Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Delivery queue recovery could lose group tool-policy context for media replay. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.10 < 2026.4.14 - Patched versions: = 2026.4.14 Impact Recovered queued outbound media could be replayed without the original session context needed to enforce group tool policy, weakening channel media restrictions after restart/recovery. Technical Details The fix persists and replays the relevant session context with delivery queue entries so recovered media dispatch goes through the same policy checks. Fix The issue was fixed in #66025. The first stable tag containing the fix is v2026.4.14, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 48aae82bbc19ba8b0741e61a08063eb0d1df464e - PR: #66025 Release Process Note Users should upgrade to openclaw 2026.4.14 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and…
Recommended action: Upgrade to 2026.4.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heartbeat owner downgrade missed local async exec completion events. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.3.31 < 2026.4.10 - Patched versions: = 2026.4.10 Impact Local background exec completion text could be missed by heartbeat owner-downgrade detection, leaving a run in a more privileged context than intended after untrusted completion content. Technical Details The fix expands exec-completion detection to local background exec formats and adds targeted tests. Fix The issue was fixed in #64376. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 19a2e9ddb5a8a494abcba812bb11f51075026a27 - PR: #64376 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Voice-call realtime WebSocket accepted oversized frames. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.9 < 2026.4.10 - Patched versions: = 2026.4.10 Impact The voice-call realtime WebSocket path could accept oversized frames, creating a remote availability risk for deployments exposing that webhook path. Technical Details The fix rejects oversized realtime WebSocket frames before processing them. Fix The issue was fixed in #63890. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - afadb7dae6738819ad9c7d2597ace0516957d20e - PR: #63890 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Reporters Thanks to G0odUser from ADLab of VenusTech Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heartbeat owner downgrade missed untrusted webhook wake events. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.7 < 2026.4.14 - Patched versions: = 2026.4.14 Impact Heartbeat owner downgrade logic could skip webhook wake events carrying untrusted content, preserving owner-like execution context where the run should have been downgraded. Technical Details The fix includes wake and hook event reasons in owner-downgrade inspection and forces downgrade for untrusted hook wake events. Fix The issue was fixed in #66031. The first stable tag containing the fix is v2026.4.14, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 31281bc92f55796817a92bc43f722cba1e77ab42 - PR: #66031 Release Process Note Users should upgrade to openclaw 2026.4.14 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Browser snapshot and screenshot routes could expose internal page content after navigation. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.14 - Patched versions: = 2026.4.14 Impact Authenticated browser tool callers could use snapshot, screenshot, or tab routes that did not consistently validate the final browser target after route-driven navigation. In restrictive browser SSRF configurations this could expose content from internal or otherwise disallowed pages. Technical Details The fix re-checks browser snapshot, screenshot, and tab route results against the configured browser SSRF policy before returning page content. Regression coverage was added around snapshot/screenshot and tab-route flows. Fix The issue was fixed in #66040. The first stable tag containing the fix is v2026.4.14, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - b75ad800a59009fc47eaa3471410f69046150e59 - PR: #66040 Release Process Note Users should…
Recommended action: Upgrade to 2026.4.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
config.get redaction bypass through sourceConfig and runtimeConfig aliases. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.14 - Patched versions: = 2026.4.14 Impact An authenticated gateway client with config read access could receive unredacted secrets through alias fields that survived redaction, including provider API keys, gateway auth material, and channel credentials. Technical Details The fix explicitly overwrites sourceConfig and runtimeConfig with the same redacted copies used for resolved and config, including the invalid-snapshot branch. Tests now cover both alias fields. Fix The issue was fixed in #66030. The first stable tag containing the fix is v2026.4.14, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 86734ef93a2f25063371b04f1946eb300548acd4 - PR: #66030 Release Process Note Users should upgrade to openclaw 2026.4.14 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks…
Recommended action: Upgrade to 2026.4.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Collect-mode queue batches could reuse the last sender authorization context. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.14 - Patched versions: = 2026.4.14 Impact Collect-mode queued messages from different senders could be drained as one batch using the final sender's authorization context, allowing earlier messages to inherit a more privileged context. Technical Details The fix splits collect-mode batches by sender authorization context before dispatch, preserving each message's own trust state. Fix The issue was fixed in #66024. The first stable tag containing the fix is v2026.4.14, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 43d4be902755c970b3d15608679761877718da69 - PR: #66024 Release Process Note Users should upgrade to openclaw 2026.4.14 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this…
Recommended action: Upgrade to 2026.4.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sandbox noVNC helper route exposed interactive browser session credentials. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.2.21 < 2026.4.10 - Patched versions: = 2026.4.10 Impact The sandbox noVNC helper route could be reached without the intended bridge authentication, exposing an interactive browser session surface. Technical Details The fix gates the sandbox noVNC helper route behind bridge authentication. Fix The issue was fixed in #63882. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix. Fix Commit(s) - 8dfbf3268bd224b7377d1ecca77a445100746085 - PR: #63882 Release Process Note Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw's exec script preflight validator previously validated and then read a script by mutable pathname. A local race could swap the path between validation and read, causing preflight analysis to inspect a different file identity than the one that passed the workspace boundary check. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: < 2026.4.10 - Patched versions: = 2026.4.10 Impact The impact is limited. This was not arbitrary full-file disclosure through the preflight error path. The validator only surfaced derived preflight content, such as a matched token, a line number, or the first non-empty JavaScript line in one branch. Exploitation also required the ability to mutate the relevant workspace path during the preflight window. Still, this was a real TOCTOU boundary bug in code that is supposed to reason about workspace-local script files before execution. A file identity that passed the initial boundary validation could differ…
Recommended action: Upgrade to 2026.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2026.1.29 can resolve this issue. This patch is called b623557a2ec7e271bda003eb3ac33fbb2e218505. Upgrading the affected component is advised.
Recommended action: Upgrade to 2026.1.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact GITDIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant). Git plumbing environment variables were not removed before host exec and could redirect Git operations. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <=2026.3.30 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @boy-hack of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Multiple Code Paths Missing Base64 Pre-Allocation Size Checks. Several base64 decode paths could allocate before enforcing decoded-size limits. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <=v2026.4.2 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @zsxsoft and @KeenSecurityLab for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact B-M3: ClawHub package downloads are not enforced with integrity verification. ClawHub downloads could install plugin archives without enforcing archive or per-file integrity metadata. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.1 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact fetchWithSsrFGuard replays unsafe request bodies across cross-origin redirects. A guarded fetch could resend unsafe request bodies or headers when following cross-origin redirects. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <2026.3.31 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @BG0ECV for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact OpenClaw Host-Exec Environment Variable Injection. Host exec could inherit environment variables that influence interpreters, shells, or build tools. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.3.28 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @wsparks-vc for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable. Strict browser SSRF checks could miss Playwright request-time navigation to private targets. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: 2026.3.8 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @smaeljaish771 for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Gateway plugin HTTP auth: gateway widens identity-bearing operator.read requests into runtime operator.write. Plugin HTTP routes using gateway auth could receive runtime write scopes even when the upstream trusted-proxy request only declared read. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: 2026.1.29 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @smaeljaish771 for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Browser SSRF Policy Bypass via Interaction-Triggered Navigation. Browser interactions could trigger navigations that bypassed the normal SSRF navigation checks. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.5 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @ccreater222 and @KeenSecurityLab for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact OpenClaw node.pair.approve placed in operator.write scope instead of operator.pairing allows unprivileged pairing approval. The pairing approval method accepted operator.write instead of the narrower pairing scope and admin requirement for exec-capable nodes. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= v2026.04.01 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @nicky-cc of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Feishu docx uploadfile/uploadimage Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix). Feishu document uploads could read local files outside the workspace-only file policy when processing docx upload blocks. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <=2026.4.3 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @Rosayxy for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact QQ Bot Extension: Missing SSRF Protection on All Media Fetch Paths. QQ Bot media download paths were not consistently routed through the SSRF guard and allowlist policy. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.2 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @adithyan-ak for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Existing WS sessions survive shared gateway token rotation. Rotating the shared gateway token did not disconnect existing shared-token WebSocket sessions. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.1 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths. Concurrent asynchronous shared-secret auth attempts could race the per-key rate-limit budget. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <=2026.4.2 - Patched versions: 2026.4.4 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @Telecaster2147 for reporting.
Recommended action: Upgrade to 2026.4.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement. A previously paired node could reconnect with a broader command set, including exec-capable commands, without forcing the operator/admin re-pairing path. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <=2026.4.5 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @zsxsoft and @KeenSecurityLab for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact /allowlist omits owner-only enforcement for cross-channel allowlist writes. An authorized non-owner sender could attempt allowlist writes against a different channel. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <=v2026.4.1 - Patched versions: 2026.4.8 Fix The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Verification The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary. Credits Thanks @zsxsoft and @KeenSecurityLab for reporting.
Recommended action: Upgrade to 2026.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.