Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
When browser control started without explicit auth credentials, OpenClaw attempted to bootstrap auth automatically. In affected versions, if that bootstrap step threw an error, startup could continue and expose browser-control routes without authentication. Impact On affected deployments, a local process (or a loopback-reachable SSRF path) could access browser-control routes, including evaluate-capable actions, without auth. Fix Startup now fails closed: if bootstrap auth fails and no explicit token/password is configured, browser-control startup aborts. Affected and Patched Versions - Affected: <= 2026.2.26 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Summary The OpenClaw ACP client could auto-approve tool calls based on untrusted metadata and permissive name heuristics. A malicious or compromised ACP tool invocation could bypass expected interactive approval prompts for read-class operations. Affected Packages / Versions - Package: npm openclaw - Affected published versions: <= 2026.2.22-2 (latest published as of February 24, 2026 is 2026.2.22-2) - Patched in code on main: 2026.2.23 (released) Technical Details - Permission classification trusted incoming toolCall.kind and heuristic name matching. - Non-core read-like names and spoofed kind metadata could reach auto-approve paths. - read operations were not scoped strongly enough to cwd in all metadata/title forms. Fix - Require trusted core tool IDs for auto-approval and ignore untrusted toolCall.kind as an authorization source. - Scope read auto-approval to cwd-resolved paths. - Add stricter tool-name validation and regression coverage for spoofed kind and…
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
applySkillConfigEnvOverrides previously copied skills.entries..env values into the host process.env without applying the host env safety policy. Impact In affected versions, dangerous process-level variables such as NODEOPTIONS could be injected when unset, which can influence runtime/child-process behavior. Required attacker capability An attacker must be able to modify OpenClaw local state/config (for example ~/.openclaw/openclaw.json) to set skills.entries.<skill.env or related skill config values. Remediation Fixed in 2026.2.21 by sanitizing skill env overrides and blocking dangerous host env keys (including NODEOPTIONS) before applying overrides, with regression tests covering blocked dangerous keys. Fix Commit(s) - 8c9f35cdb51692b650ddf05b259ccdd75cc9a83c Found using MCPwner
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability The ACP bridge accepted very large prompt text blocks and could assemble oversized prompt payloads before forwarding them to chat.send. Because ACP runs over local stdio, this mainly affects local ACP clients (for example IDE integrations) that send unusually large inputs. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.17 - Patched version: 2026.2.18 (planned next release) Impact - Local ACP sessions may become less responsive when very large prompts are submitted - Larger-than-expected model usage/cost when oversized text is forwarded - No privilege escalation and no direct remote attack path in the default ACP model Affected Components - src/acp/event-mapper.ts - src/acp/translator.ts Remediation - Enforce a 2 MiB prompt-text limit before concatenation - Count inter-block newline separator bytes during pre-concatenation size checks - Keep final outbound message-size validation before chat.send - Avoid stale active-run session…
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - openclaw npm package versions <= 2026.2.17. Vulnerability Cron webhook delivery in src/gateway/server-cron.ts used fetch() directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks. Fix Commit(s) - 99db4d13e - 35851cdaf Thanks @Adam55A-code for reporting.
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability skills/skill-creator/scripts/packageskill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents. Severity and Exposure - Severity: Low - Execution context: local/manual workflow only (skill author packaging step) - No remote trigger: this is not reachable via normal OpenClaw gateway/chat runtime paths - No extraction Zip Slip in this finding: this issue is limited to packaging-time symlink following Impact - Potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact. - Requires local execution of the packaging script on attacker-controlled skill contents. Affected Components - skills/skill-creator/scripts/packageskill.py Affected Packages / Versions - Package: openclaw (npm) -…
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discord moderation action handling (timeout, kick, ban) used sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. Impact In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user could request moderation actions by spoofing sender identity fields. Affected Packages / Versions - Package: openclaw (npm) - Latest published affected version (as of 2026-02-19): 2026.2.17 - Affected range: <=2026.2.17 - Fixed in planned next release: 2026.2.18 Fix - Moderation authorization now uses trusted sender context (requesterSenderId) instead of untrusted action params. - Added permission checks for required guild capabilities per action. Fix Commit(s) - 775816035ecc6bb243843f8000c9a58ff609e32d Thanks @aether-ai-agent for reporting.
Recommended action: Upgrade to 2026.2.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An information disclosure vulnerability in OpenClaw's tools.exec.safeBins approval flow allowed a file-existence oracle. When safe-bin validation examined candidate file paths, command allow/deny behavior could differ based on whether a path already existed on the host filesystem. An attacker could probe for file presence by comparing outcomes for existing vs non-existing filenames. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.17 - Latest published vulnerable version at triage time: 2026.2.17 - Planned patched version: 2026.2.18 Impact Attackers with access to this execution surface could infer whether specific files exist (for example secrets/config files), enabling filesystem enumeration and improving follow-on attack planning. Fix The safe-bin policy was changed to deterministic argv-only validation without host file-existence checks. File-oriented flags are blocked for safe-bin mode (for example sort -o, jq -f, grep -f), and trusted-path…
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
tools.exec.safeBins could be bypassed for filesystem access when sort output flags (-o / --output) or recursive grep flags were allowed through safe-bin execution paths. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.17 - Patched versions: = 2026.2.19 - Latest published version at triage time: 2026.2.17 Impact In deployments that enabled tools.exec.safeBins, an attacker with access to command execution flows could turn intended stdin-only safe-bin usage into file writes (sort -o) or recursive file reads (grep -R). Fix Commit(s) - 2c05cbb43e48ebad03626d3125746fb1b9a8520f Found using MCPwner Thanks @nedlir for reporting.
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In affected versions, when applypatch was enabled and the agent ran without filesystem sandbox containment, crafted paths could cause file writes/deletes outside the configured workspace directory. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.13 - Fixed: = 2026.2.14 Details The non-sandbox path resolution in applypatch did not enforce workspace containment. Inputs like ../../... or absolute paths could escape the working directory in non-sandboxed mode. Impact Practical impact depends on deployment and who can trigger tool execution. This is most relevant when tool invocation is exposed to less-trusted callers or when operators expected workspace-only containment. Workarounds - Keep tools.exec.applyPatch.enabled disabled if you do not need applypatch. - Keep tools.exec.applyPatch.workspaceOnly at its secure default of true. - Restrict who can trigger tool execution (and which tools are allowlisted). Configuration Note…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - npm package: openclaw - Affected versions: <= 2026.2.14 - Fixed version (pre-set): 2026.2.15 Description The sandbox identifier cache key for Docker/browser sandbox configuration used SHA-1 to hash normalized configuration payloads. SHA-1 is deprecated for cryptographic use and has known collision weaknesses. In this code path, deterministic IDs are used to decide whether an existing sandbox container can be reused safely. A collision in this hash could let one configuration be interpreted as another under the same sandbox cache identity, increasing the risk of cache poisoning and unsafe sandbox state reuse. The implementation now uses SHA-256 for these deterministic hashes to restore collision resistance for this security-relevant identifier path. Fix Commit(s) - 559c8d993 Release Process Note patchedversions is pre-set to 2026.2.15 for the next release. After that release is published, mark this advisory ready for publication. Thanks @kexinoh ( of…
Recommended action: Upgrade to 2026.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The webfetch tool could be used to crash the OpenClaw Gateway process (OOM / resource exhaustion) by fetching and attempting to parse attacker-controlled web pages with oversized response bodies or pathological HTML nesting. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.14 - Fixed versions: = 2026.2.15 Impact An attacker can social-engineer a user (or any automation that uses webfetch) into fetching a malicious URL that returns extremely large or deeply nested HTML. The Gateway may exhaust memory or become unresponsive, causing a denial of service. Fix The Gateway now caps the downloaded response body size before any HTML parsing and adds additional guards to avoid running Readability/DOM parsing on pathological HTML. Fix Commit(s) - 166cf6a3e04c7df42bea70a7ad5ce2b9df46d147 Release Process Note This advisory is prepared for the next npm release. Once openclaw@2026.2.15 is published, publish this advisory without further edits. Thanks…
Recommended action: Upgrade to 2026.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stored XSS in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline <script tag without script-context-safe escaping. A crafted value containing </script could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.14 - Fixed in: = 2026.2.15 (next release; fix is already merged on main) Details The gateway Control UI HTML response previously injected assistantName and assistantAvatar directly into an inline <script block using JSON.stringify(...). JSON.stringify does not prevent </script from terminating the script element, enabling stored XSS if an operator/admin sets the assistant identity to a malicious string. OpenClaw’s Control UI is intended for local use only (see SECURITY.md); this advisory’s CVSS reflects a loopback-only/local-access deployment assumption. Impact An attacker with the ability to set assistant…
Recommended action: Upgrade to 2026.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.14 - Fixed in: planned release 2026.2.15 Impact A bug in download skill installation allowed targetDir values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated. In the admin-only skills.install flow, this could write files outside the intended install sandbox. Fix Commit(s) - 2363e1b08 fix(security): restrict skill download target paths - b6305e972 test(skills): split installer security coverage Acknowledgement Thanks @Adam55A-code for reporting.
Recommended action: Upgrade to 2026.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
normalizeForHash in src/agents/sandbox/config-hash.ts recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arrays hash to the same value even when order changed. In OpenClaw sandbox flows, this hash is used to decide whether existing sandbox containers should be recreated. As a result, order-only config changes (for example Docker dns and binds array order) could be treated as unchanged and stale containers could be reused. This is a configuration integrity issue affecting sandbox recreation behavior. Affected Packages / Versions - Package: openclaw (npm) - Affected: <=2026.2.14 - Patched (planned next release): =2026.2.15 - Latest published npm version at triage time (2026-02-16): 2026.2.14 Remediation Array ordering is now preserved during hash normalization; only object key ordering remains normalized for deterministic hashing. Fix Commit(s) - 41ded303b4f6dae5afa854531ff837c3276ad60b Release Process Note…
Recommended action: Upgrade to 2026.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability In some shared-agent deployments, OpenClaw session tools (sessionslist, sessionshistory, sessionssend) allowed broader session targeting than some operators intended. This is primarily a configuration/visibility-scoping issue in multi-user environments where peers are not equally trusted. In Telegram webhook mode, monitor startup also did not fall back to per-account webhookSecret when only the account-level secret was configured. Typical Use Case Context Most regular OpenClaw deployments run a single agent, or run in trusted environments. In those setups, practical risk from this issue is generally low. Impact - Shared-agent, multi-user, less-trusted environments: session-tool access could expose transcript content across peer sessions. - Single-agent or trusted environments: practical impact is limited. - Telegram webhook mode: account-level secret wiring could be missed unless an explicit monitor webhook secret override was provided. Affected Packages / Versions -…
Recommended action: Upgrade to 2026.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include https://api.telegram.org/bot<token/...). OpenClaw previously logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles. Impact Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.14 - Fixed: = 2026.2.15 (next release) Mitigation - Upgrade to openclaw = 2026.2.15 when released. - Rotate the Telegram bot token if it may have been exposed. Fix Commit(s) - cf6990701b258bb9cc4ac7f6c7bdf05016e7f6e46 Thanks @aether-ai-agent for reporting.
Recommended action: Upgrade to 2026.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.14 - Fixed version: = 2026.2.15 (next release) Impact If an attacker can influence sandbox Docker configuration (or an operator pastes untrusted config), they may be able to: - mount sensitive host paths (e.g. /etc, /proc, /sys, /dev, Docker socket) - use network=host to bypass container network isolation - use seccompProfile=unconfined / apparmorProfile=unconfined to weaken isolation This can lead to host secret exfiltration or full host control (via Docker socket exposure). Fix OpenClaw now blocks dangerous sandbox Docker settings: - runtime enforcement when building docker create args - config-schema validation for network=host, seccompProfile=unconfined, apparmorProfile=unconfined…
Recommended action: Upgrade to 2026.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw embedded the current working directory (workspace path) into the agent system prompt without sanitization. If an attacker can cause OpenClaw to run inside a directory whose name contains control/format characters (for example newlines or Unicode bidi/zero-width markers), those characters could break the prompt structure and inject attacker-controlled instructions. Impact Prompt injection may alter agent behavior and could lead to unintended tool use or disclosure of sensitive information. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable versions: < 2026.2.15 (latest published vulnerable version as of 2026-02-16: 2026.2.14) - Patched versions: = 2026.2.15 Fix The workspace path is now sanitized before it is embedded into any LLM prompt output, stripping Unicode control/format characters and explicit line/paragraph separators. Workspace path resolution also applies the same sanitization as defense-in-depth. Fix Commit(s) -…
Recommended action: Upgrade to 2026.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
openclaw could start the sandbox browser bridge server without authentication. When the sandboxed browser is enabled, openclaw runs a local (loopback) HTTP bridge that exposes browser control endpoints (for example /profiles, /tabs, /tabs/open, /agent/). Due to missing auth wiring in the sandbox initialization path, that bridge server accepted requests without requiring gateway auth. Impact A local attacker (any process on the same machine) could access the bridge server port and: - enumerate open tabs and retrieve CDP WebSocket URLs - open/close/navigate tabs - execute JavaScript in page contexts via CDP - exfiltrate cookies/session data and page contents from authenticated sessions This is a localhost-only exposure (CVSS AV:L), but provides full browser-session compromise for sandboxed browser usage. Affected Versions - Introduced in: 2026.1.29-beta.1 (first npm release that shipped the sandbox browser bridge) - Affected range: =2026.1.29-beta.1 <2026.2.14 Patched Versions…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Feishu extension could fetch attacker-controlled remote URLs in two paths without SSRF protections: - sendMediaFeishu(mediaUrl) - Feishu DocX markdown image URLs (write/append - image processing) Affected versions - < 2026.2.14 Patched versions - = 2026.2.14 Impact If an attacker can influence tool calls (directly or via prompt injection), they may be able to trigger requests to internal services and re-upload the response as Feishu media. Remediation Upgrade to OpenClaw 2026.2.14 or newer. Notes The fix routes Feishu remote media fetching through hardened runtime helpers that enforce SSRF policies and size limits.
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The BlueBubbles extension accepted attacker-controlled local filesystem paths via mediaPath and could read arbitrary local files from disk before sending them as media attachments. Details When sendBlueBubblesMedia received a non-HTTP media source, the previous implementation resolved it to a local path and read it directly from disk. There was no required allowlist of safe directories, so values like /etc/passwd (or equivalent sensitive paths on other platforms) could be requested and exfiltrated. The fix hardens local media loading by requiring explicit configured roots (channels.bluebubbles.mediaLocalRoots) and by enforcing canonical-path containment checks before reading local files. Paths outside allowed roots are rejected. Fix PR: https://github.com/openclaw/openclaw/pull/16322 Fix commit: https://github.com/openclaw/openclaw/commit/71f357d9498cebb0efe016b0496d5fbe807539fc Affected Packages / Versions - Package: openclaw (npm) - Affected: < v2026.2.14 - Fixed: =…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw CLI process cleanup used system-wide process enumeration and pattern matching to terminate processes without verifying they were owned by the current OpenClaw process. On shared hosts, unrelated processes could be terminated if they matched the pattern. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.2.14 (including the latest published version 2026.2.13) - Fixed: 2026.2.14 (planned next release) Details The CLI runner cleanup helpers could kill processes matched by command-line patterns without validating process ownership. Fix Process cleanup is now scoped to owned processes only by filtering to direct child PIDs of the current process (ppid == process.pid) before sending signals. Hardening follow-ups: - Prefer graceful termination for resume cleanup (SIGTERM, then SIGKILL fallback). - Reduce false negatives from ps argv truncation by preferring wide output (ps -axww) with a fallback. - Tighten command-line token matching to avoid…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The manual Chutes OAuth login flow could accept attacker-controlled callback input in a way that bypassed OAuth CSRF state validation, potentially resulting in credential substitution. Impact If an attacker can convince a user to paste attacker-provided OAuth callback data during the manual login prompt, OpenClaw may exchange an attacker-obtained authorization code and persist tokens for the wrong Chutes account. The automatic local callback flow is not affected (it validates state in the local HTTP callback handler). Affected Packages / Versions - openclaw (npm): <= 2026.2.13 when using the manual Chutes OAuth login flow. Fix The manual flow now requires the full redirect URL (must include code and state), validates the returned state against the expected value, and rejects code-only pastes. Fix Commit(s) - a99ad11a4107ba8eac58f54a3c1a8a0cf5686f47 Thanks @aether-ai-agent for reporting.
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.