Threats affecting pkg:npm/OpenClaw

A vulnerability in the openclaw npm package versions 2026.4.5 through 2026.4.9 allows write-scoped operator commands to toggle persistent memory dreaming configuration settings. This configuration mutation should require admin privileges but was reachable without them. The issue is fixed in version 2026.4.10 and later.

A vulnerability in the OpenClaw package for npm (versions >=2026.4.10 <2026.4.14) allowed Microsoft Teams SSO invoke handler to process invokes without proper sender authorization checks. This issue was fixed in version 2026.4.14 by routing SSO invoke handling through the Teams sender authorization path and adding coverage for denied senders. The vulnerability has a medium severity score of 6.3 CVSS 4.0 and does not have known exploits in the wild.

A vulnerability in the openclaw npm package versions 2026.4.7 through 2026.4.13 allows heartbeat owner downgrade logic to skip untrusted webhook wake events. This flaw preserves an owner-like execution context when the run should have been downgraded, potentially leading to unauthorized elevated privileges. The issue is fixed in version 2026.4.14.

OpenClaw versions prior to 2026.4.14 contain a vulnerability where browser snapshot and screenshot routes could expose internal page content after navigation. Authenticated users could exploit this by accessing snapshot, screenshot, or tab routes that did not properly validate the final browser target, potentially exposing content from internal or restricted pages. This issue was fixed in version 2026.4.14.

OpenClaw versions prior to 2026.4.14 contain a vulnerability allowing authenticated gateway clients with config read access to bypass redaction protections via sourceConfig and runtimeConfig aliases. This flaw could expose sensitive secrets such as provider API keys, gateway authentication material, and channel credentials. The issue is fixed in version 2026.4.14.

A vulnerability in the openclaw npm package prior to version 2026.4.14 allows collect-mode queue batches to reuse the last sender's authorization context. This flaw could cause messages from different senders to be processed with the authorization context of the final sender in the batch, potentially granting earlier messages elevated privileges. The issue is fixed in version 2026.4.14 by splitting batches according to sender authorization context before dispatch.

OpenClaw versions prior to 2026.4.10 contain a time-of-check to time-of-use (TOCTOU) race condition in the exec script preflight validator. This flaw allows a local attacker with write access to the workspace path to swap the target file between validation and reading, causing the preflight analysis to inspect a different file than originally validated. The impact is limited as the validator only exposes derived preflight content, not full file disclosure. The issue was fixed in version 2026.4.10 by replacing the check-then-read flow with an atomic pinned file descriptor open that verifies file identity securely.

OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.

OpenClaw versions up to 2026.3.30 have a vulnerability where Git plumbing environment variables such as GIT_DIR were not removed from the execution environment denylist. This flaw could allow user-controlled local assistants to redirect Git operations improperly. The issue is fixed in version 2026.4.8.

OpenClaw versions up to 2026.4.7 contain multiple code paths where base64 decoding operations lack proper pre-allocation size checks. This flaw could lead to allocations exceeding intended decoded size limits. The issue affects local user-controlled instances of OpenClaw and does not involve multi-tenant service boundaries. The vulnerability has been fixed in version 2026.4.8.

OpenClaw versions up to 2026.4.1 have a vulnerability where ClawHub package downloads do not enforce integrity verification. This allows plugin archives to be installed without validating archive or per-file integrity metadata. The issue affects the OpenClaw local assistant under its trust model and was fixed in version 2026.4.8.

CVE-2026-42430 is a vulnerability in the OpenClaw package (npm) version 2026.3.8 where strict browser SSRF (Server-Side Request Forgery) protections can be bypassed during Playwright redirect handling, allowing navigation to private network targets. This flaw was fixed in version 2026.4.8. The vulnerability has a medium severity with a CVSS score of 6.5.

OpenClaw versions up to 2026.4.1 contain a vulnerability where the node.pair.approve method is assigned the broader operator.write scope instead of the more restrictive operator.pairing scope. This misconfiguration allows unprivileged users to approve pairings improperly. The issue is fixed in version 2026.4.8.

OpenClaw versions up to 2026.4.2 have a vulnerability where concurrent asynchronous authentication attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths. This race condition allows exceeding the per-key rate limit. The issue is fixed in version 2026.4.4.

OpenClaw versions up to 2026.4.1 have a vulnerability where the /allowlist endpoint does not enforce owner-only restrictions for cross-channel allowlist writes. This allows an authorized non-owner sender to attempt modifications to the allowlist of a different channel. The issue is fixed in version 2026.4.8.

OpenClaw versions up to 2026.4.1 contain a vulnerability where the node.invoke(browser.proxy) function bypasses the browser.request persistent profile-mutation guard, allowing mutation of persistent browser profiles. This issue affects the OpenClaw local assistant under its trust model and does not assume multi-tenant service boundaries. The vulnerability has been fixed in version 2026.4.8.

OpenClaw versions up to 2026.4.7 have a vulnerability in the device token rotation process that allows minting tokens with unapproved roles, bypassing the intended device role-upgrade pairing. This flaw could lead to unauthorized elevation of device privileges. The issue is fixed in version 2026.4.8.

OpenClaw versions up to 2026.4.4 treat shared reply MEDIA paths as trusted, allowing a crafted reference to cause cross-channel local file exfiltration. This vulnerability affects the OpenClaw user-controlled local assistant under its trust model and does not assume multi-tenant service boundaries. The issue is fixed in version 2026.4.8.

OpenClaw versions up to 2026.4.2 have a vulnerability where the strictInlineEval explicit-approval boundary can be bypassed due to an approval-timeout fallback on gateway and node execution hosts. This fallback allows inline eval commands to execute without the intended explicit approval. The issue is fixed in version 2026.4.8.

OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering redirects to exfiltrate sensitive request data or headers to unintended origins.