially compromising host file integrity. The issue is fixed in version 2026.2.26.
OpenClaw CLI in allowlist mode trusted PATH-derived directories for safe binary execution, allowing an attacker to bypass the allowlist by placing a same-name binary in a trusted directory. This could lead to command execution within the OpenClaw runtime context. The vulnerability affects openclaw versions up to 2026.2.21-2 and is planned to be fixed in version 2026.2.22. The root cause is trusting PATH-derived directories instead of explicit trusted directories and using shell command tokens that could resolve to shadowed binaries.
OpenClaw CLI versions from 2026.2.17 through 2026.2.24 contain a vulnerability in Telegram message_reaction handling that allows unauthorized users to inject reaction-derived system events. This occurs due to a missing sender-authorization check, bypassing configured direct message and group authorization policies. The issue is fixed in version 2026.2.25.
OpenClaw CLI versions up to 2026.2.22-2 have a stored cross-site scripting (XSS) vulnerability in the exported session HTML viewer. This occurs because raw HTML markdown tokens and unescaped metadata fields are rendered without proper sanitization, allowing attacker-controlled JavaScript to execute when opening a crafted exported session file. The vulnerability was patched in version 2026.2.23 by escaping raw HTML tokens and metadata fields and adding image MIME sanitization.
OpenClaw's macOS Dashboard flow exposed Gateway authentication credentials by including them in browser URL query parameters and storing them in localStorage. This allowed credentials to be accessible via browser address bar and persistent storage, increasing risk of unauthorized access. The vulnerability affects openclaw-cli versions up to 2026.3.2 and was fixed in version 2026.3.7 by changing token transport to URL fragments and removing persistent storage of tokens in the browser.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.24 contain an authorization flaw in the internal `/allowlist` chat commands. These commands allow an authenticated internal Gateway caller with `operator.write` scope to perform mutating actions that should require `operator.admin` scope. This missing authorization check permits persistent changes to configuration and pairing-store allowlist entries without proper admin privileges. The issue was fixed in OpenClaw 2026.3.24.
OpenClaw CLI versions prior to 2026.2.13 have an issue where inter-session messages sent via sessions_send are stored as user role messages without provenance metadata. This causes confusion between external user input and internal inter-session instructions, potentially leading to unintended privileged behavior in workflows that trust the user role as an authority signal. The vulnerability is fixed in version 2026.2.13 by adding explicit input provenance metadata to distinguish inter-session messages from genuine user input.
Several Dockerfiles used for end-to-end (E2E) testing and installation in the OpenClaw CLI project run all processes as root due to the absence of a USER directive. This allows processes inside these containers to run with uid 0, increasing the risk of container breakout if compromised. While some Dockerfiles (sandbox and sandbox-browser) have been partially fixed by adding a non-root user, the E2E/test Dockerfiles remain unpatched. The base images used default to root, and the affected Dockerfiles include scripts/e2e/Dockerfile, scripts/e2e/Dockerfile.qr-import, and scripts/docker/install-sh-e2e/Dockerfile. Remediation involves adding a USER directive to run processes as a non-root user.
OpenClaw CLI versions up to 2026.2.19-2 are affected by a startup-file injection vulnerability involving the BASH_ENV and ENV environment variables. This flaw allows unintended shell command execution when attacker-controlled environment values are inherited by spawned shell commands. The vulnerability requires local or privileged access to influence environment inputs and cannot be triggered remotely without authentication. A fix has been committed and will be released in version 2026.2.21.
OpenClaw CLI versions up to 2026.3.28 are affected by an environment variable injection vulnerability in the Host-Exec feature. This allows environment variables controlled by the user to influence interpreters, shells, or build tools during host execution. The vulnerability is scoped to the OpenClaw trust model and does not assume multi-tenant service boundaries. A fix is available in version 2026.4.8.
A time-of-check to time-of-use (TOCTOU) symlink race condition exists in OpenClaw CLI's writeFileWithinRoot function. This vulnerability allows an attacker to manipulate a symlink path between resolution and file write operations, potentially causing file creation or truncation outside the intended root directory. The issue affects versions up to 2026.2.26 and is fixed in version 2026.3.1 by changing the file write flow to include post-open identity and boundary checks and exclusive file creation semantics.
A sandbox path validation bypass vulnerability in the openclaw CLI allows unauthorized reading of host files outside the intended sandboxRoot. This occurs when the fallback temporary directory used by openclaw is a symlink alias, enabling media paths under this fallback root to escape sandbox confinement. The issue affects openclaw versions up to 2026.2.24 and is fixed in version 2026.2.25.
An update to cloud-init version 25.1.3 addresses multiple issues including fixes for vulnerabilities CVE-2024-6174 and CVE-2024-11584. The update also removes an unnecessary test dependency and corrects a dependency replacement. No specific affected versions prior to this update are stated. The vulnerabilities are rated as high severity but no CVSS score is provided.
This security update for Chromium addresses multiple vulnerabilities including a heap buffer overflow and several memory and data validation issues in DevTools. The update applies to Chromium versions 135.0.7049.114 and 136.0.7103.48, with the latter fixing four specific CVEs reported in early 2025. It also includes stability fixes and upgrades to related components such as esbuild and Go. The severity is assessed as high based on the nature of the vulnerabilities. No CVSS score is provided.
A security update has been issued for the Performance Co-Pilot (PCP) component by the SUSE Product Security Team. The update corresponds to a low severity vulnerability and is functionally equivalent to Red Hat advisory RHSA-2024:9452. No specific affected versions or detailed vulnerability information have been provided.
A security update for Ruby has been issued by the SUSE Product Security Team addressing vulnerabilities including CVE-2024-27280 and related CVEs. The update corresponds functionally to Red Hat advisory RHSA-2024:3670. The severity of these vulnerabilities is assessed as low. No specific affected Ruby versions are explicitly stated beyond certain SUSE package versions. No CVSS score is provided, and no known exploits are reported in the wild.