Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
OpenClaw's outbound host-media attachment read helper could enable host-local file reads based on global or agent-level read access without also honoring sender and group-scoped tool policy. In channel deployments that used toolsBySender or group policy to deny read for less-trusted senders, a denied sender could still trigger host-media attachment loading and cause readable local files to be returned through the outbound media path. Affected Versions This issue is known to affect OpenClaw 2026.4.9. Earlier versions were not confirmed during triage, so the advisory range is intentionally scoped to = 2026.4.9 < 2026.4.10. Impact Affected deployments are those that both allow host read or filesystem root expansion at the global/agent level and rely on sender or group-scoped policy to deny read for some channel participants. In that configuration, the intended sender/group authorization boundary could be bypassed for outbound media reads, potentially disclosing host-local files…
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
QQBot media tags could read arbitrary local files through reply text. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact QQBot outbound media tags in AI reply text could reference host-local paths outside the intended media storage boundary, allowing local file disclosure through outbound media handling. Technical Details The fix enforces the media storage boundary for all outbound QQBot local file paths. Fix The issue was fixed in #63271. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 604777e4414cc3b2ff8861f18f4fb04374c702c6 - PR: #63271 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @feiyang666 of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
busybox and toybox applet execution weakened exec approval binding. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.2.23 < 2026.4.12 - Patched versions: = 2026.4.12 Impact Opaque multi-call binaries such as busybox and toybox could obscure which applet or script-like behavior would actually run, weakening exec approval binding and risk classification. Technical Details The fix treats busybox and toybox as opaque mutable script runners and fails closed rather than binding unsafe applet invocations. Fix The issue was fixed in #65713. The first stable tag containing the fix is v2026.4.12, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 666f48d9b882a8a1415ca53f9567c72499d850c9 - PR: #65713 Release Process Note Users should upgrade to openclaw 2026.4.12 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @decsecre583 for reporting this issue.
Recommended action: Upgrade to 2026.4.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Matrix profile config persistence was reachable from operator.write message tools. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact Gateway operator.write message-tool paths could reach Matrix profile persistence that should have required admin-level authority. Technical Details The fix gates Matrix profile updates for non-owner message-tool runs and prevents write-scoped callers from mutating persistent profile config. Fix The issue was fixed in #62662. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - fe0f686c9228fffcec6de4011da45e69a6e23e54 - PR: #62662 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sandboxed agents could escape exec routing via host=node override. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.5 < 2026.4.10 - Patched versions: = 2026.4.10 Impact A sandboxed agent could request host: "node" and route exec to a remote node instead of the intended sandbox execution path, bypassing the sandbox routing boundary. Technical Details The fix blocks sandboxed exec escape to remote node targets and keeps routing aligned with the active sandbox policy. Fix The issue was fixed in #63880. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - dffad08529202edbf34e4808788e1182fe10f6a9 - PR: #63880 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Browser press/type interaction routes missed complete navigation guard coverage. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact Some browser press/type style interactions could trigger navigation without complete post-action SSRF policy enforcement. Technical Details The fix applies a three-phase interaction navigation guard to navigation-capable interactions, including pressKey and type submit flows. Fix The issue was fixed in #62023 and #63226 and #63889. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 049acf23cb03e1b92f5c71cd99c6ec5f35cc56fe - 5f5b3d733bdd791cb457f838514179e1288b10b3 - e0b8ddc1a55185aff1cf9e0e095014d2e4f1d894 - PR: #62023, #63226, #63889 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with…
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Browser interaction routes could pivot into local CDP and regain file reads. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.9 - Patched versions: = 2026.4.9 Impact Browser act/evaluate interactions could trigger navigation into the local CDP origin and then create or read disallowed file:// pages despite direct navigation guards. Technical Details The fix re-checks browser URLs after interaction-driven navigations and blocks targets that violate the configured navigation policy. Fix The issue was fixed in #63226. The first stable tag containing the fix is v2026.4.9, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 5f5b3d733bdd791cb457f838514179e1288b10b3 - PR: #63226 Release Process Note Users should upgrade to openclaw 2026.4.9 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @tdjackey for reporting this issue.
Recommended action: Upgrade to 2026.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Workspace provider auth choices could auto-enable untrusted provider plugins. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.9 - Patched versions: = 2026.4.9 Impact Non-interactive onboarding could select a provider auth choice shadowed by an untrusted workspace plugin, auto-enabling that plugin during auth setup. Technical Details The fix prefers trusted provider origins for auth choices and excludes untrusted workspace choices unless they are explicitly enabled. Fix The issue was fixed in #62368. The first stable tag containing the fix is v2026.4.9, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 2d97eae53e212ae26f3aebcd6a50ffc6877f770d - PR: #62368 Release Process Note Users should upgrade to openclaw 2026.4.9 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zpbrent for reporting this issue.
Recommended action: Upgrade to 2026.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Existing-session browser interaction routes bypassed SSRF policy enforcement. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact Existing-session browser interaction routes could continue interacting with or navigating targets without applying the same SSRF navigation guard used by guarded browser routes. Technical Details The fix guards existing-session navigation and interaction routes with browser navigation policy checks. Fix The issue was fixed in #64370. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - daeb74920d5ad986cb600625180037e23221e93a - PR: #64370 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Browser tabs action select and close routes bypassed SSRF policy. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact The browser /tabs/action select and close branches could operate on targets without enforcing configured browser SSRF policy, weakening tab-level navigation protections. Technical Details The fix enforces browser SSRF policy in the select and close tab-action branches. Fix The issue was fixed in #63332. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 48c0347921b7e9438af0312968fc360ca88023f3 - PR: #63332 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @tdjackey for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nostr profile mutation routes allowed operator.write config persistence. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin authority. Technical Details The fix requires operator.admin scope for Nostr profile mutation routes. Fix The issue was fixed in #63553. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 6517c700de9bb0ee11b41ab625ef3b63d01b6083 - PR: #63553 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact The sandbox browser CDP relay could bind too broadly, exposing Chrome DevTools Protocol access outside the intended local/sandbox source range. Technical Details The fix enforces CDP source-range restriction by default and avoids broad 0.0.0.0 exposure unless explicitly configured. Fix The issue was fixed in #61404. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - fbf11ebdb7110632f93926d0ac7b48f04cb44d77 - PR: #61404 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Channel setup catalog lookups could include untrusted workspace plugin shadows. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact Channel setup could resolve a workspace plugin shadow before a bundled channel plugin, causing setup-time plugin loading without the intended trust gate. Technical Details The fix routes setup catalog lookups through trusted catalog paths and uses excludeWorkspace: true where setup should not include workspace shadows. Fix The issue was fixed in the advisory fix branch. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 1fede43b948df40ca8674511d4bd08d39f6c5837 - PR: private advisory fork Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for…
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
screenrecord outPath bypassed workspace-only filesystem guard. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact The node-host screen recording tool could honor an outPath outside the workspace guard, allowing an authorized tool call to write outside the intended workspace boundary. Technical Details The fix applies the workspace-root guard to node tool outPath handling, including screen recording paths. Fix The issue was fixed in #63551. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 635bb35b68d8faa5bfa2fda35feadd315122748a - PR: #63551 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @anshumanbh for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Browser SSRF policy default allowed private-network navigation. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.14 - Patched versions: = 2026.4.14 Impact Browser SSRF protection could allow private-network navigation by default in paths where restrictive behavior was expected, exposing internal services or metadata endpoints through browser-driven requests. Technical Details The fix preserves strict SSRF configuration semantics, keeps private-network access disabled unless explicitly opted in, and updates loopback CDP readiness handling for the stricter default. Fix The issue was fixed in #66354 and #66386. The first stable tag containing the fix is v2026.4.14, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 024f4614a1a1831406e763adc40ef226e3d5e9ed - 1dabfef28db523e7de81edeb3dd689e9171236a2 - 213c36cf51121ef6c05cfccd78037371f968f31a - 7eecfa411df3d12e6b810e6ca5df47254fc3db3f - PR: #66354, #66386 Release Process Note…
Recommended action: Upgrade to 2026.4.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Browser SSRF hostname validation could be bypassed by DNS rebinding. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact Browser navigation policy could validate a hostname/IP resolution that differed from the address Chromium ultimately used, allowing DNS rebinding style SSRF pivots. Technical Details The fix tightens strict browser hostname navigation so unallowlisted hostname URLs fail closed under restrictive policy. Fix The issue was fixed in #64367. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 121c452d666d4749744dc2089287d0227aae2ed3 - PR: #64367 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.12 - Patched versions: = 2026.4.12 Impact QQBot reply media URLs could be treated as trusted media sources, allowing SSRF fetches whose returned bytes were then re-uploaded through the channel. Technical Details The fix routes QQBot remote media fetches through SSRF-guarded media fetching and explicit URL allowlist policy. Fix The issue was fixed in #63495 and #65788. The first stable tag containing the fix is v2026.4.12, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 08ae021d1f4f02e0ca5fd8a3b9659291c1ecf95a - ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d - PR: #63495, #65788 Release Process Note Users should upgrade to openclaw 2026.4.12 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @threalwinky for reporting this issue.
Recommended action: Upgrade to 2026.4.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Workspace .env could inject OpenClaw runtime-control variables. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.9 - Patched versions: = 2026.4.9 Impact A malicious workspace .env file could set OpenClaw runtime-control variables affecting update sources, gateway URLs, ClawHub resolution, browser executable paths, and related behavior. Technical Details The fix blocks OpenClaw runtime-control keys and key families from workspace .env loading. Fix The issue was fixed in #62660. The first stable tag containing the fix is v2026.4.9, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - dbfcef319618158fa40b31cdac386ea34c392c0c - PR: #62660 Release Process Note Users should upgrade to openclaw 2026.4.9 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab for reporting this issue.
Recommended action: Upgrade to 2026.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discord event cover images bypassed sandbox media normalization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.7 < 2026.4.10 - Patched versions: = 2026.4.10 Impact Discord event cover image parameters could bypass the sandbox media normalization path used for outbound local media, allowing host-local media references to reach a channel action path that expected normalized media. Technical Details The fix includes Discord eventCreate.image in sandbox media normalization and adds coverage for the event-create media path. Fix The issue was fixed in #64377. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 979c6f09d6fad96596feb91c905934be7e0b4f15 - PR: #64377 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer…
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Empty approver lists could grant explicit approval authorization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.12 - Patched versions: = 2026.4.12 Impact For helper-backed channels, an empty resolved approver list could be interpreted as explicit approval authorization, allowing a sender outside the normal channel authorization gate to resolve pending approvals if they knew an approval id. Technical Details The fix prevents empty approver lists from granting explicit approval authorization and adds regression coverage for unauthorized senders. Fix The issue was fixed in #65714. The first stable tag containing the fix is v2026.4.12, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 0a105c0900de701d2ee9f1abc96b017afbd0afdd - PR: #65714 Release Process Note Users should upgrade to openclaw 2026.4.12 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @anshumanbh for reporting this issue.
Recommended action: Upgrade to 2026.4.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Agent hook events could enqueue trusted system events from unsanitized external input. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact Agent hook dispatch could turn externally supplied hook metadata into trusted system events, allowing untrusted input to enter the agent as higher-trust context. Technical Details The fix sanitizes hook names and marks agent hook system events as untrusted before enqueueing them. Fix The issue was fixed in #64372. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - e3a845bde5b54f4f1e742d0a51ba9860f9619b29 - PR: #64372 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Exec environment denylist missed high-risk interpreter startup variables. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact The exec environment policy missed interpreter startup variables such as VIMINIT, EXINIT, LUAINIT, and HOSTALIASES, allowing operator-supplied environment overrides to influence downstream execution or network behavior. Technical Details The fix expands the host environment security policy denylist to cover these and related high-risk environment variables, with regression coverage. Fix The issue was fixed in #63277. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 2d126fc62343a7b6895351f96e4e1474bc358140 - PR: #63277 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @feiyang666 of Tencent zhuque Lab…
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Shell-wrapper detection missed env-argv assignment injection forms. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.2.22 < 2026.4.12 - Patched versions: = 2026.4.12 Impact Exec preflight handling missed shell-wrapper and argv-level environment assignment forms that could affect execution semantics, including high-risk shell environment controls. Technical Details The fix broadens shell-wrapper detection and blocks environment assignments in argv forms. High-risk shell variables such as SHELLOPTS and PS4 are covered by the host environment security policy. Fix The issue was fixed in #65717. The first stable tag containing the fix is v2026.4.12, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 8f8492d172f4c5b4fd7dd9a47855ed620c8770ab - PR: #65717 Release Process Note Users should upgrade to openclaw 2026.4.12 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @decsecre583 for reporting…
Recommended action: Upgrade to 2026.4.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Memory dreaming config persistence was reachable from operator.write commands. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.5 < 2026.4.10 - Patched versions: = 2026.4.10 Impact A write-scoped gateway path could toggle persistent memory dreaming settings through /dreaming, crossing into an admin-class configuration mutation. Technical Details The fix requires admin scope for persistent dreaming gateway toggles. Fix The issue was fixed in #63872. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 6af17b39e11f5f35e23b7e5a5f71a7d0aa3c7310 - PR: #63872 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Teams SSO invoke handler missed sender authorization checks. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.10 < 2026.4.14 - Patched versions: = 2026.4.14 Impact Microsoft Teams SSO signin invoke handling could process an invoke from a sender before applying the same sender allowlist checks used by normal message handling. Technical Details The fix routes SSO invoke handling through the Teams sender authorization path and adds coverage for denied senders. Fix The issue was fixed in #66033. The first stable tag containing the fix is v2026.4.14, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 80b1fa17bfc3f6a668492f0326ea52f48bb89776 - PR: #66033 Release Process Note Users should upgrade to openclaw 2026.4.14 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.