A vulnerability in openclaw-cli versions up to 2026.3.24 allows authorization bypass in Google Chat due to reliance on mutable space display names for group policy binding. This flaw permits rebinding of group policies when display names change or collide. The issue is fixed in version 2026.3.25 by enforcing stable group IDs for access decisions.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.24 contain an authorization bypass vulnerability (CVE-2026-35620) that allows a non-owner command-authorized sender to change the owner-only `/send` session delivery policy. This flaw permits persistent mutation of the current session's delivery policy, enabling lower-trust participants to disable or re-enable reply delivery or remove session overrides, despite `/send` being documented as owner-only. The vulnerability has a medium severity rating with a CVSS score of 5.4. A fix is available in OpenClaw version 2026.3.24.
OpenClaw CLI versions prior to 2026.3.22 have a vulnerability where mutating internal ACP chat commands do not enforce the operator.admin scope. This allows users with lower privileges to perform mutating control-plane actions that should be restricted. The issue was fixed in version 2026.3.22 and later.
OpenClaw CLI versions prior to 2026.3.22 have a vulnerability where remote media HTTP error responses are read without a hard size limit, allowing unbounded memory allocation before failure handling. This issue was fixed in version 2026.3.22 by enforcing capped reads and truncating oversized error bodies.
OpenClaw CLI versions prior to 2026.3.22 have a vulnerability where Trusted-proxy Control UI sessions without device identity could retain self-declared privileged scopes on device-less allow paths. This could lead to unauthorized privilege retention. The issue was fixed in version 2026.3.22 and later versions.
OpenClaw CLI's Feishu webhook component reads and parses JSON request bodies before validating the request signature in versions up to 2026.3.24. This behavior allows unauthenticated callers to force the server to perform full JSON parsing on potentially malicious or large payloads before the request is rejected. The issue was fixed in version 2026.3.25 by changing the code to validate the signature on the raw request body before parsing JSON.
OpenClaw CLI versions prior to 2026.3.22 have an inconsistent sanitization issue in the handling of gateway host execution environment overrides. This flaw allows blocked or malformed override keys to bypass the shared host environment policy due to inconsistent sanitization paths. The vulnerability was fixed in version 2026.3.22 and later versions.
OpenClaw CLI versions from 2026.2.13 up to 2026.3.24 are vulnerable to an ANSI escape sequence injection in the ACP CLI approval prompt. This vulnerability allows untrusted tool metadata to inject ANSI control sequences into approval prompts and permission logs, potentially spoofing terminal output. The issue was fixed in version 2026.3.25 by sanitizing tool titles and expanding ANSI sequence stripping.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.24 contain an incomplete fix for CVE-2026-27486. The `!stop` chat command uses an unpatched function that immediately sends SIGKILL to background bash processes without first sending SIGTERM, preventing graceful shutdown. This behavior was intended to be fixed by introducing a graceful shutdown sequence that sends SIGTERM first and only escalates to SIGKILL after a grace period. The incomplete fix leaves a copy of the vulnerable kill function in the codebase, which is still used by the `!stop` command. A patch is available in OpenClaw 2026.3.24 that addresses this issue.
OpenClaw CLI versions before 2026.4.2 have a vulnerability where untrusted workspace channel shadows could execute code during built-in channel setup. This occurs because the setup and login process could resolve an untrusted workspace channel shadow before the plugin was explicitly trusted. A malicious workspace plugin claiming a bundled channel ID could execute during channel setup even if disabled, bypassing the intended trust boundary.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.31 contain a vulnerability where a workspace .env file can override the bundled hooks root directory. This allows loading of attacker-controlled hook code, potentially compromising confidentiality, integrity, and availability. The issue is patched in version 2026.3.31 and later.
OpenClaw CLI versions prior to 2026.4.2 exposed local host configuration and state directory paths to non-admin authenticated clients via the Gateway connect success snapshot. This information disclosure vulnerability allows low-privilege users to learn filesystem layout and deployment metadata that are unnecessary for their role. The issue does not allow direct authorization bypass but could aid in host fingerprinting and chained attacks. The vulnerability is fixed in version 2026.4.2.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.28 contain a vulnerability where remote onboarding accepts discovered gateway endpoints without explicit trust confirmation before saving connection details. This allows a malicious or spoofed discovery endpoint to redirect onboarding to an attacker-controlled gateway, potentially capturing gateway credentials and traffic. The issue is fixed in version 2026.3.28.
A vulnerability in the openclaw CLI package (openclaw) allows bypassing Telnyx webhook replay detection due to Base64 signature re-encoding. Versions up to 2026.3.28 are affected. The issue was fixed in version 2026.3.31. The vulnerability has a CVSS score of 5.3 (medium severity) and does not impact integrity or availability, only confidentiality to a limited extent.
OpenShell's 'mirror' mode in the openclaw-cli package can convert untrusted sandbox files into workspace hooks that execute on the host during gateway startup. This vulnerability affects versions prior to 2026.3.28 and requires mirror mode, hooks enabled, explicit hook opt-in, and a restart to exploit. A fix was released in version 2026.3.28.
A vulnerability in the openclaw-cli package allows a gateway operator with write permissions to reach admin-class Talk Voice configuration persistence via the chat.send function. This issue affects versions from 2026.1.29 up to but not including 2026.3.28. The vulnerability is considered medium severity and has been fixed in version 2026.3.28.
A vulnerability in the openclaw CLI (CVE-2026-41388) allows the startup migration process to incorrectly rehydrate revoked Tlon configuration data from file state when empty-array revocations are treated as missing. This issue affects versions prior to 2026.3.31 and has been fixed in version 2026.3.31.
OpenClaw CLI versions before 2026.4.2 have a vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. This allows attacker-controlled pages loaded from local-network or tailnet hosts to dispatch agent.request actions without stricter origin checks. The vulnerability enables injection of unauthorized non-owner agent.request runs into active iOS node sessions, affecting session state and resource consumption. Owner-only actions or arbitrary host execution were not demonstrated. The issue is patched in version 2026.4.2.
An incomplete fix for CVE-2026-32062 in the openclaw-cli package allows oversized WebSocket frames to be parsed before validation during voice calls. This resource-consumption vulnerability affects versions prior to 2026.3.31 and has a medium severity rating. The issue was addressed in version 2026.3.31.
OpenClaw CLI versions before 2026.3.31 contain a low-severity access control vulnerability where the diffs viewer misclassifies proxied remote requests as local loopback when the 'allowRemoteViewer' setting is disabled. This misclassification could lead to unintended access control behavior. The issue is fixed in version 2026.3.31.