OpenClaw's Slack allowFrom feature could bind to mutable display names, allowing a Slack account that can change its display name metadata to match a policy entry incorrectly. This vulnerability affects versions prior to 2026.5.3. The issue does not alter OpenClaw's trusted-operator model but may allow agent access intended for another Slack identity if the feature is enabled and reachable. The vulnerability is rated high severity. Mitigations include using stable Slack user IDs in allowlists until patched, narrowing channel and tool allowlists, avoiding sharing a Gateway between untrusted users, and disabling the affected feature when not needed.
A vulnerability in OpenClaw's Skill Workshop apply flow allows an agent tool call to override a pending approval state, applying changes before the expected approval step. This affects versions prior to 2026.5.6. The issue does not alter OpenClaw's trusted-operator model but can lead to unintended application of workshop changes depending on configuration and input trust levels. The vulnerability has moderate severity and no known exploits in the wild. Manual review of Skill Workshop changes and restricting tool access are recommended until the patch is applied.
A vulnerability in OpenClaw's QQBot streaming command allows mutation of configuration without requiring an explicit allowlist entry. Authenticated Gateway operators and trusted components remain unaffected unless separate policies are bypassed. The vulnerability can lead to unauthorized configuration changes if the feature is enabled and reachable. A patch is available in version 2026.4.29. Until patched, disabling the command or restricting it to trusted senders is recommended.
A vulnerability in OpenClaw's node pairing feature allows reconnection events to confuse the approval scope state, potentially broadening node authority beyond operator intent. This affects versions prior to 2026.5.27. The issue does not alter the trusted-operator model but can impact configurations where lower-trust inputs reach the affected feature. Operators should revoke unexpected node pairings and re-pair only trusted nodes until patched. The vulnerability is rated high severity.
OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions, allowing Slack users authorized only for exec approvals to resolve plugin approvals improperly. This vulnerability affects versions prior to 2026.5.12. The issue could lead to plugin actions being approved outside the intended approval split, depending on operator configuration and input trust levels. The vulnerability is mitigated by patching to version 2026.5.12 or later and by manual review of Slack approval actions until patched. Additional mitigations include maintaining narrow allowlists and disabling the affected feature when not needed.
A vulnerability in OpenClaw's memory-wiki ingest feature allows a Gateway caller with operator.write scope to read arbitrary local files instead of being restricted to intended ingest sources. This issue affects versions prior to 2026.5.12. The vulnerability does not alter the trusted-operator security model but can lead to unauthorized local file content being imported into wiki memory if the feature is enabled and accessible. The severity is assessed as medium based on the potential confidentiality impact without integrity or availability effects.
A vulnerability in OpenClaw's scoped Gateway chat.send route allows commands requiring higher privileges (operator.approvals or operator.admin) to be executed with only operator.write scope when routed through inherited external delivery routes. This affects deployments where scoped Gateway clients with operator.write can deliver commands into sessions with external routes. The issue is fixed in version 2026.5.18. Until upgraded, avoid granting operator.write tokens to clients that can deliver commands into sessions with external routes unless fully trusted.
OpenClaw's POSIX node system.run safe-bin allowlist can be bypassed due to shell expansion altering command interpretation. This allows a lower-privilege operator to cause an approved safe-bin command to read unintended local files on the node. The issue affects deployments using safe-bin or allowlist auto-approval with shell-expanded arguments on POSIX nodes. It is a policy enforcement gap in argument validation, not a direct unauthenticated takeover. The vulnerability is patched in OpenClaw version 2026.5.18.
### Summary
Same-host trusted-proxy deployments could accept local forged identity headers. In affected versions, a local same-host caller that can reach the proxy-facing Gateway port could supply identity headers normally reserved for the trusted proxy.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
### Impact
When the affected feature is enabled and reachable, this could receive operator identity associated with the forged headers. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
### Patched Versions
The first stable patched version is `2026.5.18`.
### Mitigations
bind trusted-proxy ingress behind the actual proxy and firewall direct same-host access. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
OpenClaw versions prior to 2026.5.18 contain a vulnerability where the shell wrapper argument vector (argv) can change between approval and execution. This discrepancy allows a command shape to be executed that was not originally checked against the allowlist, potentially bypassing intended command restrictions. The vulnerability affects the shell wrapper feature and depends on operator configuration and input trust boundaries. The issue does not alter OpenClaw's trusted-operator model but requires careful policy and approval management. A fix is available starting with version 2026.5.18.
OpenClaw contains a vulnerability in its bundled MCP loopback feature where the execution denylist may be bypassed during session spawn. This allows a caller with access to the affected session-spawn path to start a session with broader command execution capabilities than intended. The issue affects versions prior to 2026.5.12. The vulnerability does not alter OpenClaw's trusted-operator model but could be exploited if lower-trust input reaches the vulnerable path. Mitigation involves restricting access to trusted operators and applying the patch in version 2026.5.12.
OpenClaw versions prior to 2026.5.18 have a vulnerability in the exec approval UI where very long commands are truncated in the display, potentially hiding the full command from the approver. This truncation can cause an approver to unknowingly approve a command with a hidden suffix that executes additional operations. The issue affects deployments with exec approval enabled and requires both an authenticated requester and an approver. The vulnerability compromises approval integrity but does not expose exec functionality to unauthenticated users or alter the local-first trust model. A fix is available in version 2026.5.18.
OpenClaw MCP SSE redirects could forward Authorization headers, allowing a lower-trust caller or configured input path to execute or persist actions beyond their intended authorization. This vulnerability affects versions prior to 2026.6.5. The impact depends on the operator's configuration and whether lower-trust input can reach the vulnerable path. The issue is limited to the named feature and does not affect the trusted-operator model of OpenClaw. A fix is available in version 2026.6.5. Until upgrading, it is recommended to restrict the affected feature to trusted operators or disable it if not needed.
OpenClaw versions before 2026.5.6 contain an improper access control vulnerability in Mattermost event handlers. The flaw arises from failure to validate channel type metadata, allowing attackers to bypass direct message (DM) policy restrictions by sending crafted events missing channel type information. This vulnerability has a moderate severity rating and a CVSS score of 3.7. A patch is available to address this issue.
OpenClaw versions before 2026.4.27 have an authorization bypass vulnerability in QQBot pre-dispatch slash commands. This flaw allows authenticated users to bypass allowFrom policy checks, enabling them to invoke slash commands before access control policies are enforced. The vulnerability can lead to unauthorized command execution depending on operator configuration.
OpenClaw versions before 2026.5.18 contain a vulnerability in identity header validation that allows local same-host callers to forge trusted-proxy identity headers. This flaw enables attackers with access to the proxy-facing Gateway port to impersonate operator identities and potentially escalate privileges. The vulnerability has a high severity rating and a CVSS score of 7.7. A patch is available to address this issue.
OpenClaw versions prior to 2026.4.29 contain an authorization bypass vulnerability in the QQBot streaming command. This flaw allows authenticated users to modify the QQBot streaming configuration without requiring explicit allowFrom restrictions, bypassing intended administrative policies.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-mgq6-vr84-7m2j. This link is maintained to preserve external references.
### Original Description
OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization.
OpenClaw's gateway tool had a vulnerability where its config mutation guard relied on a denylist that became outdated as the config schema expanded. This allowed unsafe model-driven config writes to sensitive configuration paths, potentially crossing security boundaries. A compromised model with access to the owner-only gateway tool could persist dangerous config changes affecting command execution, network behavior, credentials, telemetry, and operator policies. The issue was fixed in version 2026.4.23 by replacing the denylist with a fail-closed allowlist that restricts config changes to narrow, safe settings only.
OpenClaw versions from 2026.3.22 up to but not including 2026.4.5 have a symlink traversal vulnerability in the handling of remote marketplace repository paths. This flaw allows attackers to provide crafted symbolic link paths to escape the intended repository root directory and access files outside the expected scope. The vulnerability is fixed in version 2026.4.5.