CVE-2026-110689 is a medium severity vulnerability in OpenClaw ClawScan up to version 0.1.6. It affects the Static Scanner component's function shouldSkipTargetPath, causing a protection mechanism failure when manipulated locally. Exploit code has been publicly released. Upgrading to version 0.1.7 addresses the issue.
OpenClaw Windows Node versions before 2026.7.1 have an incomplete environment-variable sanitizer in the system.run function. This flaw fails to block certain environment variables (GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, JAVA_TOOL_OPTIONS), which attackers with gateway or agent access can exploit to execute arbitrary code by influencing allowlisted tools such as git, dotnet, or java.
OpenClaw Windows Node versions up to 2026.9.4 contain a server-side request forgery (SSRF) vulnerability in the canvas.present capability. This flaw allows attackers with gateway or agent access to bypass URL risk evaluation and make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity.
OpenClaw Windows Node versions before 2026.7.1 have a vulnerability in the system.execApprovals.set function that allows remote callers to add overly broad allow rules. This flaw arises from incomplete validation of disallowed inputs, including wildcard-executable rules and certain system binaries like mshta, rundll32, and certutil. Exploiting this, an attacker with limited privileges can execute arbitrary commands on the Windows host without operator checks or user prompts.
OpenClaw Windows Node versions before 2026.7.1 have a vulnerability in the gateway WebSocket transport that allows resource allocation without limits. This flaw enables connected gateways to send an unending sequence of WebSocket continuation frames without the EndOfMessage flag, causing unbounded memory growth and eventual node process crash.
OpenClaw Windows Node versions before 2026.7.1 have an incorrect authorization vulnerability in the exec-approval policy. The vulnerability arises because the ExecShellWrapperParser does not properly parse commands containing pipe operators or command substitutions. This allows connected gateways or agents to bypass approval rules by hiding denied commands behind allowed prefixes, enabling arbitrary command execution on affected Windows hosts.
OpenClaw Windows Node versions before 2026.7.1-3 have a missing authorization vulnerability in NodeService capture handlers. This flaw allows connected gateways or agents to perform screen snapshots, camera captures, and location retrievals without user consent or prompts. Attackers can silently invoke these functions over the node WebSocket interface, compromising user privacy without interaction.
CVE-2026-100604 is an incorrect authorization vulnerability in the ClawHub backend where organization-owned skills retain the original publisher's user ID. This flaw allows an authenticated user who originally published a skill to transfer, delete, or restore it even after losing organization privileges. The vulnerability was fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, deployed on 2026-09-11. Self-hosted deployments should update to this revision or later. The npm CLI and OpenClaw runtime are not affected.
ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding (moderationStatus: hidden) of that skill from the catalog without any moderator decision. Because the reporter quota counts only reports filed against visible targets, the same accounts can repeat the process against additional skills; official skills are not exempt. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. The fix (PR #3681) is included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read authorization enforced on normal content access, and up to 8,000 characters of quarantined content may be submitted to the AI provider and reflected in the preview returned to the caller, disclosing restricted skill content. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3682, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destination, so a public-looking hostname can resolve to an internal address or change resolution between validation and connection (DNS rebinding). A maintainer-run local harness demonstrated an outbound connection to an owner-controlled loopback listener; access to production internal services, credential disclosure, and code execution were not demonstrated. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. Fixed by PR #3683, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
CVE-2026-100600 is a resource allocation vulnerability in the openclaw clawhub backend where anonymous HTTP API requests share a single default quota. This allows unauthenticated remote attackers to exhaust the shared quota, causing denial or degradation of service for other users. Additionally, if the TRUST_FORWARDED_IPS option is enabled without proper authentication, attackers can spoof forwarded IP headers to evade rate limiting. The issue was fixed in a later revision by redirecting anonymous calls and enforcing authentication for identity assertions.
OpenClaw Discord versions before 2026.7.1 have an authorization bypass vulnerability in guild metadata read actions. This flaw allows lower-trust users to access guild metadata that should be restricted by channel allowlists, bypassing configured read-target policies. The vulnerability has a medium severity rating with a CVSS score of 5.3.
OpenClaw channel plugins prior to version 2026.8.1 do not enforce the configured channel read allowlist for certain read actions, allowing lower-trust senders or agents to access content or metadata from channels excluded by the operator's read policy. This vulnerability affects @openclaw/msteams and related plugins and is fixed in version 2026.8.1.
OpenClaw Slack versions before 2026.8.1 contain a vulnerability where sender allowlists are not properly enforced in multi-person direct messages. This allows unauthorized participants to trigger Slack agents and access tools and data intended only for authorized users. The vulnerability has a high severity score of 8.7 and requires privileged access to exploit.
OpenClaw LINE versions before 2026.8.1 have an access control vulnerability where group allowlist mode incorrectly inherits direct message (DM) allowFrom values if groupAllowFrom is not explicitly set. This allows attackers who are members of a group to bypass intended group allowlist restrictions and trigger the agent when DM access is broader than group access.
CVE-2026-100544 is a high-severity vulnerability in the openclaw voice-call package before version 2026.8.1. The flaw allows inbound callers admitted by the deployment's inbound-call policy to bypass authorization checks because the caller's identity and non-owner status are not propagated. This can cause owner-only tool filtering to fail, exposing the agent's normal tool authority to remote callers. Exploitation can lead to unauthorized reading of data, file modification, command execution, or control of connected services depending on the agent's configuration. The issue is fixed in version 2026.8.1.
OpenClaw's Matrix integration (npm package @openclaw/matrix) versions 2026.2.2 up to but not including 2026.8.1 improperly handle case sensitivity when deriving authorization identities. This causes distinct authenticated Matrix accounts that differ only by case or Unicode folding to be treated as the same authorization identity. Consequently, an attacker controlling a colliding account identifier can inherit privileges such as allowlist, owner-command, exec-approval, or plugin-approval authority assigned to another account. The vulnerability is fixed in version 2026.8.1.
CVE-2026-100540 is an authorization vulnerability in OpenClaw Feishu versions before 2026.8.1. The software fails to check if a configured default account is disabled before using it for model tool operations. This flaw allows attackers exploiting multi-account setups to use credentials of a disabled default account to read or modify Feishu resources despite the account being revoked.
A missing authorization vulnerability in @openclaw/whatsapp (npm) before version 2026.8.1 allows non-owner users to access an owner-only WhatsApp login tool. This flaw lets attackers request a forced login and obtain a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and causing availability loss. Full account takeover requires scanning the QR code with another device. The issue is fixed in version 2026.8.1.