Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
NOTE: This only affects deployments that enable the optional MS Teams extension (Teams channel). If you do not use MS Teams, you are not impacted. When OpenClaw downloads inbound MS Teams attachments / inline images, it may retry a URL with an Authorization: Bearer <token header after receiving 401 or 403. Because the default download allowlist uses suffix matching (and includes some multi-tenant suffix domains), a message that references an untrusted but allowlisted host could cause that bearer token to be sent to the wrong place. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable: <= 2026.1.30 - Patched: = 2026.2.1 Fix - Fix commit: 41cc5bcd4f1d434ad1bbdfa55b56f25025ecbf6b - Upgrade to openclaw = 2026.2.1 Workarounds - If you do not need MS Teams, disable the MS Teams extension. - If you must stay on an older version, ensure the auth host allowlist is strict (only Microsoft-owned endpoints that require auth) and avoid wildcard or broad suffix entries.…
Recommended action: Upgrade to 2026.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the optional Twitch channel plugin (extensions/twitch), allowFrom is documented as a hard allowlist of Twitch user IDs, but it was not enforced as a hard gate. If allowedRoles is unset or empty, the access control path defaulted to allow, so any Twitch user who could mention the bot could reach the agent dispatch pipeline. Scope note: This only affects deployments that installed and enabled the Twitch plugin. Core OpenClaw installs that do not install/enable the Twitch plugin are not impacted. Affected Packages / Versions - Package: openclaw (npm) - Affected: = 2026.1.29, < 2026.2.1 - Fixed: = 2026.2.1 Details Affected component: Twitch plugin access control (extensions/twitch/src/access-control.ts). Problematic logic in checkTwitchAccessControl(): - When allowFrom was configured, the code returned allowed: true for members but did not return allowed: false for non-members, so execution fell through. - If allowedRoles was unset or empty, the function returned allowed: true…
Recommended action: Upgrade to 2026.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An authentication bypass in the optional voice-call extension/plugin allowed unapproved or anonymous callers to reach the voice-call agent when inbound policy was set to allowlist or pairing. Deployments that do not install/enable the voice-call extension are not affected. Affected Packages / Versions - openclaw (npm): <= 2026.2.1 - Fixed in: = 2026.2.2 Details In affected versions (for example 2026.2.1), the inbound allowlist check in extensions/voice-call/src/manager.ts used suffix-based matching and accepted empty caller IDs after normalization. This allowed two bypasses: 1. Missing/empty from values normalized to an empty string, which caused the allowlist predicate to evaluate as allowed. 2. Suffix-based matching meant any caller number whose digits ended with an allowlisted number would be accepted. Proof Of Concept 1. Configure the voice-call extension with inboundPolicy: allowlist and allowFrom: ["+15550001234"]. 2. Place/trigger an inbound call with missing/empty…
Recommended action: Upgrade to 2026.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When Telegram webhook mode is enabled without a configured webhook secret, OpenClaw may accept unauthenticated HTTP POST requests at the Telegram webhook endpoint and trust attacker-controlled update JSON. This can allow forged Telegram updates that spoof message.from.id / chat.id, potentially bypassing sender allowlists and executing privileged bot commands. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.1.30 - Patched: = 2026.2.1 Impact An attacker who can reach the webhook endpoint can forge Telegram updates and impersonate allowlisted/paired senders by spoofing fields in the webhook payload (for example message.from.id). Impact depends on enabled commands/tools and the deployment’s network exposure. Mitigations / Workarounds - Configure a strong channels.telegram.webhookSecret and ensure your reverse proxy forwards the X-Telegram-Bot-Api-Secret-Token header unchanged. Fix Commit(s) - ca92597e1f9593236ad86810b66633144b69314d (config validation:…
Recommended action: Upgrade to 2026.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw Matrix DM allowlist matching could be bypassed in certain configurations. Matrix support ships as an optional plugin (not bundled with the core install), so this only affects deployments that have installed and enabled the Matrix plugin. Affected Packages / Versions - Package: openclaw (npm) - Affected: = 2026.1.14-1, < 2026.2.2 - Patched: = 2026.2.2 Details In affected versions, DM allowlist decisions could be made by exact-matching channels.matrix.dm.allowFrom entries against multiple sender-derived candidates, including: - The sender display name (attacker-controlled and non-unique) - The sender MXID localpart with the homeserver discarded, so @alice:evil.example and @alice:trusted.example both match alice If an operator configured channels.matrix.dm.allowFrom with display names or bare localparts (for example, "Alice" or "alice"), a remote Matrix user may be able to impersonate an allowed identity for allowlist purposes and reach the routing/agent pipeline.…
Recommended action: Upgrade to 2026.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In affected versions, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (127.0.0.1, ::1, ::ffff:127.0.0.1) even when the configured webhook secret was missing or incorrect. This does not affect the default iMessage integration unless BlueBubbles is installed and enabled. Affected Packages / Versions - npm: openclaw < 2026.2.13 - npm: @openclaw/bluebubbles < 2026.2.13 Details If a deployment exposes the BlueBubbles webhook endpoint through a same-host reverse proxy (or an attacker can reach loopback via SSRF), an unauthenticated party may be able to inject inbound webhook events into the agent pipeline. Fix Commit(s) - f836c385ffc746cb954e8ee409f99d079bfdcd2f - 743f4b28495cdeb0d5bf76f6ebf4af01f6a02e5a (defense-in-depth) Mitigations - Set a non-empty BlueBubbles webhook password. - Avoid deployments where a public-facing reverse proxy forwards to a loopback-bound Gateway without…
Recommended action: Upgrade to 2026.2.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw versions prior to 2026.2.13, OpenClaw logged certain WebSocket request headers (including Origin and User-Agent) without neutralization or length limits on the "closed before connect" path. If an unauthenticated client can reach the gateway and send crafted header values, those values may be written into core logs. Under workflows where logs are later read or interpreted by an LLM (for example via AI-assisted debugging), this can increase the risk of indirect prompt injection (log poisoning). Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.12 - Fixed: = 2026.2.13 Details - Component: src/gateway/server/ws-connection.ts - Trigger: WebSocket connection closes before completing the connect/handshake; header values are included in the log message and structured context. Impact This issue is primarily an indirect prompt injection risk and depends on downstream log consumption behavior. If you do not feed logs into an LLM or other…
Recommended action: Upgrade to 2026.2.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The OpenClaw Nostr channel plugin (optional, disabled by default, installed separately) exposes profile management HTTP endpoints under /api/channels/nostr/:accountId/profile (GET/PUT) and /api/channels/nostr/:accountId/profile/import (POST). In affected versions, these routes were dispatched via the gateway plugin HTTP layer without requiring gateway authentication, allowing unauthenticated remote callers to read or mutate the Nostr profile and persist changes to the gateway config. Profile updates are also published as a signed Nostr kind:0 event using the bot's private key. Deployments that do not have the Nostr plugin installed and enabled are not impacted. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.9 - Fixed versions: = 2026.2.12 - Scope note: only affects deployments with the optional @openclaw/nostr plugin installed and enabled Details This is exploitable when the gateway HTTP port is reachable beyond localhost (for example:…
Recommended action: Upgrade to 2026.2.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of the openclaw npm package prior to 2026.2.2 could be coerced into fetching arbitrary http(s) URLs during attachment/media hydration. An attacker who can influence the media URL (for example via model-controlled sendAttachment or auto-reply media URLs) could trigger SSRF to internal resources and exfiltrate the fetched bytes as an outbound attachment. Plain-English Explanation OpenClaw can send files by downloading them first. On vulnerable versions (< 2026.2.2), if an attacker could get OpenClaw to treat a URL as the “file to attach”, OpenClaw would download that URL from the gateway machine and then send the downloaded bytes back out as an attachment. That matters because the gateway can often reach internal-only endpoints that an attacker cannot (for example 127.0.0.1 services, private RFC1918 addresses, or cloud metadata endpoints). This is a data-leak risk. This does not directly grant code execution or shell access; it is about making the gateway perform HTTP…
Recommended action: Upgrade to 2026.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Telegram webhook mode, if channels.telegram.webhookSecret is not set, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. In deployments where the webhook endpoint is reachable by an attacker, this can allow forged Telegram updates (for example spoofing message.from.id). Note: Telegram webhook mode is not enabled by default. It is enabled only when channels.telegram.webhookUrl is configured. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.1.30 - Patched: = 2026.2.1 Impact If an attacker can reach the webhook endpoint, they may be able to send forged updates that are processed as if they came from Telegram. Depending on enabled commands/tools and configuration, this could lead to unintended bot actions. Mitigations / Workarounds - Set a strong channels.telegram.webhookSecret and ensure your reverse proxy forwards the X-Telegram-Bot-Api-Secret-Token header unchanged. - Restrict network access to the webhook…
Recommended action: Upgrade to 2026.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When the Slack integration is enabled, Slack channel metadata (topic/description) could be incorporated into the model's system prompt. Impact Prompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This is relevant only for deployments that enable Slack. In deployments where tool execution is enabled, a successful injection could lead to unintended tool invocations and/or unintended data exposure. Affected Packages / Versions - npm: openclaw < 2026.2.3 Patched Versions - npm: openclaw = 2026.2.3 Mitigation - If you do not use Slack: no action required. - If you use Slack: upgrade to a patched version. Fix Commit(s) - 35eb40a7000b59085e9c638a80fd03917c7a095e Thanks @KonstantinMirin for reporting.
Recommended action: Upgrade to 2026.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The BlueBubbles webhook handler previously treated any request whose socket remoteAddress was loopback (127.0.0.1, ::1, ::ffff:127.0.0.1) as authenticated. When OpenClaw Gateway is behind a reverse proxy (Tailscale Serve/Funnel, nginx, Cloudflare Tunnel, ngrok), the proxy typically connects to the gateway over loopback, allowing unauthenticated remote requests to bypass the configured webhook password. This could allow an attacker who can reach the proxy endpoint to inject arbitrary inbound BlueBubbles message/reaction events. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.2.12 - Patched versions: = 2026.2.12 Exposure / Configuration - BlueBubbles is an optional channel plugin (intended to eventually replace the legacy iMessage plugin, which is also optional). It is not enabled by default and is not part of a standard OpenClaw configuration. - Only deployments with the BlueBubbles webhook endpoint exposed through a reverse proxy are…
Recommended action: Upgrade to 2026.2.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A server-side request forgery (SSRF) vulnerability in the Image tool allowed attackers to force OpenClaw to make HTTP requests to arbitrary internal or restricted network targets. Affected Versions - npm: openclaw <= 2026.2.1 Patched Versions - npm: openclaw 2026.2.2 and later Fix Commits - 81c68f582d4a9a20d9cca9f367d2da9edc5a65ae (guard remote media fetches with SSRF checks) - 9bd64c8a1f91dda602afc1d5246a2ff2be164647 (expand SSRF guard coverage) Details The Image tool accepts file paths, file:// URLs, data: URLs, and http(s) URLs. In vulnerable versions, http(s) URLs were fetched without SSRF protections, enabling requests to localhost, RFC1918, link-local, and cloud metadata targets. This was fixed by routing remote media fetching through the SSRF guard (private/internal IP + hostname blocking, redirect hardening, DNS pinning). Exploitability Notes - Requires attacker-controlled invocation of the Image tool (direct tool access, or a gateway/channel surface that forwards…
Recommended action: Upgrade to 2026.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Chrome extension relay (ensureChromeExtensionRelayServer) previously treated wildcard hosts (0.0.0.0 / ::) as loopback, which could make it bind the relay HTTP/WS server to all interfaces when a wildcard cdpUrl was passed. Impact If configured with a wildcard cdpUrl, relay HTTP endpoints could become reachable off-host, leaking service presence/port and enabling DoS/brute-force traffic against the relay token header. Affected Packages / Versions - Package: openclaw (npm) - Affected: = 2026.1.14-1 < 2026.2.12 Fixed Versions - Patched: = 2026.2.12 (released 2026-02-13) Fix Commit(s) - 8d75a496bf5aaab1755c56cf48502d967c75a1d0 Notes - Earlier hardening for /json auth and /cdp token checks landed in: - a1e89afcc19efd641c02b24d66d689f181ae2b5c Thanks @qi-scape for reporting.
Recommended action: Upgrade to 2026.2.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Exec approvals allowlist bypass via command substitution/backticks inside double quotes. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.1 - Fixed: = 2026.2.2 Impact Only affects setups that explicitly enable the optional exec approvals allowlist feature. Default installs are unaffected. Fix Reject unescaped $() and backticks inside double quotes during allowlist analysis. Fix Commit(s) - d1ecb46076145deb188abcba8f0699709ea17198 Thanks @simecek for reporting.
Recommended action: Upgrade to 2026.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On Windows nodes, exec requests were executed via cmd.exe /d /s /c <rawCommand. In allowlist/approval-gated mode, the allowlist analysis did not model Windows cmd.exe parsing and metacharacter behavior. A crafted command string could cause cmd.exe to interpret additional operations (for example command chaining via &, or expansion via %...% / !...!) beyond what was allowlisted/approved. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.1 - Patched: = 2026.2.2 - Latest (npm) as of 2026-02-14: 2026.2.13 Details - Default installs: Not affected unless you opt into exec allowlist/approval gating on Windows nodes. - Windows execution uses cmd.exe via src/infra/node-shell.ts. - The fix hardens Windows allowlist enforcement by: - Passing the platform into allowlist analysis and rejecting Windows shell metacharacters. - Treating cmd.exe invocation as not allowlist-safe on Windows. - Avoiding cmd.exe entirely in allowlist mode by executing the parsed argv…
Recommended action: Upgrade to 2026.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenClaw versions prior to 2026.2.12, the gateway accepted an untrusted sessionFile path when resolving the session transcript file. This could allow an authenticated gateway client to create and append OpenClaw session transcript records at an arbitrary path on the gateway host. Affected Versions - Affected: openclaw < 2026.2.12 - Patched: openclaw = 2026.2.12 (recommended: = 2026.2.13) Impact An authenticated gateway client could influence where the gateway writes transcript data by supplying sessionFile outside of the sessions directory. Depending on deployment and filesystem permissions, this may enable arbitrary file creation and repeated appends, leading to configuration corruption and/or denial of service. This issue does not, by itself, provide a proven remote code execution path. Fix The transcript path is now constrained to the sessions directory via resolveSessionFilePath(...) containment checks. Fix commits: - 4199f9889f0c307b77096a229b9e085b8d856c26 - (compat)…
Recommended action: Upgrade to 2026.2.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The issue is not deterministic session keys by itself. The exploitable path was accepting externally supplied sessionKey values on authenticated hook ingress, allowing a hook token holder to route messages into chosen sessions. Affected Behavior - POST /hooks/agent accepted payload sessionKey and used it directly for session routing. - Common session-key shapes (for example agent:main:dm:<peerId) were often derivable from known metadata, making targeted routing practical when request-level override was enabled. Attack Preconditions - Attacker can call hook endpoints with a valid hook token. - Hook ingress allows request-selected sessionKey values. - Target session keys can be derived or guessed. Without those preconditions, deterministic key formats alone do not provide access. Impact - Integrity: targeted message/prompt injection into chosen sessions. - Persistence: poisoned context can affect subsequent turns when the same session key is reused. - Confidentiality impact is…
Recommended action: Upgrade to 2026.2.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The gateway WebSocket connect handshake could allow skipping device identity checks when auth.token was present but not yet validated. Details In src/gateway/server/ws-connection/message-handler.ts, the device-identity requirement could be bypassed based on the presence of a non-empty connectParams.auth.token rather than a validated shared-secret authentication result. Impact In deployments where the gateway WebSocket is reachable and connections can be authorized via Tailscale without validating the shared secret, a client could connect without providing device identity/pairing. Depending on version and configuration, this could result in operator access. Deployment Guidance Per OpenClaw security guidance, the gateway should only be reachable from a trusted network and by trusted users (for example, restrict Tailnet users/ACLs when using Tailscale Serve). If the gateway WebSocket is only reachable by trusted users, there is typically no untrusted party with network access to…
Recommended action: Upgrade to 2026.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. Impact A local process on the same machine could execute arbitrary commands as the gateway process user. Details - config.apply accepted raw JSON and wrote it to disk after schema validation. - cliPath values were not constrained to safe executable names/paths. - Command discovery used a shell invocation when resolving executables. Mitigation Upgrade to a patched release. If projects cannot upgrade immediately, set gateway.auth and avoid custom cliPath values.
Recommended action: Upgrade to 2026.1.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. Details Location: src/media/parse.ts:17-27 The path validation accepts dangerous patterns: No validation ensures the path is within a safe directory or is actually a media file. PoC Agent outputs any of: The file contents are rendered/sent to the requesting user or channel. Impact - Read ANY file accessible to the agent user - Exfiltrate SSH keys (~/.ssh/idrsa) - Steal cloud credentials (~/.aws/credentials) - Access API keys (.env, config.json) - Read system files (/etc/passwd, /etc/shadow) Note: PR #4930 contains a fix but is NOT MERGED - production is vulnerable.
Recommended action: Upgrade to 2026.1.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.