OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid `file:` URL spellings supplied over the Agent Client Protocol (ACP) were treated as relative paths and were incorrectly classified as reads scoped to the session working directory. When an operator connected `openclaw acp client` to an untrusted or compromised ACP peer, that peer could request a read of a file outside the session working directory without the approval prompt normally required for that path, resulting in disclosure of local file contents. The demonstrated impact is limited to file confidentiality; mutating and command-capable tool classes are not affected. This issue is fixed in OpenClaw 2026.8.1.
OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained listings so that entry-count and size checks pass, and the archive is then extracted in full. If an operator approves installation of such a malicious or compromised skill archive, over-limit files or entry counts are persisted in the skill tools directory, consuming disk space or inodes. The issue bypasses OpenClaw's extraction budgets but does not by itself execute archive contents. Fixed in 2026.8.1.
OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admission check, so a Teams member who is not on the allowlist can still trigger the configured agent despite the administrator's group boundary. The impact depends on the conversations, tools, and data available to that agent. The issue is fixed in version 2026.8.1.
OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as offline password verifiers: a caller able to obtain the redacted configuration (for example via config.get) could test password candidates offline without going through the rate-limited Gateway authentication path. Recovering the password could grant the documented shared-secret operator authority. Secret references were not affected in the same way. The issue is fixed in 2026.8.1.
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a different fallback provider while still reusing the primary provider's configured API key, causing that credential to be transmitted as a bearer token to an unintended vendor. The practical impact depends on the configured providers, whether failover occurs, and the privileges attached to the primary provider key. The issue is fixed in 2026.8.1; as a workaround, disable cross-provider embedding fallback or configure each provider with separate, narrowly scoped credentials.
OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory_get tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit disablement like an unavailable configuration snapshot and restores the stale authority. As a result, during an already-running agent turn the model can continue searching and reading durable memory after the operator revoked that access, for the remainder of that run. Exploitation requires memory to be disabled while a previously created memory tool remains active. The issue is fixed in 2026.8.1.
OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filename generation was enabled for an agent reachable by lower-trust senders, model-mediated instructions could cause the helper to invoke tools outside that sender's effective policy; the demonstrated impact was the creation of persistent scheduled work. Exploitability depends on the model acting on the injected instruction and on which tools the helper exposes. The issue is fixed in 2026.8.1; as a workaround, disable session-memory filename generation for agents reachable by lower-trust senders.
OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a transcript to inherit another speaker's owner status. In Discord agent-proxy voice sessions using the affected realtime control path, an utterance from a non-owner participant could reach the downstream agent boundary marked as owner, so owner-sensitive behavior is applied to the wrong speaker. Exploitation depends on concurrent transcript timing and on the tools and commands available to the affected agent. The issue is fixed in 2026.9.2; as a workaround, disable Discord realtime voice for agents that distinguish owner and non-owner senders.
OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local file to be read and returned via a final-response media directive or a message attachment, disclosing local file contents to an admitted requester whose agent turn did not include the read tool. Exploitation requires knowledge or derivation of a useful host path and a delivery flow that accepts local attachments. The issue is fixed in version 2026.8.1.
OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to an unattended background (dreaming) agent holding broader file and command capabilities, allowing actions beyond the authority of the original turn and affecting files, commands, or services available to that agent. Exploitation requires the content to be captured, selected for later processing, and followed by the model. The issue is fixed in 2026.8.1.
OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot reload retains that provider's credential while the OpenAI SDK selects its own default endpoint. A resulting request could disclose the configured third-party provider credential to an unrelated provider endpoint and fail with a misleading authentication error. Operators who observed this condition should rotate the affected credential. The issue is fixed in 2026.8.1.
OpenClaw CLI versions before 2026.5.19 contain a vulnerability where message read actions can bypass channel allowlist checks. This allows lower-trust callers with access to these actions to request messages from channels they should not normally access. The impact depends on the operator's configuration and whether untrusted inputs can reach the vulnerable path. The issue does not affect the trusted-operator model but can expose sensitive messages if the feature is enabled and reachable. A fix is available in version 2026.5.19.
OpenClaw CLI had a vulnerability where certain browser control interactions could bypass private-network navigation checks, allowing authenticated users with browser evaluation capabilities to read content from private or loopback URLs. This issue affected versions prior to 2026.5.18 and was fixed in that release. The vulnerability requires authenticated access and does not grant unauthorized access to OpenClaw itself. Mitigation involves upgrading to version 2026.5.18 or later and restricting browser control access to trusted operators before patching.
OpenClaw CLI versions prior to 2026.5.18 contain a vulnerability where marketplace runtime extension metadata can redirect runtime loading to unscanned payloads. This allows a package selected by a trusted operator to load plugin code outside the reviewed package entry points. The vulnerability depends on the operator's configuration and whether lower-trust input can reach the affected feature. A fix is available in version 2026.5.18.
A vulnerability in OpenClaw CLI's Control UI allows an attacker with network access to spoof locality information during pairing, potentially obtaining a durable admin device token. This issue affects LAN/shared-token deployments where locality signals are trusted for pairing decisions. The vulnerability enables persistence of admin access even after shared tokens are rotated unless the paired device is removed. It is not exploitable remotely without prior network/authentication access. A fix is available in version 2026.5.22.
OpenClaw CLI versions prior to 2026.5.20 contain a vulnerability where hook-triggered runs using a configured hook token could escalate privileges by selecting a CLI backend with owner-level MCP tool authority. This affects deployments with hooks enabled and accessible hook tokens, potentially allowing unauthorized access to owner-only MCP tools. The issue is fixed in version 2026.5.20.
A vulnerability in openclaw-cli allows a workspace .env file to override the Homebrew executable selection during skill install flows. This could cause an unintended Homebrew-compatible executable to run if the feature is enabled and reachable. The issue affects versions prior to 2026.5.27. The vulnerability relies on trusted operators opening repositories with a crafted .env file. The impact depends on the operator's configuration and the trust level of inputs reaching the affected path. A patch is available in version 2026.5.27. Until patched, it is recommended to avoid running skill install flows from untrusted workspaces and to apply configuration hardening measures.
OpenClaw CLI versions prior to 2026.4.25 contain a vulnerability where fake package roots can influence memory-core artifact loading. This occurs because a local package root resolution path, influenced by workspace state, may select an unintended package root. The vulnerability affects configurations where the feature is enabled and reachable, potentially allowing loading of memory-core artifacts from unintended local locations. The impact depends on operator configuration and whether lower-trust input can reach the affected path. The vulnerability is patched starting from version 2026.4.25. Until patched, it is recommended to run memory-core flows only from trusted workspaces and apply general hardening such as narrowing allowlists and disabling the feature when not needed.
OpenClaw CLI has a vulnerability where the embedded runner policy can be confused by provider aliases. This means that requests using provider aliases might compare policy against an alias rather than the canonical provider identity, potentially allowing access to bundled tools outside the intended provider policy. The issue affects versions before 2026.4.25. The vulnerability has a low severity score and does not affect the trusted-operator model of OpenClaw. Mitigation includes avoiding provider alias routing for embedded runner tool policy until patched and applying general hardening measures.
OpenClaw CLI versions prior to 2026.5.18 contain a vulnerability where paired nodes can forge exec lifecycle events without sufficient provenance verification. This allows a malicious or compromised paired node to send crafted lifecycle events to the gateway, potentially causing the gateway to treat attacker-supplied data as legitimate exec lifecycle results. The vulnerability requires the attacker to already control a paired node connection and does not allow unauthenticated access to the gateway. The issue is resolved in version 2026.5.18.