Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Exec allowlist analysis rejects shell expansion in unquoted heredocs Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.21 - Fixed version: 2026.4.22 Impact An allowlisted command containing an unquoted heredoc could hide shell expansion in the heredoc body. That could make the approved command text look safer than what the shell would evaluate at runtime. Fix The exec command analyzer now tracks heredoc bodies, rejects unquoted heredoc expansion tokens and continuation-splice bypasses, and preserves quoted heredocs and literal safe text. Fix Commit(s) - b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5 Verification - The fix commit is contained in the public v2026.4.22 tag. - openclaw@2026.4.22 is published on npm and the compiled package contains the fix. - Focused regression coverage for this path passed before publication. Thanks @VladimirEliTokarev for reporting.
Recommended action: Upgrade to 2026.4.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
MCP loopback owner context is derived from server-issued bearer tokens. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.21 - Fixed version: 2026.4.22 Impact The loopback MCP path accepted spoofable owner-context metadata from request headers, which could allow a non-owner loopback client to present itself as owner for owner-gated operations. Fix The MCP loopback runtime now issues separate owner and non-owner bearer tokens and derives senderIsOwner exclusively from which token authenticated the request. The spoofable sender-owner header is no longer emitted or trusted. Fix Commit(s) - 3cb1a56bfc9579a0f2336f9cfa12a8a744332a19 Verification - The fix commit is contained in the public v2026.4.22 tag. - openclaw@2026.4.22 is published on npm and the compiled package contains the fix. - Focused regression coverage for this path passed before publication. OpenClaw thanks @VladimirEliTokarev for reporting.
Recommended action: Upgrade to 2026.4.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Workspace dotenv files cannot override connector endpoint hosts. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.21 - Fixed version: 2026.4.22 Impact A workspace .env file could set connector endpoint variables for Matrix, Mattermost, IRC, or Synology-related connectors and redirect runtime traffic away from the operator-configured endpoint. Fix Workspace .env loading now blocks those endpoint variables, including per-account Matrix homeserver suffixes and generic base-url/API-host style overrides. Trusted global runtime dotenv loading remains separate. Fix Commit(s) - 0623079e98abf7202591f1b04a89755eb7ec9272 Verification - The fix commit is contained in the public v2026.4.22 tag. - openclaw@2026.4.22 is published on npm and the compiled package contains the fix. - Focused regression coverage for this path passed before publication. OpenClaw thanks @qi-scape for reporting.
Recommended action: Upgrade to 2026.4.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ACP child sessions inherit subagent security envelope constraints. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.21 - Fixed version: 2026.4.22 Impact A restricted subagent spawning an ACP child session could fail to carry forward subagent-only constraints such as depth, child-count limits, control scope, or target-agent restrictions. Fix ACP spawn now resolves and persists child subagent envelope fields, enforces maximum depth and active-child caps, and applies the inherited control scope to child ACP sessions. Fix Commit(s) - 31160dc069b7cc5d833b39c53736a41ad3befda2 Verification - The fix commit is contained in the public v2026.4.22 tag. - openclaw@2026.4.22 is published on npm and the compiled package contains the fix. - Focused regression coverage for this path passed before publication. OpenClaw thanks @zsxsoft, @qclawer, and @KeenSecurityLab for reporting.
Recommended action: Upgrade to 2026.4.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Zalo outbound photo URLs are validated through the SSRF guard. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.21 - Fixed version: 2026.4.22 Impact The Zalo plugin could forward an attacker-controlled outbound photo URL to the Zalo Bot API without first applying OpenClaw's SSRF validation policy. Fix Zalo sendPhoto now parses and validates outbound photo URLs with the shared SSRF hostname policy before posting to Zalo, and media-reply paths route through the guarded outbound media helpers. Fix Commit(s) - a65eb1b864b7630c1242a82de9e5799b80583c3f Verification - The fix commit is contained in the public v2026.4.22 tag. - openclaw@2026.4.22 is published on npm and the compiled package contains the fix. - Focused regression coverage for this path passed before publication. OpenClaw thanks @foodlook for reporting.
Recommended action: Upgrade to 2026.4.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Before OpenClaw 2026.4.2, Slack thread starter and thread-history context fetched through the API was not filtered by the effective sender allowlist. Messages from non-allowlisted senders could still enter the agent context when an allowlisted user replied in the same thread. Impact A Slack deployment that relied on sender allowlists could still feed non-allowlisted thread content into the model context through thread history. This was a sender-access-control bypass on Slack thread context, not a direct channel-auth bypass. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.1 - Patched versions: = 2026.4.2 - Latest published npm version: 2026.4.1 Fix Commit(s) - ac5bc4fb37becc64a2ec314864cca1565e921f2d — filter Slack thread context by the effective allowlist Release Process Note The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live. OpenClaw thanks @AntAISecurityLab for…
Recommended action: Upgrade to 2026.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact OpenClaw deployments before 2026.4.15 could embed host-local audio files into webchat responses without applying the local media root containment check used by other media-serving paths. If an attacker could influence an agent or tool-produced ReplyPayload.mediaUrl, the webchat audio embedding helper could resolve an absolute local path or file: URL, read an audio-like file under the size cap, and base64-encode it into the webchat media response. This crossed the model/tool-output boundary into a host file read. Prompt injection or malicious tool output is a delivery mechanism; the security boundary failure is the missing local-root containment check. The impact is narrow: the file had to be readable by the gateway process, have an audio-like extension, and fit within the webchat audio size cap. The issue exposed contents into the webchat assistant/media transcript path; it was not a general remote filesystem API. Affected Packages / Versions - Package: openclaw on npm -…
Recommended action: Upgrade to 2026.4.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact OpenClaw deployments before 2026.4.21 could treat a non-owner sender as authorized for owner-enforced slash commands when all of the following were true: - a channel plugin declared commands.enforceOwnerForCommands: true; - the channel accepted wildcard inbound senders with allowFrom: [""]; - no explicit commands.ownerAllowFrom was configured. In that state, src/auto-reply/command-auth.ts reused the channel inbound wildcard as part of the command-owner decision. A sender who was not the owner could therefore pass the owner-command gate for commands such as /send, /config, or /debug on the affected channel. The issue is limited to the command-owner authorization axis. It does not by itself grant owner-only tool access, host/sandbox access, or gateway administrator scope. Affected Packages / Versions - Package: openclaw on npm - Affected versions: <= 2026.4.20 - Patched version: 2026.4.21 The latest public release, 2026.4.21, contains the fix. Patches The fix requires a concrete…
Recommended action: Upgrade to 2026.4.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact The agent-facing gateway config.patch / config.apply guard did not cover several operator-trusted settings, including sandbox policy, plugin enablement, gateway auth/TLS, hook routing, MCP server configuration, SSRF policy, and filesystem hardening. A prompt-injected model with access to the owner-only gateway tool could persist changes to those settings. This is a model-to-operator guard bypass, not a remote unauthenticated gateway compromise. Severity is medium. Fix OpenClaw now blocks model-driven gateway config mutations for the broader operator-trusted path set and covers per-agent overrides and array-entry patching. Fix commit: - fe30b31a97a917ecc6e92f6c85378b6b20352422 Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact Bundled MCP and LSP tools could be appended to the agent's effective tool set after the normal tool-policy pipeline had already filtered core tools. If an operator configured a restrictive policy, such as a tool profile, explicit allow/deny list, owner-only tool restriction, sandbox tool policy, or subagent tool policy, a bundled MCP/LSP tool could remain available even though the same policy would have denied it. The issue required a configured bundled MCP or LSP tool source and an operator policy that should have restricted that tool. This was a local agent policy-enforcement bypass, not an unauthenticated remote gateway compromise. Severity is medium. Fix OpenClaw now applies a final effective tool policy pass to bundled MCP/LSP tools before merging them into the tool set used by normal runs and compaction. The pass covers profile policy, provider profile…
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: = 2026.4.5, < 2026.4.20 - Patched version: 2026.4.20 Impact A malicious workspace .env could set MINIMAXAPIHOST and redirect credentialed MiniMax requests to an attacker-controlled origin, exposing the MiniMax API key in the outbound Authorization header. This requires running OpenClaw from an attacker-controlled workspace. Severity is medium. Fix OpenClaw now blocks MINIMAXAPIHOST from workspace dotenv injection and removes env-driven URL routing from the affected MiniMax request path. Fix commit: - 2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1 Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact Browser profile creation normalized cdpUrl values before persisting them, but did not apply the configured browser SSRF policy at creation time. In deployments that explicitly disabled private-network CDP targets, a stored profile could still point at a private-network or metadata endpoint and later be probed by normal profile status flows. Default trusted-operator browser behavior allows private-network CDP endpoints, so this only affected strict-mode deployments. Severity is low. Fix OpenClaw now checks CDP endpoints against the browser SSRF policy during profile creation and reachability operations. Fix commits: - 1fd049e3074cac72f6734a7fe88468c84f5f8bd7 - e90c89cf8b1459f2aa1f3a665be67392b6c03fdf Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact A paired device session with limited pairing scope could enumerate global pairing state and act on pairing requests that belonged to another device within the same gateway scope ceiling. This is a same-gateway paired-device authorization bug, not a remote unauthenticated issue. Severity is low. Fix Pairing management actions are now limited to the caller device, so non-admin paired-device sessions cannot approve or operate on unrelated pending device requests. Fix commit: - 5a12f30441d5b0b151f550daa2c5c9e8db61e2e6 Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact The QQBot direct-upload media path could forward attacker-controlled image URLs without applying the SSRF validation used by the local download path. This could make configured QQBot media delivery request or relay URLs the operator did not intend to allow. The affected path is limited to QQBot outbound media handling and does not expose arbitrary local files. Severity is low. Fix OpenClaw now validates QQBot direct-upload media URLs before uploadC2CMedia and uploadGroupMedia direct-upload calls. Fix commit: - 49db424c8001f2f419aad85f434894d8d85c1a09 Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact Workspace MCP stdio configuration could pass dangerous process-startup environment variables such as NODEOPTIONS, LDPRELOAD, or BASHENV to the spawned MCP server process. In a malicious workspace, this could make the MCP child load attacker-controlled code when the operator starts a session that uses that MCP server. The impact is limited to local/workspace trust boundaries and requires the operator to run OpenClaw in a workspace containing the malicious MCP configuration. Severity is therefore medium, not high/critical. Fix OpenClaw now filters MCP stdio environment entries through the host environment safety denylist before spawning stdio MCP servers. Fix commits: - 62fa5071896e95edc7f67d1cebc70a2859e283af - 85d86ebc4bf3d2226d39d132a484f4f7a299fa1b Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact Output from webhook-triggered isolated cron agent runs could be queued into the main session awareness stream without trusted: false. That made the event render as a trusted System: event instead of an untrusted system event. This is a trust-labeling issue that can strengthen prompt-injection impact, but it does not directly bypass gateway auth, tool policy, or sandboxing. Severity is low. Fix OpenClaw now preserves untrusted labels for isolated cron awareness events and forwards the trust flag through cron delivery helpers. Fix commit: - f61896b03cc7031f51106a04566831f4ac2a0bd7 Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact Workspace .env loading did not reserve the OPENCLAW runtime-control namespace broadly enough. A malicious workspace could set variables such as OPENCLAWGITDIR before source-update or installer flows, potentially steering trusted OpenClaw runtime behavior. This requires running OpenClaw from an attacker-controlled workspace. Severity is medium. Fix OpenClaw now reserves the workspace OPENCLAW environment namespace and rejects workspace dotenv entries for OpenClaw runtime-control variables. Fix commit: - 018494fa3ebb9145112e68b56fe1cb2e9f9a9ed6 Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact Feishu card-action callbacks could synthesize a message event with DM conversations classified as group conversations. That skipped dmPolicy enforcement for card actions, so a sender in a Feishu DM could trigger card-action flows that should have been blocked by a restrictive DM policy. The issue is limited to Feishu card-action handling. Severity is medium. Fix OpenClaw now resolves Feishu card-action chat type before dispatch, including API lookup when stored context is unavailable, and avoids falling through to group handling for DMs. Fix commit: - 90979d7c3ef7ec30b9f8aa6963a5e38d2f17d166 Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact The Control UI assistant-media route authenticated trusted-proxy callers but did not enforce the declared operator scopes for identity-bearing HTTP auth paths. A trusted-proxy caller without operator.read could access assistant-media files and metadata that were otherwise inside allowed media roots. The route still required successful gateway authentication and media-root checks. Severity is low. Fix Assistant-media file and metadata requests now require operator.read on identity-bearing HTTP auth paths. Fix commit: - 99ef3a63c58440d53f8e45ad861b846032fcb036 Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Packages / Versions - Package: openclaw (npm) - Affected versions: < 2026.4.20 - Patched version: 2026.4.20 Impact Templated hook mapping sessionKey values were treated differently from request-supplied session keys. A hook mapping could render an externally influenced session key even when hooks.allowRequestSessionKey was disabled, bypassing the intended routing opt-in for hook callers. This affects webhook routing isolation. It does not grant host execution by itself. Severity is medium. Fix Template-rendered mapping session keys are now treated as externally supplied routing input and require hooks.allowRequestSessionKey=true plus the existing prefix policy checks. Fix commit: - 5275d008ed33203dba3f98e969ad683a65c416c3 Release Fixed in OpenClaw 2026.4.20.
Recommended action: Upgrade to 2026.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The QMD backend memoryget read path accepted arbitrary workspace Markdown paths that were inside the workspace but outside the canonical memory locations or indexed QMD result set. Impact When the QMD backend was enabled, a caller with access to memoryget could read arbitrary .md files under the configured workspace root, even when those files were not canonical memory files and had not been returned by QMD search. Severity remains low because exploitation requires access to the memory tool surface and is limited to workspace Markdown files, but it bypassed the intended memory-path policy. Affected versions - Affected: < 2026.4.15 - Patched: 2026.4.15 Fix OpenClaw 2026.4.15 restricts QMD reads to canonical memory paths or previously indexed QMD workspace paths. Workspace containment alone is no longer sufficient. Verified in v2026.4.15: - extensions/memory-core/src/memory/qmd-manager.ts rejects non-default workspace Markdown paths unless they match an indexed QMD workspace…
Recommended action: Upgrade to 2026.4.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Webchat tool-result media normalization could pass local and UNC-style file paths into the host-side media embedding path without applying the configured local-root containment policy. Impact A crafted tool-result media reference could cause the host to attempt local file reads or Windows UNC/network path access while preparing webchat media blocks. This could disclose allowed host files or trigger network credential exposure on affected Windows deployments. Severity remains medium because exploitation depends on a tool-result media path reaching the webchat embedding path, but the sink is a host-side file read before the user sees the rendered result. Affected versions - Affected: = 2026.4.7, < 2026.4.15 - Patched: 2026.4.15 Fix OpenClaw 2026.4.15 hardens the webchat media path and the shared media resolver. Remote-host file:// URLs and Windows network paths are rejected before filesystem access, and audio embedding now enforces configured localRoots containment before stat…
Recommended action: Upgrade to 2026.4.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Feishu webhook mode accepted missing encryptKey configuration as valid and blank card-action callback tokens as usable lifecycle tokens. Together, those fail-open paths could allow unauthenticated webhook or card-action traffic to reach command dispatch in affected deployments. Impact A deployment using Feishu webhook mode without a configured encryptKey, or handling malformed card-action callbacks with blank callback tokens, could fail open instead of rejecting the request. Severity remains critical because affected webhook deployments expose a network-triggered path into OpenClaw command handling without the expected Feishu signature or replay protection. Affected versions - Affected: < 2026.4.15 - Patched: 2026.4.15 Fix OpenClaw 2026.4.15 makes Feishu webhook and card-action validation fail closed. Webhook mode now refuses to start without an encryptKey, missing signing configuration returns invalid instead of valid, invalid signatures return 401, and blank card-action…
Recommended action: Upgrade to 2026.4.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gateway HTTP and WebSocket handlers captured the resolved bearer-auth configuration when the server started. After a SecretRef rotation, the already-running gateway could continue accepting the old bearer token until restart. Impact A bearer token that should have been revoked by SecretRef rotation could remain valid on the gateway HTTP and upgrade surfaces for the lifetime of the process. Severity remains high because the old token could continue to authorize gateway requests after operators believed it was rotated out. Affected versions - Affected: < 2026.4.15 - Patched: 2026.4.15 Fix OpenClaw 2026.4.15 resolves active gateway auth from the runtime secret snapshot per request and per upgrade instead of using a stale startup-time value. Verified in v2026.4.15: - src/gateway/server.impl.ts exposes getResolvedAuth() backed by the current runtime secret snapshot. - src/gateway/server-http.ts calls getResolvedAuth() for each HTTP request and WebSocket upgrade before running auth…
Recommended action: Upgrade to 2026.4.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CDP /json/version WebSocket URL could pivot to untrusted second-hop targets. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.5 - Patched versions: = 2026.4.5 Impact A browser profile could trust a CDP /json/version response whose webSocketDebuggerUrl pointed at a different host, enabling a second-hop SSRF-style pivot. Technical Details The fix normalizes and re-validates direct CDP WebSocket targets before connecting. Fix The issue was fixed in #60469. The first stable tag containing the fix is v2026.4.5, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - bc356cc8c2beaa747c71dd86cceab8f804699665 - PR: #60469 Release Process Note Users should upgrade to openclaw 2026.4.5 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @tdjackey for reporting this issue.
Recommended action: Upgrade to 2026.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.