OpenClaw vulnerabilities

OpenClaw versions 2026.6.6 through 2026.6.8 contain an authorization bypass vulnerability in message mutation handling, allowing lower-trust callers to perform actions requiring stronger authorization checks.

OpenClaw before version 2026.6.9 contains an authorization bypass vulnerability in the flock wrapper, allowing lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

A vulnerability in OpenClaw before version 2026.6.9 in the mirror sync feature allows symlink following, enabling lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

An authorization bypass vulnerability in OpenClaw before version 2026.6.8 in OpenAI-compatible HTTP model overrides allows lower-trust callers to perform actions requiring stronger authorization checks.

A vulnerability in OpenClaw before version 2026.5.28 allows workspace dotenv files to override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials that should remain within trusted boundaries.

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands.

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations.

OpenClaw before version 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables.

OpenClaw before version 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers can supply a group ID to the policy resolver, potentially triggering incorrect group-policy decisions for tool invocations.

OpenClaw before version 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.

OpenClaw before version 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers can execute shell content outside the intended allowlist check, potentially allowing unauthorized command execution depending on operator configuration.

OpenClaw before version 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather than stable sender identity.

OpenClaw before version 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model or workspace-derived URLs.

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.

OpenClaw before version 2026.5.3 contains a policy enforcement vulnerability that allows Zalo contacts with mutable display metadata to match allowFrom policy entries through display name changes. Attackers with mutable display names could receive agent responses intended for different Zalo identities when the feature is enabled.

OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions.

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters.

OpenClaw before version 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom state across channel boundaries.

OpenClaw before version 2026.5.12 contains a vulnerability that allows bypassing argument pattern validation in the exec allowlist. Attackers can invoke allowlisted executables with unrestricted arguments, potentially leading to unauthorized file access, network access, or command execution.

OpenClaw before version 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests.

OpenClaw before version 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications.

OpenClaw before version 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks.

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

OpenClaw before version 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass allowlist validation.

OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges.

OpenClaw before version 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup.

OpenClaw before version 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the vulnerable dispatch path to bypass hook-based auditing and policy enforcement mechanisms.

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search. This allows authenticated callers to access memory entries without proper authorization.

OpenClaw before version 2026.5.26 contains an authorization bypass vulnerability that allows a surviving pairing-scoped device session to re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval.

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK_PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.

OpenClaw before version 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content.

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers can exploit this vulnerability to exfiltrate sensitive headers like API keys or tenant-routing credentials.

OpenClaw before version 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.

OpenClaw before version 2026.5.6 has an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass DM policy by sending crafted events missing channel type information to process restricted content.

Vulnerability in OpenClaw before version 2026.5.12. It involves an allowlist bypass in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators can bypass execution allowlist checks by using unrecognized encoded-command alias forms to execute arbitrary PowerShell content.

Vulnerability in OpenClaw before 2026.5.6 allows a configuration enforcement bypass in Feishu dynamic-agent bindings. Authenticated senders can create or update bindings without honoring configured config-write controls, enabling unauthorized binding modifications.

An authorization bypass vulnerability in OpenClaw before 2026.4.27 allows authenticated senders to skip allowFrom policy checks in QQBot pre-dispatch slash commands. Attackers can invoke slash commands before access control policies are applied, potentially triggering command handling from blocked senders depending on operator configuration.

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy.

OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity headers to assume operator identity and potentially escalate privileges.

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved commands to read unintended node-local files and expose sensitive configuration data.

OpenClaw before version 2026.4.22 contains a webhook secret revocation bypass vulnerability. Old Slack and Zalo webhook secrets remain active after secrets.reload, allowing attackers to deliver webhook events using previous credentials.

OpenClaw before version 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes to execute unauthorized operations after approval.

Authorization bypass vulnerability in OpenClaw before version 2026.5.6. Authenticated senders can execute owner-only commands without proper access control, allowing privileged command execution by unauthorized users.

OpenClaw before version 2026.5.2 contains a credential exposure vulnerability in message.action forwarding, allowing remote attackers to intercept Gateway tokens and action payloads.

OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exploit this by spawning child sessions from sandboxed parents to reveal host workspace location or related memory context to child models.

Vulnerability in OpenClaw before version 2026.4.7 in the memory-wiki ingest feature. Authenticated operators with operator.write scope can read arbitrary local files outside intended sources by specifying file paths.

OpenClaw before version 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash command behavior briefly after token revocation, potentially executing unauthorized actions depending on operator configuration.

OpenClaw before version 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access.

OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuild command arguments after allowlist approval to execute unapproved command shapes, potentially bypassing security controls.

OpenClaw before version 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execute admin-gated Gateway RPCs.