### Summary
Marketplace runtime extension metadata could point at unscanned payloads. In affected versions, a package selected for installation by a trusted operator could redirect runtime loading toward hidden package content that was not scanned as expected.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
### Impact
When the affected feature is enabled and reachable, this could load plugin code outside the reviewed package entry points. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
### Patched Versions
The first stable patched version is `2026.5.18`.
### Mitigations
Install only trusted plugins and keep plugin allowlists explicit until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
### Summary
Embedded runner policy could be confused by provider aliases. In affected versions, a request using provider aliases could compare policy against an alias instead of the canonical provider identity.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
### Impact
When the affected feature is enabled and reachable, this could select bundled tool access outside the intended provider policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
### Patched Versions
The first stable patched version is `2026.4.25`.
### Mitigations
Avoid provider alias routing for embedded runner tool policy until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
### Summary
Combined POSIX shell options could confuse exec revalidation. In affected versions, a command request using combined shell flags could parse approval-time and execution-time shell options differently.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
### Impact
When the affected feature is enabled and reachable, this could run inline shell content without the intended allowlist decision. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
### Patched Versions
The first stable patched version is `2026.5.12`.
### Mitigations
avoid combined shell option forms in allowlisted commands until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
### Summary
OpenClaw's QQBot channel can deliver native approval buttons for exec and plugin approvals. In affected releases, the button callback path resolved approvals without enforcing the configured QQBot approver identity.
The text command approval path used the authorization check; the issue was specific to native QQBot approval buttons.
### Affected configurations
This affects deployments where QQBot native approval buttons are enabled and an approval message is visible to a QQ user who is not configured as an approver.
### Impact
A non-approver who could see the approval message could click an approval button and resolve the pending request. Depending on the pending approval, this could allow an exec or plugin action that should have required an authorized approver.
### Patched Versions
The first stable patched version is `2026.5.18`.
### Mitigations
Upgrade to `openclaw@2026.5.18` or later. Before upgrading, avoid delivering native approval buttons into QQ conversations that include users who should not be able to approve.
### Summary
Slack plugin approvals used the exec approver gate for plugin actions. In affected versions, a Slack user authorized only for exec approvals could resolve a plugin approval through the exec approver gate.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
### Impact
When the affected feature is enabled and reachable, this could approve a plugin action outside the operator's intended approval split. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
### Patched Versions
The first stable patched version is `2026.5.12`.
### Mitigations
keep approval allowlists aligned and review Slack approval actions manually until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
### Summary
OpenClaw nodes send lifecycle events back to the gateway. In affected releases, a paired node could send an exec lifecycle event that was accepted without enough provenance tying it to an authorized `system.run` request.
This issue affects the node event boundary. It does not allow an unauthenticated caller to reach the gateway; the attacker must already control a paired node connection.
### Affected configurations
This affects deployments with a paired node where that node can send crafted `node.event` messages to the gateway and the target agent/session can process exec lifecycle events.
### Impact
A malicious or compromised paired node could make the gateway treat attacker-supplied event data as an exec lifecycle result. In the vulnerable flow, that could steer the target session into an exec-event path that exposed capabilities the reduced node surface should not have provided.
The issue is a missing provenance check for node-originated lifecycle events.
### Patched Versions
The first stable patched version is `2026.5.18`.
### Mitigations
Upgrade to `openclaw@2026.5.18` or later. Pair nodes only from trusted environments, and remove/re-pair nodes that may have been compromised.
### Summary
OpenClaw's browser control SSRF checks blocked direct navigation to private or loopback URLs, but some Playwright `act` interactions could trigger navigation after the initial check. A later browser evaluation could then read from the page reached by that action-triggered navigation.
This issue is specific to browser control actions and private-network navigation policy. Browser evaluation remains an intentional trusted-operator feature when it is used on pages that policy allowed the browser to visit.
### Affected configurations
This affects deployments where browser control is enabled and an authenticated browser-control caller can interact with an attacker-controlled page that redirects or navigates the tab to a private-network target through a UI action.
### Impact
If the browser reached a private page through an unchecked action-triggered navigation, a caller with browser evaluation capability could read page content that direct navigation policy would have blocked.
The issue does not grant access to OpenClaw without authentication. It bypasses the private-network navigation guard for a specific browser action path.
### Patched Versions
The first stable patched version is `2026.5.18`.
### Mitigations
Upgrade to `openclaw@2026.5.18` or later. Before upgrading, restrict browser-control access to trusted operators and avoid using browser control on untrusted pages in environments with sensitive private web services.
A path-confinement bypass vulnerability in openclaw-cli versions up to 2026.3.1 allowed writes outside intended root directories during browser output handling. This issue was fixed in version 2026.3.2 by unifying root-bound, file-descriptor-verified write semantics and canonical path-boundary validation across browser output and related install/skills write paths.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.14 are affected by a cross-site request forgery (CSRF) vulnerability in browser-facing localhost mutation endpoints. These endpoints accept cross-origin requests without proper Origin or Referer validation, allowing malicious websites to trigger unauthorized state changes in the victim's local OpenClaw browser control plane. The vulnerability is mitigated by rejecting mutating HTTP methods when requests indicate a non-loopback Origin or cross-site fetch context. A patch is available that enforces these checks, and enabling authentication on the browser control interface also mitigates risk.
OpenClaw CLI versions up to 2026.2.13 have a vulnerability in the Telnyx webhook handler of the optional voice-call plugin that allows unauthenticated HTTP POST requests if the Telnyx public key is not configured. This enables attackers to forge Telnyx events. The issue affects deployments where the voice-call plugin is enabled and the webhook endpoint is accessible to attackers. A fix is planned for version 2026.2.14 and later, which enforces signature verification by requiring the Telnyx public key configuration.
OpenClaw CLI versions before 2026.2.15 embed the current working directory path into LLM prompts without sanitization. This allows an attacker who can control the directory name to inject control or format characters, potentially altering the prompt structure and injecting malicious instructions. The vulnerability was patched in version 2026.2.15 by sanitizing the workspace path to remove such characters.
OpenClaw CLI versions up to 2026.2.14 are affected by a stored cross-site scripting (XSS) vulnerability in the Control UI. The vulnerability arises from unsanitized assistant identity values (name/avatar) being injected into an inline script tag without proper escaping, allowing script injection. This can lead to execution of attacker-controlled JavaScript in the UI context. The issue is fixed in version 2026.2.15 by removing inline script injection and adding a restrictive Content Security Policy.
A command injection vulnerability exists in the openclaw CLI on macOS when refreshing keychain credentials. The vulnerability arises because user-controlled OAuth tokens are passed unsafely to a shell command, allowing potential OS command injection. This issue affects openclaw versions up to 2026.2.13 on macOS. The vulnerability is fixed in version 2026.2.14 by avoiding shell invocation and using a safer execFileSync call.
OpenClaw CLI's tools.exec.safeBins validation for the 'sort' command can be bypassed using GNU long-option abbreviations in allowlist mode, allowing execution without required approval. This affects versions up to 2026.2.22-2 and is fixed in version 2026.2.23. The vulnerability arises because long-option handling only matched denied flags by exact string and accepted unknown long options with inline values instead of failing closed.
OpenClaw CLI versions up to 2026.2.1 have an authentication bypass vulnerability in the optional voice-call extension when using inbound allowlist or pairing policies. The flaw allows calls with empty or missing caller IDs and calls from numbers ending with an allowlisted number to bypass access controls. This could enable unauthorized callers to reach voice-call agents. The issue is fixed in version 2026.2.2 by rejecting calls with missing caller IDs and enforcing strict caller ID matching.
A vulnerability in the optional Twitch plugin of the OpenClaw CLI allowed unauthorized Twitch users to trigger the agent pipeline despite being excluded by the configured allowlist. This occurred because the 'allowFrom' user ID list was not properly enforced when 'allowedRoles' was unset or empty, resulting in an authorization bypass. The issue affects OpenClaw versions from 2026.1.29 up to but not including 2026.2.1. A fix is available in version 2026.2.1.
OpenClaw CLI versions up to 2026.2.1 have a critical vulnerability (CVE-2026-28470) that allows bypassing the exec approvals allowlist via command substitution or backticks inside double quotes. This issue only affects setups that explicitly enable the optional exec approvals allowlist feature; default installations are not impacted. The vulnerability is fixed in version 2026.2.2 and later by rejecting unescaped command substitutions and backticks during allowlist analysis.
OpenClaw CLI versions prior to 2026.2.12 use a non-constant-time string comparison for hook tokens, allowing an attacker with network access to the hooks endpoint to potentially infer the token via timing attacks. This requires many requests and is complicated by real-world network latency. The vulnerability has a medium severity score of 4.8. A patch is available in version 2026.2.12.
OpenClaw CLI versions before 2026.2.23 have a medium severity vulnerability (CVE-2026-31992) where the allowlist exec-guard can be bypassed using 'env -S'. This causes a mismatch between policy analysis and runtime execution for shell wrapper payloads, weakening safety controls designed for trusted operators. The issue is fixed in versions 2026.2.23 and later.
Openclaw CLI versions up to 2026.2.17 have a vulnerability in the tools.exec.safeBins feature that allows bypassing intended stdin-only restrictions. This occurs when the sort command's output flags (-o/--output) or recursive grep flags are permitted, enabling unintended file writes or recursive file reads. The issue is fixed in versions 2026.2.19 and later.