OpenClaw vulnerabilities

OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained listings so that entry-count and size checks pass, and the archive is then extracted in full. If an operator approves installation of such a malicious or compromised skill archive, over-limit files or entry counts are persisted in the skill tools directory, consuming disk space or inodes. The issue bypasses OpenClaw's extraction budgets but does not by itself execute archive contents. Fixed in 2026.8.1.

OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matrix accounts can normalize to the same authorization identity. A Matrix participant controlling a colliding account identifier (a protocol-valid identifier that differs from the configured one only by characters OpenClaw case/Unicode folds; display-name matching is not required) can inherit allowlist, owner-command, exec-approval, or plugin-approval authority configured for another account. The issue is fixed in 2026.8.1.

OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory_get tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit disablement like an unavailable configuration snapshot and restores the stale authority. As a result, during an already-running agent turn the model can continue searching and reading durable memory after the operator revoked that access, for the remainder of that run. Exploitation requires memory to be disabled while a previously created memory tool remains active. The issue is fixed in 2026.8.1.

OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating sender's global or per-agent toolsBySender policy when handling outbound attachments. A sender that has been explicitly denied filesystem read tools can still cause a known local file to be read and returned via a final-response media directive or a message attachment, disclosing local file contents.

OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules, deterministic and hidden recall paths can retrieve durable memory and inject it into the agent's context even when toolsBySender explicitly denies that requester access to the memory tools (memory_search, memory_get). As a result, an admitted but denied sender can receive information derived from durable memory in the agent's response without directly invoking any memory tool. The issue is fixed in 2026.8.1.

OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source fields to bypass sandbox path validation and cause Telegram delivery to read and send known host files that would otherwise be rejected.

OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to an unattended background (dreaming) agent holding broader file and command capabilities, allowing actions beyond the authority of the original turn and affecting files, commands, or services available to that agent. Exploitation requires the content to be captured, selected for later processing, and followed by the model. The issue is fixed in 2026.8.1.

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority.

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the configured workspace boundary.

@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login and receive a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and causing loss of availability; full account relinking additionally requires the attacker to scan the returned QR code with another phone. The issue affects the owner-only tool boundary rather than WhatsApp transport authentication. Fixed in 2026.8.1.

OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materially different effects.

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different nodes beyond the operator's original approval scope.

OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot reload retains that provider's credential while the OpenAI SDK selects its own default endpoint. A resulting request could disclose the configured third-party provider credential to an unrelated provider endpoint and fail with a misleading authentication error.

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions from completing Browser Relay Authentication v2.

A flaw has been found in OpenClaw up to version 2026.9.5. The affected function is createCanvasHostHandler in extensions/canvas/src/host/server.ts of the Canvas Host Route component. Manipulation can lead to denial of service. The attack can be launched remotely, and the exploit has been published. The suggested fix 'streaming/size-limit' was never shipped - the latest 2026.9.5 still buffers the whole file via readFile(), unlike the sibling WS path which caps at 64KB.

OpenClaw before version 2026.5.18 contains an authorization bypass vulnerability in the exec allowlist glob matching mechanism. Attackers can craft input paths that bypass glob patterns, allowing execution or persistence of unauthorized actions when the feature is enabled.

OpenClaw before version 2026.6.5 contains an authorization bypass vulnerability in the node exec approvals feature. Lower-trust callers can execute actions beyond their intended authorization by using different gateway and node environments. Attackers can exploit mismatched environment configurations to persist or execute actions exceeding the caller's approved permissions.

Server-Side Request Forgery (SSRF) vulnerability in OpenClaw versions 2026.4.14 through 2026.5.25. Browser snapshot routes fail to validate post-navigation destinations, allowing attackers with lower trust to bypass OpenClaw policy checks and reach network destinations that should have been blocked.

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks.

An authorization bypass vulnerability in OpenClaw before version 2026.5.18 in skill command dispatch allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform unauthorized actions when the affected feature is enabled and reachable.

An authorization bypass vulnerability in OpenClaw before version 2026.5.18 exists in the device-pair approval feature, allowing lower-trust callers to execute actions beyond their intended authorization.

OpenClaw before version 2026.5.22 contains a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level.

OpenClaw 2026.5.12 before 2026.5.26 contains an incorrect authorization vulnerability in the ClickClack allowFrom feature. When enabled, a lower-trust caller or configured input path can execute actions beyond intended authorization, including running non-allowlisted commands.

In OpenClaw 2026.2.25 before 2026.5.26, a lower-trust caller or configured input path can bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.

OpenClaw 2026.2.12 before 2026.5.26 has an authorization bypass vulnerability in agentId validation. A lower-trust attacker can submit blank agent IDs to bypass restrictions and perform actions requiring stronger authorization.

OpenClaw versions 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature. Lower-trust callers can bypass role-management checks. Attackers can perform actions requiring stronger authorization by reaching the affected feature through configured input paths.

OpenClaw versions 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing non-allowlisted senders to perform unauthorized operations.

OpenClaw 2026.4.20 before 2026.5.28 contains a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by OpenClaw policy (SSRF).

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks.

OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary.

OpenClaw before version 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should have required a stronger authorization or policy check.

A vulnerability in OpenClaw before version 2026.6.1 allows bypassing credential redaction in the trajectory export feature. Lower-trust callers can access data that should remain within trusted boundaries.

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce availability.

In OpenClaw versions 2026.5.10-beta.1 through 2026.6.5, an authorization bypass in the ClickClack agent-mode dispatch feature may ignore the toolsAllow policy. A lower-trust caller can perform actions requiring stronger authorization.

A vulnerability in OpenClaw before version 2026.6.5 allows forwarding of Authorization headers during MCP SSE redirects. When the feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond the caller's intended authorization.

An authentication bypass vulnerability in OpenClaw before version 2026.6.5 allows lower-trust callers to reach admin-scoped tools. Attackers can perform actions requiring stronger authorization by exploiting insufficient policy checks on configured input paths.

OpenClaw versions before 2026.6.9 have a missing authorization vulnerability in Discord moderation actions. A lower-trust caller or configured input path could perform moderation actions that should have required stronger authorization or policy checks.

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When enabled and reachable, a lower-trust caller or configured input path can perform actions that should have required stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. The issue is fixed in version 2026.6.6.

OpenClaw versions before 2026.6.6 have an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization level.

OpenClaw versions 2026.6.1 through 2026.6.8 contain a privilege escalation vulnerability in isolated cron jobs. Lower-trust attackers can regain access to denied execution tools via misconfigured input paths.

A vulnerability in OpenClaw before version 2026.6.6 allows a network policy bypass in the sandbox exec-server. Attackers can send HTTP requests through the exec-server to access internal network resources that should have been blocked by configured policies.

A vulnerability in OpenClaw before version 2026.6.6 stems from improper filtering of the host exec environment, allowing abuse of Git ext transport. When the feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond the caller's intended authorization.

A vulnerability in OpenClaw before version 2026.6.6 stems from improper filtering of interpreter startup variables in the host exec environment. This allows a lower-trust caller to supply crafted environment variables, potentially leading to execution or persistence of actions beyond intended authorization.

OpenClaw versions 2026.5.28 through 2026.6.5 contain an authorization bypass vulnerability in native web search. This allows lower-trust callers to perform actions requiring stronger policy checks.

A vulnerability in OpenClaw before version 2026.6.6 allows bypassing security policy during browser CDP discovery by accepting blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

An authorization bypass vulnerability in OpenClaw versions 2026.3.22 through 2026.6.6 allows WhatsApp group IDs to satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation.

An authorization bypass vulnerability in OpenClaw versions 2026.5.20 through 2026.6.6 in the MCP loopback feature allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks via configured input paths to perform or persist actions beyond their intended permissions.

In OpenClaw versions 2026.5.20 before 2026.6.9, a privilege escalation vulnerability exists in plugin install commands. It allows lower-trust callers to execute or persist actions beyond their intended authorization.

OpenClaw versions 2026.6.5 through 2026.6.8 contain a vulnerability in the plugin installation wrappers that can bypass the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.

An authorization bypass vulnerability in OpenClaw versions 2026.6.6 through 2026.6.8 allows lower-trust callers to perform actions requiring stronger authorization checks in Discord guild actions.