OpenClaw CLI versions prior to 2026.5.12 contain a vulnerability where combined POSIX shell options can cause confusion during exec revalidation. This may lead to inline shell commands executing without proper allowlist approval. The issue affects configurations where the feature is enabled and reachable, potentially allowing unintended command execution depending on operator setup. The vulnerability does not alter the trusted-operator model of OpenClaw. A fix is available in version 2026.5.12.
A vulnerability in OpenClaw CLI's MCP loopback feature allows non-owner callers to bypass owner-only tool policies and before-tool-call hooks. This issue affects versions from 2026.1.29 up to but not including 2026.4.24. The impact depends on the operator's configuration and whether untrusted inputs can reach the affected loopback path. A patch is available to address this issue. Until patched, restricting MCP loopback access to trusted operators and narrowing allowlists is recommended.
OpenClaw CLI's Matrix allowFrom feature could bind to mutable display names, allowing a Matrix account that can change display name metadata to match a policy entry through mutable display metadata. This vulnerability affects versions prior to 2026.5.7 and could lead to unauthorized agent access intended for another Matrix identity. The issue does not alter OpenClaw's trusted-operator model but depends on operator configuration and input trust levels. A patch is available in version 2026.5.7.
OpenClaw CLI versions prior to 2026.5.18 have a vulnerability in the QQBot native approval buttons where the configured approver identity is not enforced. This allows any QQ user who can see an approval message to click the approval button and resolve the request, potentially executing actions without proper authorization. The issue is specific to native QQBot approval buttons and does not affect text command approvals. A fix is available in version 2026.5.18.
OpenClaw contains a vulnerability in its native command authorization that may bypass owner-command enforcement. This allows a sender able to trigger native command handling to authorize commands that should be restricted to owners only. The vulnerability affects versions prior to 2026.5.6. The impact depends on the operator's configuration and whether untrusted input can reach the vulnerable code path. A fix is available in version 2026.5.6. Until patched, it is recommended to restrict native command access to trusted senders and limit channel and tool allowlists.
OpenClaw versions prior to 2026.5.12 have a vulnerability where PowerShell encoded-command aliases may bypass execution allowlist checks. This occurs because abbreviated encoded-command flags can use alias forms not recognized by the allowlist parser. The vulnerability affects configurations where this feature is enabled and reachable, potentially allowing execution of encoded PowerShell content without proper allowlist validation. The issue does not alter OpenClaw's trusted-operator model and depends on operator configuration and input trust levels. A fix is available in version 2026.5.12. Until patched, it is recommended to avoid allowlisting PowerShell wrapper forms and require approval for encoded commands. Additional hardening includes narrowing allowlists, isolating Gateway users, and disabling the affected feature if not needed.
OpenClaw versions prior to 2026.5.7 have a vulnerability where trusted retry endpoint checks may incorrectly validate URLs by matching hostname prefixes rather than exact hostnames. This can allow lower-trust input to specify a retry endpoint URL that appears to be trusted but actually directs authentication material to an unintended external endpoint. The vulnerability affects the retry endpoint feature when enabled and reachable. The issue is mitigated by pinning retry endpoints to exact trusted origins and restricting access until the patched version is deployed.
OpenClaw versions prior to 2026.5.6 contain a vulnerability where Telegram interactive callbacks can bypass the commands.allowFrom sender allowlist. This allows a Telegram user invoking a callback to mark it as an authorized sender before the allowlist check is applied. The vulnerability affects only the Telegram callback feature and does not alter OpenClaw's trusted-operator model. The impact depends on the operator's configuration and whether untrusted input can reach the affected callback path. The issue is patched in version 2026.5.6. Until patched, restricting Telegram command callbacks to trusted chats and narrowing allowlists are recommended mitigations.
OpenClaw versions prior to 2026.4.24 have a vulnerability where Mattermost slash token revocation may not take immediate effect, allowing a revoked token to be accepted until the monitor refreshes. This issue affects the slash command feature when enabled and reachable. The vulnerability does not affect the overall trusted-operator model of OpenClaw. The practical impact depends on configuration and exposure to lower-trust inputs. A fix is available starting with version 2026.4.24. Until patched, restarting or refreshing the Mattermost monitor after token rotation mitigates the issue. Additional hardening includes restricting channel and tool allowlists, avoiding shared Gateways among untrusted users, and disabling the feature if not needed.
OpenClaw versions prior to 2026.4.22 have a vulnerability where Slack and Zalo webhook secrets may remain active after a secrets.reload operation. This allows a caller with an old webhook secret to continue sending webhook events during a brief stale-secret window after secret rotation. The vulnerability affects the webhook secret revocation process but does not alter OpenClaw's trusted-operator security model. The impact depends on the operator's configuration and exposure of the affected feature. A fix is available starting with version 2026.4.22.
OpenClaw versions prior to 2026.5.6 have a vulnerability in the Feishu dynamic-agent bindings feature where configWrites enforcement may be bypassed. This allows a Feishu sender using dynamic-agent binding behavior to create or update bindings without respecting configured config-write controls. The vulnerability does not affect OpenClaw's trusted-operator model and requires the affected feature to be enabled and reachable. The impact depends on the operator's configuration and whether lower-trust inputs can access this feature. The issue is fixed in version 2026.5.6.
OpenClaw versions prior to 2026.4.26 contain a vulnerability where spawning a child session from a sandboxed parent session could expose the real host workspace path to the child session prompt. This exposure may reveal sensitive workspace location or related memory context depending on the operator's configuration and trust boundaries. The issue does not affect the overall trusted-operator model but is scoped to the sandboxed session spawn feature. The vulnerability has moderate impact and no known exploits in the wild. Mitigation includes avoiding spawning child sessions from sensitive sandboxed workspaces until patched and applying configuration hardening such as narrow allowlists and disabling the feature if not needed.
### Summary
QQBot pre-dispatch slash commands could skip allowFrom checks. In affected versions, a QQBot sender able to invoke slash commands could dispatch the command before applying the configured allowFrom policy.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
### Impact
When the affected feature is enabled and reachable, this could trigger command handling from a sender that policy should have blocked. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
### Patched Versions
The first stable patched version is `2026.4.27`.
### Mitigations
restrict QQBot slash command exposure until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
OpenClaw versions prior to 2026.5.4 contain a vulnerability in the bundled device-pair plugin that allows authorized non-owner chat senders to issue device-pairing bootstrap codes. This enables these users to enroll devices with operator/node capabilities, which retain persistent credentials until removed. The vulnerability requires the attacker to have chat command access and does not affect unauthenticated users. The issue is fixed in version 2026.5.4.
OpenClaw versions prior to 2026.4.29 have a vulnerability in browser debug/export routes where already-open blocked tabs could be reused without reapplying the expected SSRF policy. This allows an attacker with access to these routes to potentially export or inspect content from tabs that should be protected by browser network policies. The vulnerability affects the specific feature and configuration related to browser debug/export routes and does not alter the trusted-operator model of OpenClaw. The issue is mitigated by closing blocked tabs before using debug/export features and restricting access to these routes until patched.
OpenClaw versions prior to 2026.5.2 have a vulnerability where message.action forwarding can send Gateway credentials to model-supplied loopback URLs. This occurs when model-controlled action metadata selects a loopback Gateway URL, causing the action payload and credentials to be forwarded to that URL. The vulnerability is limited to the named feature and configuration and does not affect the overall trusted-operator model. Exploitation depends on the operator's configuration and whether untrusted input can reach the affected path. The issue is patched in version 2026.5.2.
A vulnerability in OpenClaw's QQBot admin commands allows bypassing DM-only and allowFrom policy checks. This means that admin commands intended to be restricted to direct messages or specific senders can be triggered from unauthorized contexts. The issue affects versions prior to 2026.4.29. The vulnerability does not alter the overall trusted-operator model of OpenClaw but can lead to unauthorized execution of admin commands depending on configuration. The first stable patched version is 2026.4.29. Mitigations include disabling the affected QQBot admin commands or restricting QQBot access until the patch is applied.
### Summary
Mattermost handlers could fall open when channel type was missing. In affected versions, a Mattermost event missing channel type metadata could continue without applying the intended DM policy decision.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
### Impact
When the affected feature is enabled and reachable, this could process a Mattermost event that should have been gated by channel policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
### Patched Versions
The first stable patched version is `2026.5.6`.
### Mitigations
keep Mattermost bot access restricted and review channel metadata errors until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
OpenClaw's trusted-proxy Control UI mode improperly accepted client-declared operator scopes on WebSocket connections before these scopes were validated and bound to a server-approved pairing or authorization baseline. This vulnerability affects deployments using the trusted-proxy authentication mode, allowing a restricted or unpaired trusted-proxy client to gain elevated operator.admin authority on a live WebSocket connection. The issue is resolved in OpenClaw version 2026.5.18 and later.
OpenClaw's Slack allowFrom feature could bind to mutable display names, allowing a Slack account that can change its display name metadata to match a policy entry incorrectly. This vulnerability affects versions prior to 2026.5.3. The issue does not alter OpenClaw's trusted-operator model but may allow agent access intended for another Slack identity if the feature is enabled and reachable. The vulnerability is rated high severity. Mitigations include using stable Slack user IDs in allowlists until patched, narrowing channel and tool allowlists, avoiding sharing a Gateway between untrusted users, and disabling the affected feature when not needed.