Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
LINE webhook handler lacks shared pre-auth concurrency budget before signature verification Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Shipped v2026.3.28 lacks a shared pre-auth concurrency budget on the public LINE webhook path, but the effect is bounded transient availability loss only, so low fits. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 57c47d8c7fbf5a2e70cc4dec2380977968903cad — 2026-03-31T19:34:25+09:00 OpenClaw thanks @nexrin for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Matrix thread root and reply context bypass sender allowlist Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Real in shipped v2026.3.28 Matrix because fetched thread-root/reply context bypasses sender allowlists, with unreleased mainline filtering fix. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 8a563d603b70ef6338915f0527bee87282c3bad5 — 2026-03-31T17:09:03+01:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Workspace .env can override the bundled hooks root and load attacker hook code Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: v2026.3.28 still lets workspace .env override OPENCLAWBUNDLEDHOOKSDIR, which can replace trusted default-on bundled hooks from an untrusted workspace. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 330a9f98cb29c79b1c16a2117e03d6276a0d6289 — 2026-03-31T19:25:12+09:00 OpenClaw thanks @nexrin for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Feishu thread history and quoted messages bypass sender allowlist Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Real in shipped v2026.3.28 Feishu because fetched quoted/root/thread context bypasses sender allowlists, and SECURITY.md does not exempt remote sender-allowlist bypasses. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - f45e5a6569aab1d58cc6de25b19f1dc4c8779b85 — 2026-03-31T19:43:54+09:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation Current Maintainer Triage - Status: open - Normalized severity: Critical Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - a30214a624946fc5c85c9558a27c1580172374fd — 2026-03-31T09:06:51+09:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Zalo webhook replay cache cross-target messageId scope bypass Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: v2026.3.28 replay dedupe is still keyed too broadly, but the issue should stay scoped to authenticated sibling-target delivery paths rather than arbitrary unauthenticated attackers. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 4d038bb242c11f39e45f6a4bde400e5fd42e4ebf — 2026-03-31T19:33:57+09:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @smaeljaish771 for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: v2026.3.28 still models Nostr privateKey as plain string so config views can expose it, and the secret-schema fix is unreleased. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 57700d716f660591fb6e09727f3ca8041fa48b9d — 2026-03-31T19:55:03+09:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @ccreater222 for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
PIPINDEXURL and UVINDEXURL bypass host exec env sanitization and redirect Python package-index traffic Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay limited to approved or allowlisted package-management exec paths, not arbitrary remote execution. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 7ae1bb0c7799fd0cbd2d4de7b0f5b8039837ab8d — 2026-03-31T09:53:32+09:00 OpenClaw thanks @nexrin for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Voice-call Plivo replay mutates in-process callback origin before replay rejection Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: v2026.3.28 can still mutate Plivo callback origin before replay rejection, but this needs a captured valid callback for a live call so medium is overstated. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - efe9183f9d2fd5e01c8068fa01f4a07a58a63c0b — 2026-03-31T19:50:35+09:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @zsxsoft for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unauthenticated plugin-auth HTTP routes receive operator runtime scopes Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still gives auth:"plugin" routes operator WRITESCOPE, but impact should stay limited to plugin routes that actually touch privileged runtime actions before plugin auth completes. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 2a1db0c0f1fa375004a95ba0ef030534790a6d47 — 2026-04-01T00:20:49+09:00 OpenClaw thanks @davidluzsilva for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values. Impact A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive environment settings when OpenClaw started there. Affected Component src/infra/dotenv.ts, src/cli/dotenv.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 6a79324802 (Filter untrusted CWD .env entries before OpenClaw startup).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Allow-always persistence could trust wrapper carrier executables instead of the actual invoked target when commands were routed through dispatch wrappers. Impact A one-time approval could persist a broader future allowlist entry than the operator intended, weakening execution approval boundaries. Affected Component src/infra/exec-approvals-allowlist.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 9ec44fad39 (Exec approvals: reject wrapper carrier allow-always targets).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The fal provider used raw fetches for both provider API traffic and returned image download URLs instead of the existing SSRF-guarded fetch path. Impact A malicious or compromised fal relay could make the gateway fetch internal URLs and expose metadata or internal service responses through the image pipeline. Affected Component extensions/fal/image-generation-provider.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 80d1e8a11a (fal: guard image fetches). OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When only a route-level group allowlist was configured, sender policy resolution silently downgraded from allowlist to open instead of preserving the configured group policy. Impact Any member of an allowlisted Google Chat space or Zalouser group could interact with the bot even when the operator intended sender-level restrictions. Affected Component extensions/googlechat/src/monitor-access.ts, extensions/zalouser/src/monitor.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit e64a881ae0 (Channels: preserve routed group policy). OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The chat.send path reused command authorization to trigger /reset session rotation even though direct session reset is an admin-only control-plane operation. Impact A write-scoped gateway caller could rotate a target session, archive the prior transcript state, and force a new session id without admin scope. Affected Component src/gateway/server-methods/chat.ts, src/auto-reply/reply/session.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit be00fcfccb (Gateway: align chat.send reset scope checks).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The node pairing approval path did not consistently enforce that the approving caller already held every scope requested by the node. Impact A lower-privileged operator could approve a pending node request for broader scopes and extend privileges onto the paired node. Affected Component src/infra/node-pairing.ts, src/gateway/server-methods/nodes.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 4d7cc6bb4f (gateway: restrict node pairing approvals). OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Allow-always persistence did not unwrap /usr/bin/script and similar wrappers to the actual executed target before storing trust decisions. Impact A user approval for one wrapped command could persist trust for a wrapper binary that later executed a different underlying program. Affected Component src/infra/dispatch-wrapper-resolution.ts, src/infra/exec-wrapper-resolution.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 83da3cfe31 (infra: unwrap script wrapper approval targets).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Host exec env override sanitization did not fail closed for several package-manager and related redirect variables that can steer dependency fetches or startup behavior. Impact An approved exec request could silently redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content. Affected Component src/infra/host-env-security-policy.json, src/infra/host-env-security.ts Fixed Versions - Affected: < 2026.3.22 - Patched: = 2026.3.22 Fix Fixed by commit 7abfff756d (Exec: harden host env override handling across gateway and node).
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nextcloud Talk webhook signature failures were not throttled even though the integration relies on an operator-configured shared secret that may be weak. Impact An attacker who could reach the webhook endpoint could brute-force weak secrets online and then forge inbound webhook events. Affected Component extensions/nextcloud-talk/src/monitor.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit e403decb6e (nextcloud-talk: throttle repeated webhook auth failures). OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SSRF/IP classifier treated several IPv6 special-use ranges as public and allowed fetches to proceed. Impact An attacker who controlled a fetched URL could target internal or non-routable IPv6 addresses that should have been blocked by the SSRF guard. Affected Component src/shared/net/ip.ts, src/infra/net/ssrf. Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit d61f8e5672 (Net: block missing IPv6 special-use ranges). OpenClaw thanks @nicky-cc of Tencent zhuque Lab https://github.com/Tencent/AI-Infra-Guard for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discord button and component interaction ingress did not consistently reapply the same guild and channel policy gates used for normal inbound messages. Impact Users could trigger privileged component actions from contexts that should have been blocked by Discord channel policy. Affected Component extensions/discord/src/monitor/agent-components.ts Fixed Versions - Affected: = 2026.2.14, <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 511093d4b3 (Discord: apply component interaction policy gates).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ACP-only provenance fields in chat.send were gated by self-declared client metadata from the WebSocket handshake rather than verified authorization state. Impact A normal authenticated operator client could spoof ACP identity labels and inject reserved provenance fields intended only for the ACP bridge. Affected Component src/gateway/server-methods/chat.ts, src/gateway/server/ws-connection/message-handler.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 4b9542716c (Gateway: require verified scope for chat provenance).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The chat.send path let authorized write-scoped callers persist /verbose session overrides even though the same stored session mutation is admin-only through sessions.patch. Impact A write-scoped gateway caller could persist verbose output for later runs and expose more reasoning or tool output than the operator intended. Affected Component src/auto-reply/reply/directive-handling.impl.ts, src/gateway/sessions-patch.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit c603123528 (fix(gateway): require admin for persisted verbose defaults).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Host execution env sanitization did not block GITTEMPLATEDIR or AWSCONFIGFILE, even though both can redirect trusted tooling to attacker-controlled content. Impact An approved exec request could redirect git or AWS CLI behavior through attacker-controlled configuration and execute untrusted code or load attacker-selected credentials. Affected Component src/infra/host-env-security-policy.json, src/infra/host-env-security.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 6eb82fba3c (Infra: block additional host exec env keys). OpenClaw thanks @nicky-cc of Tencent zhuque Lab https://github.com/Tencent/AI-Infra-Guard for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The jq safe-bin policy blocked explicit env usage but still allowed jq programs that accessed environment data through $ENV. Impact An operator-approved safe-bin jq command could disclose environment variables that the safe-bin policy was supposed to keep out of scope. Affected Component src/infra/exec-safe-bin-semantics.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 78e2f3d66d (Exec: tighten jq safe-bin env checks). Thanks @nicky-cc of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.