OpenClaw vulnerabilities

An authorization bypass vulnerability in OpenClaw before version 2026.5.18 in skill command dispatch allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform unauthorized actions when the affected feature is enabled and reachable.

An authorization bypass vulnerability in OpenClaw before version 2026.5.18 exists in the device-pair approval feature, allowing lower-trust callers to execute actions beyond their intended authorization.

OpenClaw before version 2026.5.22 contains a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level.

OpenClaw 2026.5.12 before 2026.5.26 contains an incorrect authorization vulnerability in the ClickClack allowFrom feature. When enabled, a lower-trust caller or configured input path can execute actions beyond intended authorization, including running non-allowlisted commands.

In OpenClaw 2026.2.25 before 2026.5.26, a lower-trust caller or configured input path can bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.

OpenClaw 2026.2.12 before 2026.5.26 has an authorization bypass vulnerability in agentId validation. A lower-trust attacker can submit blank agent IDs to bypass restrictions and perform actions requiring stronger authorization.

OpenClaw versions 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature. Lower-trust callers can bypass role-management checks. Attackers can perform actions requiring stronger authorization by reaching the affected feature through configured input paths.

OpenClaw versions 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing non-allowlisted senders to perform unauthorized operations.

OpenClaw 2026.4.20 before 2026.5.28 contains a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by OpenClaw policy (SSRF).

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks.

OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary.

OpenClaw before version 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should have required a stronger authorization or policy check.

A vulnerability in OpenClaw before version 2026.6.1 allows bypassing credential redaction in the trajectory export feature. Lower-trust callers can access data that should remain within trusted boundaries.

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce availability.

In OpenClaw versions 2026.5.10-beta.1 through 2026.6.5, an authorization bypass in the ClickClack agent-mode dispatch feature may ignore the toolsAllow policy. A lower-trust caller can perform actions requiring stronger authorization.

A vulnerability in OpenClaw before version 2026.6.5 allows forwarding of Authorization headers during MCP SSE redirects. When the feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond the caller's intended authorization.

An authentication bypass vulnerability in OpenClaw before version 2026.6.5 allows lower-trust callers to reach admin-scoped tools. Attackers can perform actions requiring stronger authorization by exploiting insufficient policy checks on configured input paths.

OpenClaw versions before 2026.6.9 have a missing authorization vulnerability in Discord moderation actions. A lower-trust caller or configured input path could perform moderation actions that should have required stronger authorization or policy checks.

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When enabled and reachable, a lower-trust caller or configured input path can perform actions that should have required stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. The issue is fixed in version 2026.6.6.

OpenClaw versions before 2026.6.6 have an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization level.

OpenClaw versions 2026.6.1 through 2026.6.8 contain a privilege escalation vulnerability in isolated cron jobs. Lower-trust attackers can regain access to denied execution tools via misconfigured input paths.

A vulnerability in OpenClaw before version 2026.6.6 allows a network policy bypass in the sandbox exec-server. Attackers can send HTTP requests through the exec-server to access internal network resources that should have been blocked by configured policies.

A vulnerability in OpenClaw before version 2026.6.6 stems from improper filtering of the host exec environment, allowing abuse of Git ext transport. When the feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond the caller's intended authorization.

A vulnerability in OpenClaw before version 2026.6.6 stems from improper filtering of interpreter startup variables in the host exec environment. This allows a lower-trust caller to supply crafted environment variables, potentially leading to execution or persistence of actions beyond intended authorization.

OpenClaw versions 2026.5.28 through 2026.6.5 contain an authorization bypass vulnerability in native web search. This allows lower-trust callers to perform actions requiring stronger policy checks.

A vulnerability in OpenClaw before version 2026.6.6 allows bypassing security policy during browser CDP discovery by accepting blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

An authorization bypass vulnerability in OpenClaw versions 2026.3.22 through 2026.6.6 allows WhatsApp group IDs to satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation.

An authorization bypass vulnerability in OpenClaw versions 2026.5.20 through 2026.6.6 in the MCP loopback feature allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks via configured input paths to perform or persist actions beyond their intended permissions.

In OpenClaw versions 2026.5.20 before 2026.6.9, a privilege escalation vulnerability exists in plugin install commands. It allows lower-trust callers to execute or persist actions beyond their intended authorization.

OpenClaw versions 2026.6.5 through 2026.6.8 contain a vulnerability in the plugin installation wrappers that can bypass the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.

An authorization bypass vulnerability in OpenClaw versions 2026.6.6 through 2026.6.8 allows lower-trust callers to perform actions requiring stronger authorization checks in Discord guild actions.

OpenClaw versions 2026.6.6 through 2026.6.8 contain an authorization bypass vulnerability in message mutation handling, allowing lower-trust callers to perform actions requiring stronger authorization checks.

OpenClaw before version 2026.6.9 contains an authorization bypass vulnerability in the flock wrapper, allowing lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

A vulnerability in OpenClaw before version 2026.6.9 in the mirror sync feature allows symlink following, enabling lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

An authorization bypass vulnerability in OpenClaw before version 2026.6.8 in OpenAI-compatible HTTP model overrides allows lower-trust callers to perform actions requiring stronger authorization checks.

A vulnerability in OpenClaw before version 2026.5.28 allows workspace dotenv files to override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials that should remain within trusted boundaries.

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands.

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations.

OpenClaw before version 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables.

OpenClaw before version 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers can supply a group ID to the policy resolver, potentially triggering incorrect group-policy decisions for tool invocations.

OpenClaw before version 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.

OpenClaw before version 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers can execute shell content outside the intended allowlist check, potentially allowing unauthorized command execution depending on operator configuration.

OpenClaw before version 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather than stable sender identity.

OpenClaw before version 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model or workspace-derived URLs.

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.

OpenClaw before version 2026.5.3 contains a policy enforcement vulnerability that allows Zalo contacts with mutable display metadata to match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.

OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions.

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters.

OpenClaw before version 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom state across channel boundaries.

OpenClaw before version 2026.5.12 contains a vulnerability that allows bypassing argument pattern validation in the exec allowlist. Attackers can invoke allowlisted executables with unrestricted arguments, potentially leading to unauthorized file access, network access, or command execution.