OpenClaw CLI versions up to 2026.2.25 have an authorization inconsistency where BlueBubbles group allowlist checks may incorrectly accept DM pairing-store identities as group members when configured with dmPolicy=pairing and groupPolicy=allowlist. This flaw allows DM-authorized identities to bypass explicit group membership checks for message and reaction ingress. The issue does not escalate privileges beyond existing DM authorization or bypass sandbox or gateway controls. A fix is planned for version 2026.2.26.
OpenClaw CLI's browser navigation guard allowed authenticated users to navigate to non-network URL schemes such as file://, enabling them to access local files readable by the OpenClaw process user. This vulnerability affects versions up to 2026.2.19-2 and is patched in the upcoming 2026.2.21 release. Exploitation requires authenticated access to the gateway with browser tooling enabled. The vulnerability has a CVSS score of 6.5 (medium severity).
OpenClaw CLI has a vulnerability (CVE-2026-32010) affecting non-default configurations where the 'sort' command is manually added to the safe-bin allowlist. This allows bypassing allowlist approval via the '--compress-program' flag, potentially running external programs without operator approval. Default installations are not affected as 'sort' is not included in safeBins by default. The issue is fixed in version 2026.2.22 and later.
OpenClaw CLI versions up to 2026.2.17 have a vulnerability in the exec allowlist safeBins policy that allows bypass via short-option payloads, enabling unauthorized file write operations. This occurs when the tools.exec.security setting is allowlist and safeBins includes affected binaries. The issue is fixed in version 2026.2.19.
OpenClaw CLI versions up to 2026.2.21-2 have an SSRF protection bypass due to incomplete IPv4 special-use range blocking in the web fetch guard. This allows certain IPv4 addresses in special-use/non-global ranges, such as 198.18.0.1, to bypass SSRF filtering. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 2026.2.22 and later.
OpenClaw CLI's safeBins exec tooling had a vulnerability allowing a stdin-only policy bypass for the grep command when used with the -e/--regexp flag. This flaw permitted reading files from the working directory, such as .env, if grep was explicitly enabled in safeBins. The issue affects versions up to 2026.2.19-2 and is fixed starting from 2026.2.21. Exploitation requires grep to be opt-in and the ability to invoke exec tooling under that profile. The CVSS score is medium severity (6.5).
OpenClaw CLI versions up to 2026.2.23 contain a vulnerability in sandbox media path validation that allows absolute paths under the host temporary directory to be accepted even if they lie outside the sandbox root. This enables attacker-controlled media references to read and exfiltrate files from the host tmp directory outside the sandbox boundary. The issue is fixed in version 2026.2.24.
OpenClaw CLI versions up to 2026.2.24 have a vulnerability where Discord direct-message reaction notifications do not consistently enforce the same authorization checks as normal DM messages. This allows non-allowlisted Discord users to enqueue reaction-derived system events in restrictive DM setups. The issue is limited to reaction ingress and does not directly enable command execution. A patch is available in version 2026.2.25 that aligns reaction ingress authorization with normal message checks.
OpenClaw CLI versions up to 2026.2.19-2 improperly parse the X-Forwarded-For header when requests come through trusted proxies. This allows attacker-controlled header values to influence security decisions that rely on client IP, such as authentication rate limiting and local/private classification. The vulnerability is mitigated if reverse proxies overwrite rather than append or preserve forwarding headers, as recommended by OpenClaw documentation. A patch is planned for version 2026.2.21.
OpenClaw CLI versions up to 2026.2.23 contain a vulnerability where a workspace-only sandbox guard mismatch allows certain @-prefixed absolute paths to bypass boundary validation. This flaw can enable reading files outside the intended workspace when the workspace-only mode is enabled. The issue is fixed in version 2026.2.24.
OpenClaw CLI versions up to 2026.2.19-2 have a vulnerability where enabling the insecure option 'gateway.controlUi.allowInsecureAuth: true' and exposing the Control UI over plaintext HTTP can allow an attacker with leaked or intercepted credentials to gain privileged operator access. This insecure deployment bypasses device identity and pairing guarantees. The issue was fixed in version 2026.2.21.
OpenClaw CLI contains a vulnerability in its HTML session exporter where image MIME types are interpolated into data-URL image sources without proper validation or escaping. This allows an attacker who can control image MIME types in session data to inject arbitrary JavaScript via crafted MIME types, leading to cross-site scripting (XSS) when the exported HTML is opened. The vulnerability affects versions from 2026.1.29 up to but not including 2026.2.23. A fix has been implemented by adding a sanitization helper that validates MIME types against a whitelist and defaults to a safe value for unrecognized types.
The OpenClaw CLI sandbox browser container launched Chromium with the --no-sandbox flag enabled by default, disabling Chromium's OS-level sandbox protections. This configuration weakens the isolation of the browser container and increases the potential impact of renderer-side vulnerabilities. The issue affects openclaw npm package versions up to and including 2026.2.19-2. A fix is planned for version 2026.2.21, which removes the default --no-sandbox flag and adds an explicit opt-in mechanism. Additional security measures include browser container hash migration and security audit checks to ensure stale containers are detected and safely recreated.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.25 contain a vulnerability in the handling of browser trace and download output paths. This flaw allows symlink traversal that escapes the intended temporary output directory, potentially enabling an attacker with local access and the ability to influence output paths to overwrite arbitrary files. A patch is planned in version 2026.2.25 to address this issue.
OpenClaw CLI's sandbox browser noVNC observer sessions launched x11vnc without requiring VNC authentication, allowing local users or those with access to the exposed port to connect without a password. The noVNC port was published only to the host loopback interface by default, limiting exposure to local access unless explicitly exposed more broadly. This vulnerability affects versions up to 2026.2.19-2 and is fixed in version 2026.2.21 and later by enforcing password authentication and generating per-container noVNC passwords and short-lived observer tokens.
OpenClaw CLI versions up to 2026.3.10 contain a vulnerability where sandboxed leaf subagents can bypass session boundaries and control sibling sessions. This allows a low-privilege sandboxed worker to steer or kill sibling runs owned by the same requester, potentially executing with broader tool policies. The issue is fixed in version 2026.3.11 by restricting subagent control access and enforcing descendant-only control scope.
A critical authorization vulnerability in openclaw CLI versions before 2026.3.11 allows a user with operator.pairing scope to mint tokens with broader scopes, including operator.admin, for paired devices. This flaw enables unauthorized administrative access and can lead to remote code execution on connected nodes. The issue is fixed in version 2026.3.11.
OpenClaw CLI versions up to 2026.3.8 contain a vulnerability in the public gateway 'agent' RPC that allows an authenticated operator with 'operator.write' permission to override workspace boundaries. This enables the operator to run processes outside the intended workspace directory, potentially accessing and executing files from arbitrary directories. The issue is fixed in version 2026.3.11 and later.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.28 contain a vulnerability in the node pairing approval process. The flaw allows a low-privilege operator to approve node pairing requests with broader scopes than they possess, potentially escalating privileges on the paired node. This issue is fixed in version 2026.3.28.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.28 contain a vulnerability where removing a device or revoking its token does not terminate active WebSocket sessions. This allows revoked devices to maintain access through existing live sessions until they reconnect. The issue is fixed in version 2026.3.28.