OpenClaw vulnerabilities

Vulnerability in OpenClaw before 2026.5.12, allowing bypass of exec denylist via MCP loopback session-spawn path. Authenticated attackers can execute broader commands.

OpenClaw before version 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute unintended Homebrew-compatible executables during skill setup to compromise the system.

OpenClaw before version 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies. Attackers can invoke owner-only behavior through the affected loopback path.

OpenClaw before version 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens.

OpenClaw before version 2026.5.18 contains a provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node can send crafted node.event messages to the gateway.

OpenClaw before version 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them, potentially exposing sensitive information.

OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agents incorrectly receive owner-scoped MCP loopback authority. Attackers with a valid hook token can exploit the /hooks/agent endpoint to access owner-only MCP tools.

OpenClaw before version 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution. Attackers with access to affected workspaces can load memory-core artifacts from unintended local locations, potentially executing malicious code or accessing sensitive data.

OpenClaw before version 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.

OpenClaw before version 2026.5.7 contains a privilege escalation vulnerability in the allowFrom feature in Matrix, allowing authenticated accounts to match policy entries through mutable display name metadata. Attackers who can change display names may gain agent access intended for another Matrix identity.

OpenClaw before version 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension metadata to load plugin code outside reviewed package entry points, bypassing security scanning.

OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy. This allows attackers to compare provider aliases against aliases instead of canonical provider identities, potentially leading to unauthorized access to tools.

OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow. This allows attackers to exploit agent tool calls to set apply: true despite approvalPolicy: pending configuration.

OpenClaw before version 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied, triggering command behavior outside configured Telegram sender restrictions.

OpenClaw before version 2026.5.12 contains a shell option parsing vulnerability that allows bypassing exec revalidation checks. Attackers can exploit this vulnerability to execute unauthorized commands.

A scope bypass vulnerability in OpenClaw before 2026.5.18 in the Gateway chat.send route allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited external routes to bypass operator.approvals and operator.admin scope requirements.

OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers can bypass private-network SSRF policies by reusing blocked tabs to export or inspect protected content.

OpenClaw before version 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization.

OpenClaw before version 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands. Authenticated senders can skip DM-only and allowFrom policy checks, allowing them to route admin commands from unauthorized senders or contexts to execute restricted behavior that policy should have blocked.

OpenClaw before version 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals. Users with limited exec permissions can bypass approval splits and approve plugin actions outside operator configuration.

An authorization bypass vulnerability in OpenClaw before version 2026.5.4 in the bundled device-pair plugin allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers with chat command access can create setup codes to enroll devices with operator/node capabilities.

OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget authenticated browser control toward localhost endpoints and expose browser state.

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript state, and force new session IDs without requiring admin scope.

OpenClaw before version 2026.3.31 contains a path traversal vulnerability in the ACP dispatch component. Attackers can read arbitrary files by manipulating inbound channel attachment paths, bypassing access controls.

OpenClaw before version 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can inject malicious environment variables to override critical system configurations.

OpenClaw before 2026.3.28 has an environment variable disclosure vulnerability in the jq safe-bin policy. The $ENV filter is not blocked, allowing attackers to read sensitive environment variables.

OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions. Attackers can trigger privileged component actions from blocked contexts by bypassing channel policy enforcement.

OpenClaw before version 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read. Attackers can exploit improper media parent directory validation to exfiltrate credentials and access sensitive files.

OpenClaw before version 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API. Attackers can retrieve thread messages that should be filtered by sender allowlists, bypassing message filtering restrictions.

OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files.

OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension's resolveUploadInput function, bypassing file-system sandbox restrictions.

OpenClaw versions 2026.2.19 through 2026.3.30 have improper cache isolation in the Zalo webhook replay-dedupe mechanism. Attackers controlling one authenticated webhook can suppress legitimate events on other accounts by matching event_name and message_id parameters.

OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in the agents.create and agents.update handlers, which use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.

OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can trigger redirects to exfiltrate sensitive request data or headers to unintended origins.

OpenClaw before version 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it in the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection.

OpenClaw prior to commit b57b680 has an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths. Attackers can inject attacker-controlled environment variables into execution, bypassing approval validation.

OpenClaw prior to commit 8aceaf5 has a bypass vulnerability in shell-bleed protection, allowing attackers to execute blocked script content using pipes, command substitution, or subshells.

OpenClaw before 2026.3.28 has an SSRF vulnerability in the fal provider image-generation-provider.ts component. Attackers can exploit unguarded image downloads to expose internal service metadata and responses through the image pipeline.

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.

OpenClaw before 2026.3.28 lacks rate limiting in Nextcloud Talk webhook authentication. Attackers can brute-force weak shared secrets to forge webhook events.

OpenClaw before 2026.3.28 has a vulnerability in the Google Chat and Zalouser extensions where group allowlist policies silently downgrade to open policy. Attackers can bypass sender restrictions and interact with bots.

OpenClaw before version 2026.3.28 lacks sufficient scope validation in the node pairing approval path. Low-privilege operators can approve nodes with broader scopes, leading to privilege escalation on paired nodes.

OpenClaw before version 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.

OpenClaw before version 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, allowing unauthorized senders to trigger replies in allowlisted Teams routes.

OpenClaw before version 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.

OpenClaw before version 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile function. An attacker can exploit a TOCTOU race condition by modifying parent paths inside the sandbox, allowing files to be written outside the allowed area.

OpenClaw before version 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can execute channel commands like /config set channels.<provider>.accounts.<id> to modify configuration on target accounts with configWrites: false.

OpenClaw before 2026.3.11 has a credential fallback vulnerability where unavailable local tokens are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to bypass intended authentication boundaries.

OpenClaw before version 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.