Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476) Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Several channel extensions still used raw fetch() against configured base URLs without the SSRF guard that was added for CVE-2026-28476. Commit f92c92515bd439a71bd03eb1bc969c1964f17acf routes those outbound requests through fetchWithSsrFGuard so configured endpoints cannot be rebound to blocked internal destinations. Verified vulnerable on tag v2026.3.24 and fixed on main by commit f92c92515bd439a71bd03eb1bc969c1964f17acf. Fix Commit(s) - f92c92515bd439a71bd03eb1bc969c1964f17acf
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Google Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit 11ea1f67863d88b6cbcb229dd368a45e07094bff requires stable group IDs for access decisions. Verified vulnerable on tag v2026.3.24 and fixed on main by commit 11ea1f67863d88b6cbcb229dd368a45e07094bff. Fix Commit(s) - 11ea1f67863d88b6cbcb229dd368a45e07094bff
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
sessionstatus sessionId resolution bypasses sandboxed session-tree visibility Affected Packages / Versions - Package: openclaw - Affected versions: = 2026.3.11, <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details sessionstatus previously resolved a sessionId to a canonical session key after early visibility checks, letting sandboxed children reach parent or sibling sessions that were blocked by explicit sessionKey. Commit d9810811b6c3c9266d7580f00574e5e02f7663de enforces visibility after sessionId resolution so sandboxed callers cannot escape their session tree. Verified vulnerable on tag v2026.3.24 and fixed on main by commit d9810811b6c3c9266d7580f00574e5e02f7663de. Fix Commit(s) - d9810811b6c3c9266d7580f00574e5e02f7663de
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gateway HTTP Session History Route Bypasses Operator Read Scope Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details The HTTP /sessions/:sessionKey/history route previously authenticated bearer tokens but skipped the same operator.read check used by chat.history over WebSocket. Commit 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea makes HTTP callers declare operator scopes and rejects history reads that do not include operator.read. Verified vulnerable on tag v2026.3.24 and fixed on main by commit 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea. Fix Commit(s) - 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea
Recommended action: Upgrade to 2026.3.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The image tool did not fully honor the tools.fs.workspaceOnly filesystem boundary. In affected releases, image-path resolution could still traverse sandbox bridge mounts outside the workspace and read files from mounted directories that the other file tools would reject. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.2 - Fixed: = 2026.3.2 - Latest released tags checked: v2026.3.23 (ccfeecb6887cd97937e33a71877ad512741e82b2) and v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53 - 14baadda2c456f3cf749f1f97e8678746a34a7f4 Release Status The complete fix shipped in v2026.3.2 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/agents/openclaw-tools.ts now passes fsPolicy into createImageTool, so the image tool receives the same workspace-only policy input as the other filesystem tools. -…
Recommended action: Upgrade to 2026.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ACP permission resolution trusted conflicting tool identity hints from rawInput and metadata, which could suppress dangerous-tool prompting. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - e4c61723cd2d530680cc61789311d464ab8cdf60 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/acp/client.ts now fails closed when meta, rawInput, and title tool identities conflict instead of trusting spoofable raw input. - src/acp/client.test.ts ships regressions for conflicting tool identity hints and dangerous-tool prompting. OpenClaw thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Synology Chat multi-account configuration could collapse onto a shared webhook path, replacing route ownership and bypassing per-account DM policy separation. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - 980940aa58f862da4e19372597bbc2a9f268d70b Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - extensions/synology-chat/src/accounts.ts now distinguishes inherited base webhook paths from explicit per-account paths. - extensions/synology-chat/src/gateway-runtime.ts now fails closed on inherited or duplicate webhook paths and registers routes without replacement. OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Leaf subagents could still use the send action to message controlled child sessions even when their controlScope was narrower than children. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - 7679eb375294941b02214c234aff3948796969d0 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/auto-reply/reply/commands-subagents/action-send.ts now threads controller context through the send path. - src/agents/subagent-control.ts now blocks send attempts unless the requester owns the target and has controlScope="children". OpenClaw thanks @space08 for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When gateway.trustedProxies was configured, spoofed loopback hops in forwarding headers could be accepted as the client origin and weaken downstream auth and rate-limit decisions. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - fc2d29ea926f47c428c556e92ec981441228d2a4 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/gateway/net.ts now ignores loopback forwarded hops before trusted-proxy client resolution. - That shipped origin fix is the one consumed by canvas auth and gateway auth-rate-limit paths that rely on resolved client identity. OpenClaw thanks @lintsinghua for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
device.pair.approve allowed an operator.pairing approver to approve a pending device request for broader operator scopes than the approver actually held. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - fc2d29ea926f47c428c556e92ec981441228d2a4 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/gateway/server-methods/devices.ts now threads caller scopes into device.pair.approve. - src/infra/device-pairing.ts now rejects requested operator scopes that exceed the approver-held operator scope set. OpenClaw thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Google Chat app-url webhook verification accepted add-on principals outside the intended deployment binding. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - extensions/googlechat/src/auth.ts now requires expectedAddOnPrincipal matching for add-on principals and rejects unexpected issuers. - extensions/googlechat/src/monitor-webhook.ts passes the configured appPrincipal into auth verification for the shipped webhook path. OpenClaw thanks @ijxpwastaken for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nextcloud Talk room authorization matched on collidable room names instead of the stable room token, allowing policy confusion across similarly named rooms. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - extensions/nextcloud-talk/src/inbound.ts now resolves allowlist policy from roomToken-backed room identity. - extensions/nextcloud-talk/src/policy.ts now keys room authorization on stable room tokens instead of display names. OpenClaw thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Tlon settings reconciliation treated explicit empty allowlists as unset, which could silently undo an intended deny-all revocation. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - 3cbf932413e41d1836cb91aed1541a28a3122f93 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - extensions/tlon/src/monitor/index.ts now honors explicit empty allowlists as authoritative deny-all configuration. - extensions/tlon/src/monitor/settings-helpers.test.ts ships regression coverage for explicit empty settings allowlists. Thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Tlon cite expansion happened before channel and DM authorization completed, allowing cite work and content handling before the final auth decision. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - 3cbf932413e41d1836cb91aed1541a28a3122f93 - ebee4e2210e1f282a982c7ef2ad79d77a572fc87 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - extensions/tlon/src/monitor/index.ts now defers cite expansion until after authorization and preserves explicit empty-allowlist semantics. - extensions/tlon/src/monitor/utils.ts and extensions/tlon/src/security.test.ts ship the deferred cite expansion behavior and regressions. OpenClaw thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mutating internal ACP chat commands missed the operator.admin gate that should separate read-only and mutating control-plane actions. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - 229426a257e49694a59fa4e3895861d02a4d767f Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/auto-reply/reply/commands-acp.ts now requires operator.admin for mutating internal ACP actions. - src/auto-reply/reply/commands-acp.test.ts ships regression coverage for non-admin denial and admin success cases. OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mattermost interactive callback dispatch could run action handlers before normal sender authorization checks completed. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - extensions/mattermost/src/mattermost/interactions.ts now requires callback authorization before dispatching actions. - extensions/mattermost/src/mattermost/monitor.ts routes callback authorization through the same sender and allowlist policy used for normal ingress. OpenClaw thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Read-scoped gateway snapshots could expose credentials embedded in channel baseUrl and related endpoint fields. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - f0202264d0de7ad345382b9008c5963bcefb01b7 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/channels/account-snapshot-fields.ts now strips URL userinfo from channel status snapshot fields. - src/config/redact-snapshot.ts now redacts credential-bearing baseUrl and httpUrl fields while preserving safe context. OpenClaw thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Queued node actions were not revalidated against current command policy when later delivered, so stale allowlists or declarations could survive policy tightening. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - ec2c6d83b9f5f91d6d9094842e0f19b88e63e3e2 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/gateway/server-methods/nodes.ts now revalidates queued actions against the current allowlist and declared command set at delivery time. - src/gateway/server-methods/nodes.invoke-wake.test.ts includes the shipped stale-queue regression coverage. OpenClaw thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gateway host exec env override handling did not consistently apply the shared host environment policy, so blocked or malformed override keys could slip through inconsistent sanitization paths. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - 7abfff756d6c68d17e21d1657bbacbaec86de232 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/infra/host-env-security.ts now provides one shared sanitizer and fail-closed diagnostics for blocked or malformed override keys. - src/agents/bash-tools.exec.ts and src/node-host/invoke-system-run.ts both route env overrides through the shared sanitizer before execution. OpenClaw thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Trusted-proxy Control UI sessions without device identity could retain self-declared privileged scopes on the device-less allow path. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - ccf16cd8892402022439346ae1d23352e3707e9e Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/gateway/server/ws-connection/message-handler.ts now strips unbound self-declared scopes on the trusted-proxy no-device path. - src/gateway/server/ws-connection/connect-policy.ts remains the allow path, but the shipped scope scrub prevents privilege retention without device identity. OpenClaw thanks @nexrin for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Voice Call webhook handling buffered request bodies before provider signature checks, enabling bounded unauthenticated resource exhaustion. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - 651dc7450b68a5396a009db78ef9382633707ead Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - extensions/voice-call/src/webhook.ts now enforces header gating and shared pre-auth body caps before reading attacker-controlled request bodies. - extensions/voice-call/src/webhook.test.ts ships regression coverage for missing-signature, oversize, and timeout pre-auth webhook cases. OpenClaw thanks @SEORY0 for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Bonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - deecf68b59a9b7eea978e40fd3c2fe543087b569 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/infra/bonjour-discovery.ts now resolves and returns only concrete endpoints instead of falling back to unresolved TXT host and port hints. - src/cli/gateway-cli/discover.ts consumes only the fail-closed resolved endpoint path. OpenClaw thanks @nexrin for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Remote media HTTP error bodies were read without a hard size cap before failure handling, allowing unbounded allocation on error responses. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - 81445a901091a5d27ef0b56fceedbe4724566438 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/media/fetch.ts now routes non-2xx failures through bounded prefix reads instead of buffering the whole error body. - src/media/read-response-with-limit.ts enforces capped reads and truncates oversized snippets before surfacing failure text. OpenClaw thanks @YLChen-007 for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Android Canvas WebView pages from untrusted origins could invoke the JavascriptInterface bridge and inject instructions into the app. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - 8b02ef133275be96d8aac2283100016c8a7f32e5 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - apps/android/app/src/main/java/ai/openclaw/app/ui/CanvasScreen.kt now snapshots page origin and rejects untrusted bridge calls. - apps/android/app/src/main/java/ai/openclaw/app/node/CanvasActionTrust.kt centralizes trusted origin and path validation for the bridge. OpenClaw thanks @cyjhhh for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Allow-always exec approvals did not unwrap /usr/bin/time, so an unregistered time wrapper could bypass executable binding and reuse approval state for the inner command. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.3.22 - Fixed: = 2026.3.22 - Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked: 2026.3.23-2 Fix Commit(s) - 39409b6a6dd4239deea682e626bac9ba547bfb14 Release Status The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2. Code-Level Confirmation - src/infra/dispatch-wrapper-resolution.ts now unwraps /usr/bin/time and binds approvals to the real inner executable. - src/infra/exec-approvals-allow-always.test.ts ships regression coverage for time-wrapper allow-always approval bypasses. OpenClaw thanks @YLChen-007 for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.