Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
On macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data, this created an OS command injection risk. The fix avoids invoking a shell by using execFileSync("security", argv) and passing the updated keychain payload as a literal argument. Affected Packages / Versions - Package: openclaw (npm) - Platform: macOS only - Affected versions: <= 2026.2.13 Fix - Patched version: = 2026.2.14 (next release) - Fix PR: #15924 - Fix commits (merged to main): - 9dce3d8bf83f13c067bc3c32291643d2f1f10a06 - 66d7178f2d6f9d60abad35797f97f3e61389b70c - b908388245764fb3586859f44d1dff5372b19caf Thanks @aether-ai-agent for reporting.
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw’s browser control API accepted user-supplied output paths for trace/download files without consistently constraining writes to OpenClaw-managed temporary directories. Impact If an attacker can access the browser control API, they could attempt to write trace/download output files outside intended temp roots, depending on process filesystem permissions. Affected versions openclaw < 2026.2.13 Fixed versions openclaw = 2026.2.13 Remediation Upgrade to 2026.2.13 or later. What changed The fix constrains output paths for: - POST /trace/stop - POST /wait/download - POST /download All three now enforce OpenClaw temp-root boundaries and reject traversal/escape paths. Credits Thanks to Adnan Jakati (@jackhax) of Praetorian for responsible disclosure. Fix shipped in PR #15652 and merged to main on February 13, 2026 (7f0489e4731c8d965d78d6eac4a60312e46a9426). --- Fix commit 7f0489e4731c8d965d78d6eac4a60312e46a9426 confirmed on main and in v2026.2.14. Upgrade…
Recommended action: Upgrade to 2026.2.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw browser download helpers accepted an unsanitized output path. When invoked via the browser control gateway routes, this allowed path traversal to write downloads outside the intended OpenClaw temp downloads directory. This issue is not exposed via the AI agent tool schema (no download action). Exploitation requires authenticated CLI access or an authenticated gateway RPC token. Affected Packages / Versions - Package: openclaw (npm) - Affected: =2026.1.12, <=2026.2.12 - Fixed: =2026.2.13 Details Affected code: src/browser/pw-tools-core.downloads.ts (waitForDownloadViaPlaywright, downloadViaPlaywright). Fixed entrypoints (as of 2026.2.13): - Gateway browser control routes /wait/download and /download now restrict path to DEFAULTDOWNLOADDIR via resolvePathWithinRoot. Fix Commit(s) - 7f0489e4731c8d965d78d6eac4a60312e46a9426 Mitigation Upgrade to openclaw =2026.2.13. Thanks @locus-x64 for reporting.
Recommended action: Upgrade to 2026.2.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw Gateway supports hook mappings with optional JavaScript/TypeScript transform modules. In affected versions, the gateway did not sufficiently constrain configured module paths before passing them to dynamic import(). Under some configurations, a user who can modify gateway configuration could cause the gateway process to load and execute an unintended local module. Impact Potential code execution in the OpenClaw gateway Node.js process. This requires access that can modify gateway configuration (for example via the gateway config endpoints). Treat such access as high privilege. Affected Packages / Versions - npm package: openclaw - Affected: = 2026.1.5 and <= 2026.2.13 Patched Versions - = 2026.2.14 Fix Commit(s) - a0361b8ba959e8506dc79d638b6e6a00d12887e4 (restrict hook transform module loading) - 35c0e66ed057f1a9f7ad2515fdcef516bd6584ce (harden hooks module loading) Mitigation - Upgrade to 2026.2.14 or newer. - Avoid exposing gateway configuration endpoints to…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw versions <= 2026.2.9 construct transcript file paths using an unsanitized sessionId and also accept sessionFile paths without enforcing that they stay within the agent sessions directory. A crafted sessionId and/or sessionFile (example: ../../etc/passwd) can cause path traversal when the gateway performs transcript file read/write operations. Preconditions: an attacker must be able to authenticate to the gateway (gateway token/password). By default the gateway binds to loopback (local-only); configurations that expose the gateway widen the attack surface. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.9 - Fixed: = 2026.2.12 Fix Fixed by validating session IDs (rejecting path separators / traversal sequences) and enforcing sessions-directory containment for session transcript file operations. Fix Commit(s) - 4199f9889f0c307b77096a229b9e085b8d856c26 Additional Hardening - cab0abf52ac91e12ea7a0cf04fff315cf0c94d64 Mitigation Upgrade to…
Recommended action: Upgrade to 2026.2.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Inter-session messages sent via sessionssend could be interpreted as direct end-user instructions because they were persisted as role: "user" without provenance metadata. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.12 (i.e. < 2026.2.13) - Fixed in: 2026.2.13 (patched versions = 2026.2.13) Impact A delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input. This is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in workflows that trust role: "user" as a sole authority signal. Technical details Before the fix, routed inter-session prompts were stored as regular user turns without a verifiable source marker. As a result, downstream workers and transcript readers could not distinguish: - External user input - Internal inter-session routed input Fix OpenClaw now carries explicit input provenance…
Recommended action: Upgrade to 2026.2.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Command hijacking via PATH handling Discovered: 2026-02-04 Reporter: @akhmittra Summary OpenClaw previously accepted untrusted PATH sources in limited situations. In affected versions, this could cause OpenClaw to resolve and execute an unintended binary ("command hijacking") when running host commands. This issue primarily matters when OpenClaw is relying on allowlist/safe-bin protections and expects PATH to be trustworthy. Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.2.14 - Patched: = 2026.2.14 (planned next release) What Is Required To Trigger This A) Node Host PATH override (remote command hijack) An attacker needs all of the following: - Authenticated/authorized access to an execution surface that can invoke node-host execution (for example, a compromised gateway or a caller that can issue system.run). - A node host connected and exposing system.run. - A configuration where allowlist/safe-bins are expected to restrict execution (this is not…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The optional Tlon (Urbit) extension previously accepted a user-provided base URL for authentication and used it to construct an outbound HTTP request, enabling server-side request forgery (SSRF) in affected deployments. Impact This only affects deployments that have installed and configured the Tlon (Urbit) extension, and where an attacker can influence the configured Urbit URL. Under those conditions, the gateway could be induced to make HTTP requests to attacker-chosen hosts (including internal addresses). Deployments that do not use the Tlon extension, or where untrusted users cannot change the Urbit URL, are not impacted. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.13 Fixed Versions - 2026.2.14 (planned next release) Fix Commit(s) - bfa7d21e997baa8e3437657d59b1e296815cc1b1 Details Urbit authentication now validates and normalizes the base URL and uses an SSRF guard that blocks private/internal hosts by default (opt-in:…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled. Impact This issue is limited to configurations that explicitly enable and expose the voice-call webhook endpoint. Not affected by default: - The voice-call extension is optional and disabled by default. - The bypass only applied when tunnel.allowNgrokFreeTierLoopbackBypass was explicitly enabled. - Exploitation required the webhook to be reachable (typically via a public ngrok URL during development). Worst case (when exposed and the option was enabled): - An external attacker could send forged requests to the publicly reachable webhook endpoint that would be accepted without a valid X-Twilio-Signature. - This could result in unauthorized webhook event handling (integrity) and request flooding (availability). Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <=…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
URL-backed media fetch handling allocated the entire response payload in memory (arrayBuffer) before enforcing maxBytes, allowing oversized responses to cause memory exhaustion. Affected Versions - openclaw (npm): < 2026.2.14 - clawdbot (npm): <= 2026.1.24-3 Patched Versions - openclaw (npm): 2026.2.14 Fix Commit - openclaw/openclaw main: 00a08908892d1743d1fc52e5cbd9499dd5da2fe0 Details Affected component: - src/media/input-files.ts (fetchWithGuard) When content-length is missing or incorrect, reading the body via response.arrayBuffer() buffers the full payload before a size check can run. Proof of Concept 1. Configure URL-based media input. 2. Serve a response larger than maxBytes (chunked transfer / no content-length). 3. Trigger the fetchWithGuard URL fetch path. Example local server (large response): Impact Availability loss via memory pressure from attacker-controlled remote media responses. Mitigation Until a patched release is available, disable URL-backed media inputs…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When Slack DMs are configured with dmPolicy=open, the Slack slash-command handler incorrectly treated any DM sender as command-authorized. This allowed any Slack user who could DM the bot to execute privileged slash commands via DM, bypassing intended allowlist/access-group restrictions. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.13 - Affected configuration: Slack DMs enabled with channels.slack.dm.policy: open (aka dmPolicy=open) Impact Any Slack user in the workspace who can DM the bot could invoke privileged slash commands via DM. Fix The slash-command path now computes CommandAuthorized for DMs using the same allowlist/access-group gating logic as other inbound paths. Fix commit(s): - f19eabee54c49e9a2e264b4965edf28a2f92e657 Release Process Note patchedversions is set to the planned next release (2026.2.14). Once that npm release is published, this advisory should be published. Thanks @christos-eth for reporting.
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw's exec-approvals allowlist supports a small set of "safe bins" intended to be stdin-only (no positional file arguments) when running tools.exec.host=gateway|node with security=allowlist. In affected configurations, the allowlist validation checked pre-expansion argv tokens, but execution used a real shell (sh -c) which expands globs and environment variables. This allowed safe bins like head, tail, or grep to read arbitrary local files via tokens such as or $HOME/... without triggering approvals. This issue is configuration-dependent and is not exercised by default settings (default tools.exec.host is sandbox). Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.13 - Patched: = 2026.2.14 (planned; publish the advisory after the npm release is out) Impact An authorized but untrusted caller (or prompt-injection) could cause the gateway/node process to disclose files readable by that process when host execution is enabled in allowlist mode. Fix…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Command injection in the maintainer/dev script scripts/update-clawtributors.ts. Impact Affects contributors/maintainers (or CI) who run bun scripts/update-clawtributors.ts in a source checkout that contains a malicious commit author email (e.g. crafted @users.noreply.github.com values). Normal CLI usage is not affected (npm i -g openclaw): this script is not part of the shipped CLI and is not executed during routine operation. Affected Versions - Source checkouts: tags v2026.1.8 through v2026.2.13 (inclusive) - Version range (structured): = 2026.1.8, < 2026.2.14 Details The script derived a GitHub login from git log author metadata and interpolated it into a shell command (via execSync). A malicious commit record could inject shell metacharacters and execute arbitrary commands when the script is run. Fix - Fix commit: a429380e337152746031d290432a4b93aa553d55 - Planned patched version: 2026.2.14 Credits Thanks @scanleale and @MegaManSec (https://joshua.hu) of AISLE Research…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Authenticated attackers can read arbitrary files from the Gateway host by supplying absolute paths or path traversal sequences to the browser tool's upload action. The server passed these paths to Playwright's setInputFiles() APIs without restricting them to a safe root. Severity remains High due to the impact (arbitrary local file read on the Gateway host), even though exploitation requires authenticated access. Exploitability / Preconditions This is not a "drive-by" issue. An attacker must: - Reach the Gateway HTTP surface (or otherwise invoke the same browser control hook endpoints). - Present valid Gateway auth (bearer token / password), as required by the Gateway configuration. - In common default setups, the Gateway binds to loopback and the onboarding wizard generates a gateway token even for loopback. - Have the browser tool permitted by tool policy for the target session/context (and have browser support enabled). If an operator exposes the Gateway beyond loopback…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Under iMessage groupPolicy=allowlist, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Details Affected component: src/imessage/monitor/monitor-provider.ts. Vulnerable logic derived effectiveGroupAllowFrom using both the static group allowlist and DM pairing-store identities (storeAllowFrom). This allowed a sender approved via DM pairing to satisfy group authorization in groups even if the sender/chat was not explicitly present in groupAllowFrom. This weakens boundary separation between DM pairing and group allowlist authorization. Affected Packages / Versions - openclaw (npm): affected <= 2026.2.13 - clawdbot (npm): affected <= 2026.1.24-3 Fix Commit(s) - openclaw/openclaw@872079d42fe105ece2900a1dd6ab321b92da2d59 - openclaw/openclaw@90d1e9cd71419168b2faa54a759b124a3eacfae7 Thanks @vincentkoc for reporting.
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discovery beacons (Bonjour/mDNS and DNS-SD) include TXT records such as lanHost, tailnetDns, gatewayPort, and gatewayTlsSha256. TXT records are unauthenticated. Prior to the fix, some clients treated TXT values as authoritative routing/pinning inputs: - iOS and macOS: used TXT-provided host hints (lanHost/tailnetDns) and ports (gatewayPort) to build the connection URL. - iOS and Android: allowed the discovery-provided TLS fingerprint (gatewayTlsSha256) to override a previously stored TLS pin. On a shared/untrusted LAN, an attacker could advertise a rogue openclaw-gw.tcp service. This could cause a client to connect to an attacker-controlled endpoint and/or accept an attacker certificate, potentially exfiltrating Gateway credentials (auth.token / auth.password) during connection. Distribution / Exposure The iOS and Android apps are currently alpha/not broadly shipped (no public App Store / Play Store release). Practical impact is primarily limited to developers/testers running…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.13 - Patched: 2026.2.14 Details The gateway method skills.status returned a requirements report that included configChecks[].value (the resolved value for each requires.config entry). If a skill required a broad config subtree (for example channels.discord), the report could include secrets such as Discord bot tokens. skills.status is callable with operator.read, so read-scoped clients could obtain secrets without operator.admin / config. access. Fix - Stop including raw resolved config values in requirement checks (return only { path, satisfied }). - Narrow the Discord skill requirement to the token key. Fix commit(s): - d3428053d95eefbe10ecf04f92218ffcba55ae5a - ebc68861a61067fc37f9298bded3eec9de0ba783 Mitigation Rotate any Discord tokens that may…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A mismatch between rawCommand and command[] in the node host system.run handler could cause allowlist/approval evaluation to be performed on one command while executing a different argv. Affected Configurations This only impacts deployments that: - Use the node host / companion node execution path (system.run on a node). - Enable allowlist-based exec policy (security=allowlist) with approval prompting driven by allowlist misses (for example ask=on-miss). - Allow an attacker to invoke system.run. Default/non-node configurations are not affected. Impact In affected configurations, an attacker who can invoke system.run can bypass allowlist enforcement and approval prompts by supplying an allowlisted rawCommand while providing a different command[] argv for execution. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.13 - Patched version: = 2026.2.14 (planned next release) Fix Enforce rawCommand/command[] consistency (gateway fail-fast + node…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw's SSRF protection could be bypassed using full-form IPv4-mapped IPv6 literals such as 0:0:0:0:0:ffff:7f00:1 (which is 127.0.0.1). This could allow requests that should be blocked (loopback / private network / link-local metadata) to pass the SSRF guard. - Vulnerable component: SSRF guard (src/infra/net/ssrf.ts) - Issue type: SSRF protection bypass Affected Packages / Versions - Package: openclaw (npm) - Vulnerable: <= 2026.2.13 - Patched: = 2026.2.14 (planned next release) Details The SSRF guard's IP classification did not consistently detect private IPv4 addresses when they were embedded in IPv6 using full-form IPv4-mapped IPv6 notation. As a result, inputs like 0:0:0:0:0:ffff:7f00:1 could bypass loopback/private network blocking. Fix Commit(s) - c0c0e0f9aecb913e738742f73e091f2f72d39a19 Release Process Note This advisory is kept in draft state with the patched version set to the planned next release. Once openclaw@2026.2.14 is published to npm, the only remaining…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Gateway tool accepted a tool-supplied gatewayUrl without sufficient restrictions, which could cause the OpenClaw host to attempt outbound WebSocket connections to user-specified targets. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.13 - Patched versions: = 2026.2.14 (planned) What Is Needed To Trigger This This requires the ability to invoke tools that accept gatewayUrl overrides (directly or indirectly). In typical setups this is limited to authenticated operators, trusted automation, or environments where tool calls are exposed to non-operators. In other words, this is not a drive-by issue for arbitrary internet users unless a deployment explicitly allows untrusted users to trigger these tool calls. Details Some tool call paths allowed gatewayUrl overrides to flow into the Gateway WebSocket client without validation or allowlisting. This meant the host could be instructed to attempt connections to non-gateway endpoints (for…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Feishu extension previously allowed sendMediaFeishu to treat attacker-controlled mediaUrl values as local filesystem paths and read them directly. Affected versions - < 2026.2.14 Patched versions - = 2026.2.14 Impact If an attacker can influence tool calls (directly or via prompt injection), they may be able to exfiltrate local files by supplying paths such as /etc/passwd as mediaUrl. Remediation Upgrade to OpenClaw 2026.2.14 or newer. Notes The fix removes direct local file reads from this path and routes media loading through hardened helpers that enforce local-root restrictions. --- Fix commit 5b4121d60 confirmed on main and in v2026.2.14. Upgrade to openclaw = 2026.2.14.
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links without an unattended key, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full message after the user clicked "Run". At the time of writing, the OpenClaw macOS desktop client is still in beta. An attacker could pad the message with whitespace to push a malicious payload outside the visible preview, increasing the chance a user approves a different message than the one that is actually executed. Impact If a user runs the deep link, the agent may perform actions that can lead to arbitrary command execution depending on the user's configured tool approvals/allowlists. This is a social-engineering mediated vulnerability: the confirmation prompt could be made to misrepresent the executed message. Affected Versions - OpenClaw macOS desktop client versions = 2026.2.6 and <= 2026.2.13. Fixed Versions -…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In affected versions, OpenClaw's optional @openclaw/voice-call plugin Telnyx webhook handler could accept unsigned inbound webhook requests when telnyx.publicKey was not configured, allowing unauthenticated callers to forge Telnyx events. This only impacts deployments where the Voice Call plugin is installed, enabled, and the webhook endpoint is reachable from the attacker (for example, publicly exposed via a tunnel/proxy). Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.13 - Fixed: = 2026.2.14 (planned) Details Telnyx webhooks are expected to be authenticated via Ed25519 signature verification. In affected versions, TelnyxProvider.verifyWebhook() could effectively fail open when no Telnyx public key was configured, allowing arbitrary HTTP POST requests to the voice-call webhook endpoint to be treated as legitimate Telnyx events. Fix The fix makes Telnyx webhook verification fail closed by default and requires telnyx.publicKey (or TELNYXPUBLICKEY)…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw's plugin installation path derivation could be abused by a malicious plugin package.json name to escape the intended extensions directory and write files to a parent directory. Affected Packages / Versions - Package: openclaw (npm) - Affected: = 2026.1.20, < 2026.2.1 - Fixed: = 2026.2.1 - Latest published as of 2026-02-14: 2026.2.13 (not affected) Details In affected versions, the plugin installer derives the on-disk install directory from the plugin manifest name without robust validation. Example (POSIX / macOS / Linux): - Manifest name: @malicious/.. - unscopedPackageName("@malicious/..") yields .. - The install directory becomes path.join(extensionsDir, ".."), which resolves to the parent of the extensions directory. This can cause plugin files to be written into the OpenClaw state directory (default ~/.openclaw/) rather than a subdirectory of ~/.openclaw/extensions/. Note: on Windows, affected versions also failed to sanitize backslashes (\\) in the derived…
Recommended action: Upgrade to 2026.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
What this means (plain language) If you give a client “chat/write” access to the gateway (operator.write) but you do not intend to let that client approve exec requests (operator.approvals), affected versions could still let that client approve/deny a pending exec approval by sending the /approve chat command. This is mainly relevant for shared or multi-client setups where different tokens are intentionally scoped differently. Single-operator installs are typically less impacted. Technical summary A gateway client authenticated with a device token scoped only to operator.write (without operator.approvals) could approve/deny pending exec approval requests by sending a chat message containing the built-in /approve command. exec.approval.resolve is correctly scoped to operator.approvals for direct RPC calls, but the /approve command path invoked it via an internal privileged gateway client. Affected Packages / Versions - openclaw (npm): < 2026.2.2 Fix - Fixed in openclaw…
Recommended action: Upgrade to 2026.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.