Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The message tool accepted mediaUrl and fileUrl aliases without applying the same sandbox localRoots validation as the canonical media path handling. Impact A caller constrained to sandbox media roots could read arbitrary local files by routing them through the alias parameters. Affected Component src/infra/outbound/message-action-params.ts, src/infra/outbound/message-action-runner.ts Fixed Versions - Affected: < 2026.3.24 - Patched: = 2026.3.24 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 1d7cb6fc03 (fix: close sandbox media root bypass for mediaUrl/fileUrl aliases). OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget. Impact An unauthenticated network attacker could consume socket and worker capacity and disrupt WebSocket availability for legitimate clients. Affected Component src/gateway/server-http.ts, src/gateway/server/preauth-connection-budget.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit cb5f7e201f (gateway: cap concurrent pre-auth websocket upgrades). Discovered by：Topsec AlphaLab (wang dong)
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Feishu upload path resolution could read files outside the configured localRoots sandbox before handing them to the upload path. Impact A tool caller constrained to workspace or localRoots paths could exfiltrate arbitrary host files through Feishu upload actions. Affected Component extensions/feishu/src/docx.ts Fixed Versions - Affected: = 2026.2.6, <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 764394c78b (fix: enforce localRoots sandbox on Feishu docx upload file reads).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discord text approval commands resolved pending exec approvals without honoring the configured approver allowlist. Impact A Discord user who was allowed to send commands but was not in the approver list could still approve pending host execution. Affected Component extensions/discord/src/exec-approvals.ts, src/auto-reply/reply/commands-approve.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 355abe5eba (Discord: enforce approver checks for text approvals).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Removing a device or revoking its token updated stored credentials but did not disconnect already-authenticated WebSocket sessions. Impact A revoked device could continue using its existing live session until reconnect, extending access beyond credential removal. Affected Component src/gateway/server-methods/devices.ts, src/gateway/server.impl.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 7a801cc451 (Gateway: disconnect revoked device sessions). OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Remote onboarding accepted discovered gateway endpoints without an explicit trust confirmation before persisting the remote URL and connection details. Impact A malicious or spoofed discovery endpoint could steer onboarding toward an attacker-controlled gateway and capture future gateway credentials or traffic. Affected Component src/commands/onboard-remote.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit d6affb17d8 (CLI: confirm discovered remote gateways before saving config).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Zalo image path fetched and stored inbound media before the DM/pairing authorization checks ran. Impact Unauthorized senders could force network fetches and disk writes in the inbound media store even when the message itself was rejected. Affected Component extensions/zalo/src/monitor.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 68ceaf7a5f (zalo: gate image downloads before DM auth). OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The /pair approve command path called device approval without forwarding caller scopes into the core approval check. Impact A caller that held pairing privileges but not admin privileges could approve a pending device request asking for broader scopes, including admin access. Affected Component extensions/device-pair/index.ts, src/infra/device-pairing.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 4ee4960de2 (Pairing: forward caller scopes during approval). OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key. Impact An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing. Affected Component extensions/voice-call/src/webhook-security.ts Fixed Versions - Affected: <= 2026.3.24 - Patched: = 2026.3.28 - Latest stable 2026.3.28 contains the fix. Fix Fixed by commit 85777e726c (Voice Call: canonicalize Plivo V3 replay key).
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fixed in OpenClaw 2026.3.24, the current shipping release. Title Non-owner command-authorized sender can change the owner-only /send session delivery policy CWE CWE-285 Improper Authorization CVSS v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Base score: 5.4 (Medium) Severity Assessment Medium. This is a real owner-only authorization bypass, but the demonstrated impact is limited to persistent mutation of the current session’s delivery policy rather than direct code execution, sandbox escape, or cross-host compromise. Impact A non-owner sender who is allowed to run commands can invoke /send on|off|inherit and persistently change the current session’s sendPolicy, even though OpenClaw documents /send as owner-only. That lets a lower-trust participant: - disable reply delivery for the current session (/send off), suppressing future replies in that chat; - re-enable reply delivery (/send on) after the owner intentionally disabled it; - remove the session override (/send inherit).…
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fixed in OpenClaw 2026.3.24, the current shipping release. Title browser.request still allows POST /reset-profile through the operator.write surface in OpenClaw v2026.3.22 after GHSA-vmhq-cqm9-6p7q Severity Assessment High CWE: - CWE-863: Incorrect Authorization Proposed CVSS v3.1: - 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) An authenticated caller who only has access to the scoped Gateway method browser.request on the operator.write surface can still reach a destructive persistent-profile management route. Likely related advisory family: - GHSA-vmhq-cqm9-6p7q This should be treated as a later-version residual or incomplete fix. The earlier fix blocked POST /profiles/create and profile deletion, but the latest released v2026.3.22 code still omits POST /reset-profile from the same mutation gate. Impact A caller with operator.write access to browser.request can still trigger persistent profile reset via POST /reset-profile. This crosses the intended privilege boundary for…
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fixed in OpenClaw 2026.3.24, the current shipping release. Title Mutating internal /allowlist chat commands missed operator.admin scope enforcement CWE CWE-862 Missing Authorization CVSS v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Base score: 6.5 (Medium) Severity Assessment Medium. This is a real authorization flaw in OpenClaw’s internal control plane. The issue does not require host access, trusted local state tampering, or multi-tenant assumptions, but exploitation does require an already authenticated internal Gateway caller with operator.write. Impact An authenticated internal Gateway caller limited to operator.write can perform state-changing /allowlist actions without operator.admin, even though comparable mutating internal chat commands already require operator.admin. The reachable effects are persistent changes to config-backed allowFrom entries and pairing-store-backed allowlist entries. This is not a semantic-modeling complaint and not a generic “trusted operator can…
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fixed in OpenClaw 2026.3.24, the current shipping release. Summary The shared /allowlist command persists channel authorization config through writeConfigFile(...) but does not re-validate gateway client scopes for internal gateway callers. Because chat.send is intentionally reachable to operator.write callers and still creates a generic command-authorized internal context, an authenticated write-scoped gateway client can indirectly mutate channel allowFrom and groupAllowFrom policy that direct config.patch correctly reserves to operator.admin. This is not just a generic code smell. The current code already shows the intended boundary by adding sink-side internal admin checks to shared /config and /plugins writes, but /allowlist was left behind. Details The gateway's documented scope split is clear: - chat.send is a write-scoped action. - direct config mutation is an admin-scoped action. The vulnerable path is: 1. A gateway client authenticates with operator.write. 2. The client…
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fixed in OpenClaw 2026.3.24, the current shipping release. Summary During the installation phase of OpenClaw local plugins/hooks, the Git executable can be hijacked by a project-level .npmrc file, leading to arbitrary code execution during installation. Details Please note that the source code locations mentioned below are based on version openclaw-2026.3.13-1, but the issue has been confirmed to still exist in the current latest version, 2026.3.23. When installing a local plugin directory, local plugin archive, local hook pack directory, or local hook pack archive, OpenClaw first copies the source directory to a temporary stageDir, then executes the following in that directory: See src/infra/install-package-dir.ts:176-199. Since this process does not strip the project root .npmrc, and npm reads the project-level .npmrc during local project installation, an attacker could use a .npmrc file in a malicious plugin or hook directory to override npm’s git executable path. By leveraging a…
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fixed in OpenClaw 2026.3.24, the current shipping release. Summary The OpenAI-compatible HTTP endpoint /v1/models accepts bearer auth but does not enforce operator method scopes. In contrast, the WebSocket RPC path enforces operator.read for models.list. A caller connected with operator.approvals (no read scope) is rejected for models.list (missing scope: operator.read) but can still enumerate model metadata through HTTP /v1/models. Confirmed on current main at commit 06de515b6c42816b62ec752e1c221cab67b38501. Details The WS control-plane path enforces role/scope checks centrally before dispatching methods. For non-admin operators, this includes required method scopes such as operator.read for models.list. The HTTP compatibility path for /v1/models performs bearer authorization and then returns model metadata; it does not apply an equivalent scope check. As reproduced, a caller with only operator.approvals can: 1. connect successfully, 2. fail models.list over WS with missing scope:…
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fixed in OpenClaw 2026.3.24, the current shipping release. Advisory Details Title: Incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant) Description: Summary The patch for CVE-2026-32011 tightened pre-auth body parsing limits (from 1MB/30s to 64KB/5s) across several webhook handlers. However, the Feishu extension's webhook handler was not included in the patch and still accepts request bodies with the old permissive limits (1MB body, 30-second timeout) before verifying the webhook signature. An unauthenticated attacker can exhaust server connection resources by sending concurrent slow HTTP POST requests to the Feishu webhook endpoint. Details In extensions/feishu/src/monitor.ts, the webhook HTTP handler uses installRequestBodyLimitGuard with permissive limits at lines 276-278: The body guard is installed at line 276 before the request reaches the Lark SDK's adaptDefault webhook handler (line 284), which performs signature…
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fixed in OpenClaw 2026.3.24, the current shipping release. Advisory Details Title: Sandbox Media Root Bypass via Unnormalized mediaUrl / fileUrl Parameter Keys (CWE-22) Description: Summary A path traversal vulnerability in the agent sandbox enforcement allows a sandboxed agent to read arbitrary files from other agents' workspaces by using the mediaUrl or fileUrl parameter key in message tool calls. The normalizeSandboxMediaParams function only checks ["media", "path", "filePath"] keys, while mediaUrl and fileUrl escape normalization entirely. Combined with handlePluginAction dropping mediaLocalRoots from the dispatch context, this enables a full sandbox escape where any agent can read files outside its designated sandbox root. Details The vulnerability exists in two files within the messaging pipeline: 1. Incomplete parameter key coverage in normalizeSandboxMediaParams: In src/infra/outbound/message-action-params.ts, the function iterates over a hardcoded allowlist of parameter keys…
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fixed in OpenClaw 2026.3.24, the current shipping release. Advisory Details Title: Incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in !stop Chat Command via shell-utils.ts Description: Summary The !stop (and /bash stop) chat command kills background bash processes using SIGKILL directly, without first sending SIGTERM to allow graceful shutdown. This is because bash-command.ts imports killProcessTree() from src/agents/shell-utils.ts, which still contains the pre-CVE-2026-27486 aggressive kill logic, rather than from the patched src/process/kill-tree.ts. Details CVE-2026-27486 fixed unsafe process termination by introducing a graceful shutdown sequence in src/process/kill-tree.ts — sending SIGTERM first, waiting a configurable grace period (default 3 seconds), then escalating to SIGKILL only if the process is still alive. However, an identical copy of the unpatched killProcessTree function remains in src/agents/shell-utils.ts (lines 170–192). This function sends SIGKILL…
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ACP CLI approval prompt ANSI escape sequence injection Affected Packages / Versions - Package: openclaw - Affected versions: = 2026.2.13, <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details ACP tool titles could previously carry ANSI control sequences into approval prompts and permission logs, letting untrusted tool metadata spoof terminal output. Commit 464e2c10a5edceb380d815adb6ff56e1a4c50f60 sanitizes tool titles at the source and broadens ANSI stripping to full CSI sequences. Verified vulnerable on tag v2026.3.24 and fixed on main by commit 464e2c10a5edceb380d815adb6ff56e1a4c50f60. Fix Commit(s) - 464e2c10a5edceb380d815adb6ff56e1a4c50f60
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Telegram callback queries from direct messages previously used weaker callback-only authorization and could mutate session state without satisfying normal DM pairing. Commit 269282ac69ab6030d5f30d04822668f607f13065 enforces DM authorization for callbacks. Verified vulnerable on tag v2026.3.24 and fixed on main by commit 269282ac69ab6030d5f30d04822668f607f13065. Fix Commit(s) - 269282ac69ab6030d5f30d04822668f607f13065
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Weak Webhook Token Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Synology Chat webhook auth previously rejected invalid tokens without throttling repeated guesses, allowing brute-force attempts against weak webhook secrets. Commit 0b4d07337467f4d40a0cc1ced83d45ceaec0863c adds repeated-guess throttling before auth failure responses. Verified vulnerable on tag v2026.3.24 and fixed on main by commit 0b4d07337467f4d40a0cc1ced83d45ceaec0863c. Fix Commit(s) - 0b4d07337467f4d40a0cc1ced83d45ceaec0863c
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
MS Teams Feedback Invoke Bypasses Sender Allowlists and Records Unauthorized Session Feedback Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Microsoft Teams feedback invokes previously bypassed sender authorization and could record feedback or trigger reflection for unauthorized senders. Commit c5415a474bb085404c20f8b312e436997977b1ea applies the same DM and group authorization checks to feedback invokes. Verified vulnerable on tag v2026.3.24 and fixed on main by commit c5415a474bb085404c20f8b312e436997977b1ea. Fix Commit(s) - c5415a474bb085404c20f8b312e436997977b1ea
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gateway Plugin Subagent Fallback deleteSession Uses Synthetic operator.admin Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Gateway plugin subagent fallback deleteSession previously dispatched sessions.delete with a synthetic operator.admin runtime scope when no request-scoped client existed. Commit b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7 binds deletion to the caller scope instead of minting admin scope. Verified vulnerable on tag v2026.3.24 and fixed on main by commit b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7. Fix Commit(s) - b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Feishu Raw card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Feishu raw card sends could previously mint legacy callback payloads that bypassed DM pairing and let unpaired recipients reach callback handling. Commit 81c45976db532324b5a0918a70decc19520dc354 rejects legacy raw-card command payloads so callbacks stay on the normal paired path. Verified vulnerable on tag v2026.3.24 and fixed on main by commit 81c45976db532324b5a0918a70decc19520dc354. Fix Commit(s) - 81c45976db532324b5a0918a70decc19520dc354
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Feishu webhook reads and parses unauthenticated request bodies before signature validation Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Feishu webhook handling previously parsed JSON before signature validation, which let unauthenticated callers force full JSON parsing work before rejection. Commit 5e8cb22176e9235e224be0bc530699261eb60e53 reads the raw request body, validates the signature first, and only then parses JSON. Verified vulnerable on tag v2026.3.24 and fixed on main by commit 5e8cb22176e9235e224be0bc530699261eb60e53. Fix Commit(s) - 5e8cb22176e9235e224be0bc530699261eb60e53
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.