OpenClaw CLI versions up to 2026.2.25 contain an authorization bypass vulnerability in Signal group allowlist enforcement. When groupPolicy is set to allowlist, sender identities approved via direct message (DM) pairing-store could improperly bypass group allowlist checks. This occurs because DM pairing approvals leak into group allowlist evaluation, weakening the authorization boundary between DM pairing and group membership controls. The issue is fixed in version 2026.2.26 by isolating DM pairing-store entries to DM-only and enforcing explicit group allowlist boundaries.
A parsing mismatch vulnerability in the beta macOS companion app of OpenClaw CLI allows shell-chain payloads to bypass allowlist checks in the system.run command under specific conditions. This requires an authenticated caller with operator.write permission, a paired macOS beta node host, and exec approvals configured to security=allowlist with ask=on-miss. Default installs are not affected. The issue is fixed in the planned next release 2026.2.22.
OpenClaw CLI versions up to 2026.2.17 have a local command injection vulnerability in Windows Scheduled Task script generation due to unsafe handling of cmd arguments in generated gateway.cmd files. This allows cmd metacharacter-only values to be emitted without proper quoting or escaping, potentially causing unintended command execution when the scheduled task runs. The issue is fixed in version 2026.2.19 and later.
OpenClaw CLI on Windows contains a command injection vulnerability in a fallback path where the Lobster extension retries certain spawn failures using a shell. This fallback interprets tool-provided arguments via cmd.exe, potentially allowing command injection. The issue affects versions from 2026.1.21 through 2026.2.17 and is fixed in version 2026.2.19 by removing the shell fallback and enforcing safer execution methods.
OpenClaw CLI versions up to 2026.2.26 have a vulnerability where system.run approvals do not bind the executable identity for commands resolved via PATH tokens. This allows a previously approved action to execute a different binary if the PATH resolution changes after approval. The issue is fixed in version 2026.3.1 by requiring immutable systemRunPlan data and pinning path-token commands to their canonical executable identity.
OpenClaw CLI versions 2026.2.22 and 2026.2.23 contain an authorization flaw in the synology-chat channel plugin. When the dmPolicy is set to allowlist but the allowedUserIds list is empty or unset, unauthorized Synology senders can dispatch agents. This issue requires specific plugin setup and sender access, leading to a medium severity classification. The vulnerability is fixed in version 2026.2.24.
Openclaw CLI versions from 2026.2.26 up to but not including 2026.3.1 on Windows have a vulnerability in the ACPX wrapper resolution for .cmd/.bat files. The fallback to shell execution allowed the current working directory (cwd) to influence execution behavior, potentially compromising command execution integrity. This issue is fixed in version 2026.3.1 by enforcing explicit PATH/PATHEXT entrypoint resolution and strict fail-closed handling for unresolvable wrappers.
OpenClaw CLI versions up to 2026.2.17 contain a command injection vulnerability in the Lobster extension tool execution on Windows. The vulnerability arises from a fallback to Windows shell execution with shell metacharacter interpretation after subprocess spawn failures. This allows command injection via crafted command arguments. The issue is fixed in version 2026.2.19 by removing the shell fallback and using explicit executable/script argument execution.
OpenClaw CLI versions up to 2026.2.21-2 allow clients authenticated with a shared gateway token to connect as role=node without device identity verification. This bypass enables unauthorized injection of node.event messages, triggering agent request and voice transcript flows. The vulnerability is fixed in version 2026.2.22, which enforces device identity for role=node connections even when shared-token authentication succeeds.
OpenClaw CLI's sandboxed image tool bypasses the workspace-only file access restriction, allowing it to read and exfiltrate mounted images outside the designated workspace. This vulnerability affects versions prior to 2026.2.23 and was fixed by enforcing workspace-only constraints on the image tool's path resolution. The issue results in a sandbox boundary bypass with confidentiality impact but does not affect integrity or availability.
OpenClaw CLI versions up to 2026.3.1 contain an authentication bypass vulnerability in the plugin route `/api/channels/*` due to a mismatch in path canonicalization depth. This allows specially encoded alternate-path requests to evade authentication checks while still resolving to protected routes. The issue is fixed in version 2026.3.2 with improved canonicalization and stricter auth enforcement.
OpenClaw CLI versions prior to 2026.2.25 have a vulnerability in Slack interactive callbacks where sender authorization checks can be bypassed in shared workspace deployments. This allows unauthorized workspace members to enqueue system-event text into active sessions. The issue does not grant unauthenticated access, cross-gateway isolation bypass, or host-level privilege escalation. A patch is planned in version 2026.2.25.
An experimental tool in OpenClaw CLI called apply_patch could bypass workspace-only checks in certain sandbox configurations. This issue only affects opt-in sandbox setups with specific flags enabled and does not impact default installations where sandbox mode and the experimental tool are disabled. The vulnerability was fixed in OpenClaw CLI version 2026.2.23.
OpenClaw CLI versions up to 2026.2.23 have a vulnerability in the safeBins allowlist policy where static default trusted directories include writable package-manager paths like /opt/homebrew/bin and /usr/local/bin. An attacker with write access to these directories can place a malicious binary with the same name as a trusted executable (e.g., jq), causing OpenClaw to execute the attacker-controlled binary. This allows command execution within the OpenClaw runtime context. The issue is fixed in version 2026.2.24 by restricting trusted directories to immutable system paths and requiring explicit opt-in for user-managed paths.
OpenClaw CLI versions up to 2026.3.1 have a vulnerability in webhook handlers for BlueBubbles and Google Chat where request bodies are parsed before authentication. This allows unauthenticated attackers to send slow or oversized request bodies, causing a denial of service by tying up parser resources. The issue is fixed in version 2026.3.2 by enforcing authentication before body parsing and adding strict limits on request processing time and size.
OpenClaw CLI versions up to 2026.2.24 contain a vulnerability in the gateway agents.files.get and agents.files.set methods that allows symlink traversal. This flaw permits reading and writing files outside the intended workspace by following symlinks, potentially enabling arbitrary host file access within the gateway process permissions. The vulnerability is patched in version 2026.2.25, which enforces path containment and rejects out-of-workspace symlink targets.
OpenClaw CLI versions up to 2026.2.25 are vulnerable to a metadata spoofing issue during node reconnection. An attacker with an already paired node identity can spoof platform and deviceFamily metadata to bypass platform-based node command policies. This allows unauthorized access to commands restricted by the original platform. The vulnerability is fixed in version 2026.2.26 by signing and verifying the platform metadata in the device-auth payload and rejecting mismatched reconnect metadata.
OpenClaw CLI versions from 2026.1.21 up to but not including 2026.2.18 contain a vulnerability in the tools.exec.safeBins allowlist mechanism. The vulnerability allows an attacker who can influence the PATH environment before the gateway process starts to execute trojan binaries named as allowed executables, bypassing the allowlist checks. This issue is rated medium severity due to the prerequisite of controlling the gateway launch environment. The vulnerability is fixed in version 2026.2.19 by enforcing that allowed executables must reside in trusted system directories.
OpenClaw CLI on macOS has a vulnerability in its optional exec-approval allowlist mode where basename-only entries are treated as trusted commands. This allows a local binary with the same name as an allowed command to execute without approval under certain security settings. The default security posture is not affected. A patch is planned in version 2026.2.22 to enforce path-only allowlist matching and remove basename fallback.
CVE-2026-32018 affects the openclaw-cli package, where concurrent operations on the sandbox registry can cause race conditions leading to lost updates or resurrection of removed entries. This occurs due to read-modify-write registry writes without proper locking, causing stale snapshots and overwrites. The issue impacts sandbox state consistency and related commands such as sandbox list, prune, and recreate. Versions up to 2026.2.17 are affected, with a fix available in version 2026.2.18.