OpenClaw versions prior to 2026.3.22 contain a vulnerability in the host environment sanitization logic that fails to block certain package-manager and related environment variables. This flaw allows an attacker, upon an approved execution request, to redirect package resolution or runtime bootstrap processes to attacker-controlled infrastructure, potentially leading to execution of malicious code. The issue is fixed in version 2026.3.22.
A vulnerability in OpenClaw's gateway allows write-scoped callers to persist verbose output session overrides via the chat.send path, which should be restricted to admin-only access. This could lead to unintended exposure of detailed reasoning or tool output. The issue affects versions up to 2026.3.24 and is fixed in version 2026.3.28.
OpenClaw had a vulnerability where the host execution environment sanitization did not block the environment variables GIT_TEMPLATE_DIR and AWS_CONFIG_FILE. These variables can redirect trusted tools like git and AWS CLI to attacker-controlled configurations, potentially allowing execution of untrusted code or loading attacker-selected credentials. The issue affects OpenClaw versions up to 2026.3.24 and is fixed in version 2026.3.28.
A vulnerability in the OpenClaw Feishu extension allows bypassing the localRoots sandbox during file upload path resolution, enabling arbitrary file reads outside the sandbox. This affects versions from 2026.2.6 up to 2026.3.27. The issue is fixed in version 2026.3.28.
OpenClaw CLI's remote onboarding feature accepted discovered gateway endpoints without explicit user confirmation, persisting remote URLs and connection details. This flaw allowed a malicious or spoofed discovery endpoint to redirect onboarding to an attacker-controlled gateway, potentially capturing gateway credentials and traffic. The vulnerability affects versions up to 2026.3.24 and is fixed in version 2026.3.28.