OpenClaw CLI's Control UI static file handler improperly followed symbolic links, allowing an attacker to read files outside the intended root directory. This vulnerability is a path traversal issue caused by insufficient validation of symlinked asset paths. The flaw affects versions up to and including 2026.2.21-2 and is fixed in version 2026.2.22. The impact is primarily confidentiality loss due to out-of-root file reads. The severity is rated low in trusted environments but could be higher in shared or less controlled setups. A patch is available and enforces realpath containment to prevent directory traversal via symlinks.
OpenClaw CLI versions up to 2026.2.21-2 have a vulnerability in the Feishu allowlist authorization mechanism where an attacker can bypass authorization by exploiting display-name collisions. The allowlist is intended to match sender IDs, but the system incorrectly accepted mutable display names, allowing unauthorized senders to be authorized if their display name matched an allowlisted ID. This issue is fixed in version 2026.2.22 and later by enforcing strict ID-only matching and normalizing ID prefixes.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.24 contain a vulnerability in the system.run allowlist mode. A mismatch in dispatch-wrapper depth parsing allows nested transparent dispatch wrappers to bypass shell-wrapper approval gating, enabling execution without the expected approval prompt. This issue is rated high severity with a CVSS score of 8.8. The vulnerability is patched in version 2026.2.24.
OpenClaw CLI versions up to 2026.2.21 and certain prereleases contain a symlink traversal vulnerability in avatar handling. This flaw allows local files outside the intended workspace to be read via avatar response surfaces. The vulnerability impacts confidentiality by exposing local files accessible to the OpenClaw process. A fix is planned in version 2026.2.22, which enforces strict symlink and file identity checks to prevent traversal.
CVE-2026-32025 is a vulnerability in OpenClaw CLI versions before 2026.2.25 that allows a local browser-origin WebSocket authentication bypass on loopback deployments using password authentication. An attacker who convinces a user to open a malicious webpage can attempt to brute-force the gateway password without throttling, potentially gaining authenticated operator access. This issue is limited to local loopback access and requires a guessable password. The vulnerability is patched in version 2026.2.25.
A vulnerability in openclaw-cli versions from 2026.1.29 up to but not including 2026.2.26 allows DM pairing-store identities to bypass group allowlist authorization checks. This flaw enables a sender authorized via direct message pairing to satisfy group sender allowlist requirements without explicit inclusion in the group allowlist, causing an authorization boundary violation between DM pairing and group allowlists. The issue is fixed in version 2026.2.26.
OpenClaw CLI versions up to 2026.2.17 are vulnerable to sensitive file disclosure via the stageSandboxMedia function when iMessage remote attachment fetching is enabled. The vulnerability allows arbitrary absolute paths to be copied from a remote host, potentially exposing files outside expected attachment directories. This can lead to confidentiality breaches if an attacker can manipulate attachment path metadata. A fix is pending in the next release with remote attachment path validation. The issue is rated with a CVSS score of 7.5 (high severity).
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.26 contain an authentication bypass vulnerability in the gateway authentication for plugin channel HTTP routes. This occurs due to a mismatch in path canonicalization between the gateway guard and the plugin handler routing, allowing unauthorized access to plugin channel APIs. The vulnerability is identified as CVE-2026-32031 and has a moderate severity rating.
OpenClaw CLI versions up to 2026.2.21-2 contain a vulnerability where the shell environment fallback trusts an unvalidated SHELL path from the host environment. This allows an attacker who can control the local environment or startup environment to influence which shell executable is invoked, potentially leading to high impact compromise. The vulnerability is not remotely exploitable without prior local environment compromise. A patch is available in version 2026.2.22 that validates the SHELL path against trusted locations and falls back safely to /bin/sh.
OpenClaw CLI versions up to 2026.3.1 have an authorization flaw in the Discord voice transcript handling where the owner-flag (senderIsOwner) is omitted, causing owner-only tools to be accessible to non-owner voice participants in the same channel. This issue arises because the agentCommand function defaults missing senderIsOwner to true, exposing privileged tools like gateway and cron. The vulnerability primarily affects mixed-trust deployments, which are outside the recommended use case of a single trusted operator. A fix is available in version 2026.3.2.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.26 contain a vulnerability in the gateway plugin route authentication for /api/channels. This vulnerability allows an attacker to bypass authentication by using encoded dot-segment traversal sequences in the request path, which are normalized by plugin handlers. The issue is fixed in version 2026.2.26. The CVSS 3.1 score is 6.5, indicating a medium severity vulnerability.
OpenClaw CLI versions up to 2026.2.21-2 have a vulnerability in the MSTeams media download flow where redirect handling can bypass configured media host allowlists. This allows redirect chains to non-allowlisted targets, weakening server-side request forgery (SSRF) protections. The issue is fixed in the planned release 2026.2.22.
OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.24 contain a sandbox network isolation bypass vulnerability. The issue allows sandboxed containers to join the network namespace of another container via the Docker network mode 'container:<id>', bypassing the intended network isolation. This requires the ability to configure trusted sandbox network settings and is not exploitable remotely without such access. The vulnerability is fixed in version 2026.2.24.
OpenClaw CLI versions up to 2026.2.21-2 have a sender-authorization bypass vulnerability in the toolsBySender group policy matching when using untyped keys. This flaw allows an attacker to gain stronger tool permissions by causing an identifier collision with another sender's identity. The issue is fixed by introducing explicit typed sender keys and deprecating untyped keys. A patch is planned for version 2026.2.22.
OpenClaw CLI versions up to 2026.2.26 have a vulnerability where browser control startup can continue without authentication if the automatic auth bootstrap fails. This allows local or loopback-reachable processes to access browser-control routes without authentication. The issue is fixed in version 2026.3.1, where startup aborts if bootstrap auth fails and no explicit credentials are provided.
OpenClaw CLI versions from 2026.2.22 through 2026.2.24 contain a vulnerability where an attacker with valid shared gateway authentication can attach an unpaired device identity and request elevated operator scopes, including administrative privileges, before pairing approval. This allows privilege escalation by self-assigning higher operator scopes. A patch is available in version 2026.2.25 that requires pairing for operator device-identity sessions authenticated with shared token or password authentication, except for certain trusted proxy paths.
OpenClaw CLI versions up to 2026.2.24 have a time-of-check to time-of-use (TOCTOU) vulnerability in the system.run approval process on node hosts. This occurs because the current working directory (cwd) used for approval can be a mutable symlink, which may be changed between approval and execution, potentially allowing command execution in an unintended directory. The vulnerability affects operator-reviewed command execution trust boundaries. A patch is available in version 2026.2.25 that rejects symlink cwd paths and strengthens approval binding.
A vulnerability in the openclaw-cli package allows crafted .tar.bz2 archives to bypass safety checks during extraction, causing a local denial of service (DoS) when installing skills. The issue arises because the tar.bz2 installer path uses shell tar logic without the same hardening as the centralized extractor. This flaw affects versions up to 2026.3.1 and has been fixed in version 2026.3.2.
OpenClaw CLI versions up to 2026.2.19-2 have a vulnerability in tokenless Tailscale authentication that allows bypassing token/password requirements for HTTP gateway routes when tokenless auth is enabled. This weakens authentication boundaries in trusted-network deployments. The issue is fixed in the planned 2026.2.21 release by restricting tokenless Tailscale header authentication to Control UI websocket login only and requiring token/password auth for HTTP gateway routes.
OpenClaw CLI versions up to 2026.2.26 allow sandboxed sessions to spawn child sessions under agents with sandboxing disabled, potentially reducing runtime confinement. This cross-agent spawning flaw could let a sandboxed requester escape into an unsandboxed environment. The issue is fixed in version 2026.3.1 by enforcing sandbox inheritance at spawn time, rejecting spawns that would downgrade confinement.