OpenClaw vulnerabilities

OpenClaw before version 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals. Users with limited exec permissions can bypass approval splits and approve plugin actions outside operator configuration.

An authorization bypass vulnerability in OpenClaw before version 2026.5.4 in the bundled device-pair plugin allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers with chat command access can create setup codes to enroll devices with operator/node capabilities.

OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget authenticated browser control toward localhost endpoints and expose browser state.

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript state, and force new session IDs without requiring admin scope.

OpenClaw before version 2026.3.31 contains a path traversal vulnerability in the ACP dispatch component. Attackers can read arbitrary files by manipulating inbound channel attachment paths, bypassing access controls.

OpenClaw before version 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can inject malicious environment variables to override critical system configurations.

OpenClaw before 2026.3.28 has an environment variable disclosure vulnerability in the jq safe-bin policy. The $ENV filter is not blocked, allowing attackers to read sensitive environment variables.

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

OpenClaw before version 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.

OpenClaw before version 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.

OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files.

OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension's resolveUploadInput function, bypassing file-system sandbox restrictions.

OpenClaw versions 2026.2.19 through 2026.3.30 have improper cache isolation in the Zalo webhook replay-dedupe mechanism. Attackers controlling one authenticated webhook can suppress legitimate events on other accounts by matching event_name and message_id parameters.

OpenClaw before version 2026.3.31 (patched in 2026.4.8) has a request body replay vulnerability in fetchWithSsrFGuard, allowing unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this to exfiltrate sensitive request data or headers to unintended origins.

OpenClaw before version 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it in the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection.

OpenClaw prior to commit b57b680 has an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths. Attackers can inject attacker-controlled environment variables into execution, bypassing approval validation.

OpenClaw prior to commit 8aceaf5 has a bypass vulnerability in shell-bleed protection, allowing attackers to execute blocked script content using pipes, command substitution, or subshells.

OpenClaw before 2026.3.28 has an SSRF vulnerability in the fal provider image-generation-provider.ts component. Attackers can exploit unguarded image downloads to expose internal service metadata and responses through the image pipeline.

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.

OpenClaw before 2026.3.28 lacks rate limiting in Nextcloud Talk webhook authentication. Attackers can brute-force weak shared secrets to forge webhook events.

OpenClaw before 2026.3.28 has a vulnerability in the Google Chat and Zalouser extensions where group allowlist policies silently downgrade to open policy. Attackers can bypass sender restrictions and interact with bots.

OpenClaw before version 2026.3.28 lacks sufficient scope validation in the node pairing approval path. Low-privilege operators can approve nodes with broader scopes, leading to privilege escalation on paired nodes.

OpenClaw before version 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.

OpenClaw before version 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, allowing unauthorized senders to trigger replies in allowlisted Teams routes.

OpenClaw before version 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.

OpenClaw before version 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile function. An attacker can exploit a TOCTOU race condition by modifying parent paths inside the sandbox, allowing files to be written outside the allowed area.

OpenClaw before version 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can execute channel commands like /config set channels.<provider>.accounts.<id> to modify configuration on target accounts with configWrites: false.

OpenClaw before 2026.3.11 has a credential fallback vulnerability where unavailable local tokens are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to bypass intended authentication boundaries.

OpenClaw before version 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.