A vulnerability in openclaw-cli versions up to 2026.2.14 allows the admin-only skills installation process to write files outside the intended sandbox directory due to insufficient validation of the target directory path. This could lead to unauthorized file writes outside the per-skill tools directory. A fix is planned for version 2026.2.15.
OpenClaw CLI versions up to 2026.3.2 have a vulnerability in the system.run dispatch-wrapper handling where shell-wrapper approval gating can be bypassed under specific conditions involving four transparent dispatch wrappers. This mismatch allows execution planning to unwrap through to the shell payload without triggering the expected approval in security=allowlist mode. The issue is fixed in version 2026.3.7 by aligning shell-wrapper classification with execution planning at the configured dispatch depth boundary.
Openclaw CLI versions up to 2026.2.17 have a vulnerability in Discord moderation action handling where sender identity is taken from untrusted request parameters instead of a trusted runtime context. This allows a non-admin user with the bot's guild permissions to spoof sender identity and request moderation actions such as timeout, kick, or ban. The issue is fixed in version 2026.2.18 by using a trusted sender context and adding permission checks.
The OpenClaw CLI's local skill packaging script previously followed symlinks when creating .skill archives, potentially including unintended local files outside the skill directory. This vulnerability is limited to local execution by skill authors packaging skills and does not affect remote or runtime components. The issue is fixed by rejecting symlinks during packaging in version 2026.2.18.
OpenClaw CLI versions before 2026.2.14 have a vulnerability in their process cleanup routine where the tool may kill unrelated processes on shared hosts due to unvalidated PID termination based on pattern matching. This occurs because the cleanup did not verify process ownership before sending SIGKILL signals. The issue is fixed in version 2026.2.14 by restricting termination to child processes owned by the current process and improving matching logic.
The Openclaw CLI npm package versions up to 2026.2.17 contain a server-side request forgery (SSRF) vulnerability in the cron webhook delivery mechanism. The vulnerability arises because the code uses fetch() directly without SSRF policy checks, allowing webhook targets to access internal or private endpoints. This issue was fixed in versions after 2026.2.17 with specific commits addressing the problem.
OpenClaw CLI versions before 2026.2.24 contain a vulnerability where message actions 'sendAttachment' and 'setGroupIcon' can hydrate media from local absolute paths if the 'sandboxRoot' is unset. This bypasses local media root checks and could allow reading arbitrary files accessible to the runtime user. The issue is fixed in version 2026.2.24 and later.
OpenClaw CLI versions up to 2026.2.23 contain a vulnerability in sandbox bind-source validation. The issue allows bypassing allowed-root and blocked-path checks by using a symlinked parent directory combined with a non-existent leaf path. This causes the sandbox boundary enforcement to be weakened, potentially allowing paths to resolve outside intended allowed roots. The vulnerability is fixed in version 2026.2.24 by improving canonicalization of paths during validation.
OpenClaw CLI's runtime `/debug set` override functionality accepted prototype-reserved keys such as `__proto__`, `constructor`, and `prototype`. This vulnerability affects runtime in-memory overrides only, which are non-persistent and cleared on restart. The `/debug` command is disabled by default and requires prior authorization to invoke, with no unauthenticated exploitation vector identified. The issue is addressed in the planned release 2026.2.21 by blocking reserved prototype keys during deep merges and sanitizing nested object values. This vulnerability is considered a defense-in-depth hardening measure rather than a critical security flaw.
OpenClaw CLI versions up to 2026.2.25 contain a vulnerability where the approval context for node system.run executions can be bypassed by rebinding a writable parent symlink in the current working directory (cwd) after approval. This allows a command approved for one filesystem location to execute from a different location if the parent symlink changes between approval and execution. The issue is fixed in version 2026.2.26 by enforcing immutable approval-time plan preparation and rejecting mutable parent-symlink path components during approval-plan building.
OpenClaw CLI versions up to 2026.2.21-2 contain a vulnerability in the exec allowlist wrapper analysis where wrapper binaries such as env or shell dispatch chains were not fully unwrapped. This flaw allows an attacker with permission to trigger system.run requests under an allowlist policy to bypass intended restrictions by smuggling payloads through these wrappers. The issue is fixed in version 2026.2.22.
OpenClaw CLI versions up to 2026.2.17 have a vulnerability where the ACP prompt-size checks are missing in the local stdio bridge. This allows very large prompt text blocks to be accepted and assembled into oversized payloads before being forwarded to chat.send. The issue mainly affects local ACP clients, such as IDE integrations, that send unusually large inputs. The vulnerability can reduce responsiveness in local ACP sessions and increase model usage and costs. There is no privilege escalation or direct remote attack vector in the default ACP model. A patch is planned for version 2026.2.18.
A vulnerability in the openclaw-cli npm package versions up to 2026.3.2 allows sandboxed requester sessions to initialize host-side ACP sessions via the /acp spawn command. This occurs because the command path did not enforce the same runtime guard as other ACP spawn requests, enabling sandboxed sessions to cross into host-side ACP runtime initialization. The issue is fixed in version 2026.3.7 by adding a shared ACP runtime-policy guard to prevent unauthorized ACP session initialization from sandboxed contexts.
A race condition vulnerability in the OpenClaw CLI ZIP extraction process allows an attacker to write files outside the intended extraction directory by exploiting a parent-directory symlink rebind between path validation and file write. This issue affects versions prior to 2026.3.2 and has been fixed in version 2026.3.2.
OpenClaw CLI versions up to 2026.2.1 on Windows nodes have a critical vulnerability in their exec allowlist/approval gating. The vulnerability arises because the allowlist analysis does not properly model Windows cmd.exe parsing and metacharacter behavior, allowing crafted commands to bypass restrictions. This can lead to execution of unauthorized commands. The issue is fixed in version 2026.2.2 and later by improving allowlist enforcement and avoiding cmd.exe invocation in allowlist mode.
A vulnerability in the openclaw CLI's Slack integration allowed any Slack user who could send a direct message to the bot to execute privileged slash commands when the Slack DM policy was set to open. This bypassed intended allowlist and access-group restrictions. The issue affects openclaw versions from 2026.1.29 up to but not including 2026.2.14 when configured with dmPolicy=open. A patch is available in version 2026.2.14 that corrects the authorization logic for direct messages.
OpenClaw CLI versions from 2026.1.29 up to 2026.2.13 are vulnerable to a path traversal issue in the hook transform module loading mechanism. This allows an attacker with the ability to modify hook configurations to load and execute arbitrary JavaScript modules outside the intended directory, running code with gateway process privileges. The vulnerability is fixed in version 2026.2.14 by restricting transform module paths to a designated transforms root directory and rejecting attempts to escape it.
OpenClaw CLI's web_fetch tool is vulnerable to a denial of service (DoS) condition due to unbounded response parsing. An attacker can cause the OpenClaw Gateway process to exhaust memory or become unresponsive by supplying malicious web pages with oversized response bodies or deeply nested HTML. This vulnerability affects versions prior to 2026.2.15 and has been fixed in version 2026.2.15 by capping response body size and adding parsing safeguards.
A vulnerability in the OpenClaw CLI Chrome extension relay caused the relay HTTP/WS server to bind publicly when configured with a wildcard cdpUrl. This occurred because wildcard hosts were incorrectly treated as loopback addresses. The issue could expose relay endpoints off-host, leaking service presence and enabling denial-of-service or brute-force attacks against the relay token header. The flaw affects versions from 2026.1.14-1 up to but not including 2026.2.12 and was fixed in version 2026.2.12.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.1 contain a path traversal vulnerability in the plugin installation process. A malicious plugin's manifest name can cause files to be written outside the intended extensions directory, potentially overwriting files in the OpenClaw state directory. This issue affects POSIX and Windows systems, with Windows allowing deeper traversal due to improper backslash sanitization. The vulnerability requires an operator to install untrusted plugins, which may limit exposure in some deployments. The issue is fixed in version 2026.2.1 and later.