OpenClaw vulnerabilities

OpenClaw before version 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests.

OpenClaw before version 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications.

OpenClaw before version 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks.

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

OpenClaw before version 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass allowlist validation.

OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges.

OpenClaw before version 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup.

OpenClaw before version 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the vulnerable dispatch path to bypass hook-based auditing and policy enforcement mechanisms.

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search. This allows authenticated callers to access memory entries without proper authorization.

OpenClaw before version 2026.5.26 contains an authorization bypass vulnerability that allows a surviving pairing-scoped device session to re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval.

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK_PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.

OpenClaw before version 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content.

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers can exploit this vulnerability to exfiltrate sensitive headers like API keys or tenant-routing credentials.

OpenClaw before version 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.

OpenClaw before version 2026.5.6 has an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass DM policy by sending crafted events missing channel type information to process restricted content.

Vulnerability in OpenClaw before version 2026.5.12. It involves an allowlist bypass in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators can bypass execution allowlist checks by using unrecognized encoded-command alias forms to execute arbitrary PowerShell content.

Vulnerability in OpenClaw before 2026.5.6 allows a configuration enforcement bypass in Feishu dynamic-agent bindings. Authenticated senders can create or update bindings without honoring configured config-write controls, enabling unauthorized binding modifications.

An authorization bypass vulnerability in OpenClaw before 2026.4.27 allows authenticated senders to skip allowFrom policy checks in QQBot pre-dispatch slash commands. Attackers can invoke slash commands before access control policies are applied, potentially triggering command handling from blocked senders depending on operator configuration.

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy.

OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity headers to assume operator identity and potentially escalate privileges.

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved commands to read unintended node-local files and expose sensitive configuration data.

OpenClaw before version 2026.4.22 contains a webhook secret revocation bypass vulnerability. Old Slack and Zalo webhook secrets remain active after secrets.reload, allowing attackers to deliver webhook events using previous credentials.

OpenClaw before version 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes to execute unauthorized operations after approval.

Authorization bypass vulnerability in OpenClaw before version 2026.5.6. Authenticated senders can execute owner-only commands without proper access control, allowing privileged command execution by unauthorized users.

OpenClaw before version 2026.5.2 contains a credential exposure vulnerability in message.action forwarding, allowing remote attackers to intercept Gateway tokens and action payloads.

OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exploit this by spawning child sessions from sandboxed parents to reveal host workspace location or related memory context to child models.

Vulnerability in OpenClaw before version 2026.4.7 in the memory-wiki ingest feature. Authenticated operators with operator.write scope can read arbitrary local files outside intended sources by specifying file paths.

OpenClaw before version 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash command behavior briefly after token revocation, potentially executing unauthorized actions depending on operator configuration.

OpenClaw before version 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access.

OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuild command arguments after allowlist approval to execute unapproved command shapes, potentially bypassing security controls.

OpenClaw before version 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execute admin-gated Gateway RPCs.

Vulnerability in OpenClaw before 2026.5.12, allowing bypass of exec denylist via MCP loopback session-spawn path. Authenticated attackers can execute broader commands.

OpenClaw before version 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute unintended Homebrew-compatible executables during skill setup to compromise the system.

OpenClaw before version 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies. Attackers can invoke owner-only behavior through the affected loopback path.

OpenClaw before version 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens.

OpenClaw before version 2026.5.18 contains a provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node can send crafted node.event messages to the gateway.

OpenClaw before version 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them, potentially exposing sensitive information.

OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agents incorrectly receive owner-scoped MCP loopback authority. Attackers with a valid hook token can exploit the /hooks/agent endpoint to access owner-only MCP tools.

OpenClaw before version 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution. Attackers with access to affected workspaces can load memory-core artifacts from unintended local locations, potentially executing malicious code or accessing sensitive data.

OpenClaw before version 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.

OpenClaw before version 2026.5.7 contains a privilege escalation vulnerability in the allowFrom feature in Matrix, allowing authenticated accounts to match policy entries through mutable display name metadata. Attackers who can change display names may gain agent access intended for another Matrix identity.

OpenClaw before version 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension metadata to load plugin code outside reviewed package entry points, bypassing security scanning.

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy. This allows attackers to compare provider aliases against aliases instead of canonical provider identities, potentially leading to unauthorized access to tools.

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow. This allows attackers to exploit agent tool calls to set apply: true despite approvalPolicy: pending configuration.

OpenClaw before version 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied, triggering command behavior outside configured Telegram sender restrictions.

OpenClaw before version 2026.5.12 contains a shell option parsing vulnerability that allows bypassing exec revalidation checks. Attackers can exploit this vulnerability to execute unauthorized commands.

A scope bypass vulnerability in OpenClaw before 2026.5.18 in the Gateway chat.send route allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited external routes to bypass operator.approvals and operator.admin scope requirements.

OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers can bypass private-network SSRF policies by reusing blocked tabs to export or inspect protected content.

OpenClaw before version 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization.

OpenClaw before version 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands. Authenticated senders can skip DM-only and allowFrom policy checks, allowing them to route admin commands from unauthorized senders or contexts to execute restricted behavior that policy should have blocked.