Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real shipped operator.write to admin-class Telegram config or cron persistence bug, but it is an authenticated sink-specific escalation and high is too high given the narrower scope. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.24 - Patched versions: = 2026.3.28 - First stable tag containing the fix: v2026.3.28 Fix Commit(s) - b7d70ade3b9900dbe97bd73be9c02e924ff3c986 — 2026-03-25T12:12:09-06:00 Release Process Note - The fix is already present in released version 2026.3.28. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
sessionstatus still bypasses configured tools.sessions.visibility for unsandboxed invocations Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real on shipped v2026.3.22: non-sandboxed sessionstatus skipped the shared visibility guard, but this is a same-agent session-policy bypass with unreleased fix, not a broader host-boundary break. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 4d369a3400dc9b737fbe8daa63f09d909ce7beb8 — 2026-03-30T16:48:12+02:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real shipped operator.write to admin-class Talk Voice config persistence bug, but it is the same narrow authenticated persistence class and should be normalized below high. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.24 - Patched versions: = 2026.3.28 - First stable tag containing the fix: v2026.3.28 Fix Commit(s) - e34694733fc64931ed4a543c73d84ad3435d5df1 — 2026-03-25T19:55:26Z Release Process Note - The fix is already present in released version 2026.3.28. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Real shipped malicious-workspace-config env injection in the CLI backend runner, fixed by sanitizing backend env before spawn and shipped in v2026.3.24, so advisory stays open until published. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.23-2 - Patched versions: = 2026.3.24 - First stable tag containing the fix: v2026.3.24 Fix Commit(s) - c2fb7f1948c3226732a630256b5179a60664ec24 — 2026-03-24T12:58:10-07:00 Release Process Note - The fix is already present in released version 2026.3.24. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @YLChen-007 for reporting.
Recommended action: Upgrade to 2026.3.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Marketplace Plugin Download Follows Redirects Without SSRF Protection Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: v2026.3.28 still uses bare redirect-following fetch in src/plugins/marketplace.ts for marketplace archives, and fixed-on-main only does not change that shipped SSRF exposure. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 2ce44ca6a1302b166a128abbd78f72114f2f4f52 — 2026-03-31T12:59:42+01:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Tlon media downloads can bypass core safety limits and exhaust disk Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: Shipped v2026.3.28 Tlon media downloads bypassed core size/count/cleanup limits, but this is availability-only resource exhaustion in a bundled plugin path, so low. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 2194587d70d2aef863508b945319c5a7c88b12ce — 2026-03-31T19:40:15+09:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
/phone arm//phone disarm Bypasses operator.admin Scope Check for External Channels Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Maintainers accepted this issue, fixed it in aa66ae1fc797d3298cc409ed2c5da69a89950a45 on 2026-03-27, and that fix shipped in v2026.3.28, so normalize it as a fixed released draft rather than a close-by-trust-model call. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.24 - Patched versions: = 2026.3.28 - First stable tag containing the fix: v2026.3.28 Fix Commit(s) - aa66ae1fc797d3298cc409ed2c5da69a89950a45 — 2026-03-27T20:35:42Z Release Process Note - The fix is already present in released version 2026.3.28. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Before OpenClaw 2026.4.2, exec script preflight validation could fail open on complex interpreter invocations such as pipes or other non-simple command forms. In those cases, script-content validation could be skipped entirely. Impact An attacker-controlled command shape could bypass the intended preflight validation for script execution. This weakened a defense-in-depth guard that was meant to block unsafe script content before execution. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.1 - Patched versions: = 2026.4.2 - Latest published npm version: 2026.4.1 Fix Commit(s) - 8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513 — close the fail-open bypass in exec script preflight Release Process Note The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live. Thanks @iskindar for reporting, and thanks @wsparks-vc for coordination.
Recommended action: Upgrade to 2026.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Before OpenClaw 2026.4.2, the Gemini OAuth flow reused the PKCE verifier as the OAuth state value. Because the provider reflected state back in the redirect URL, the verifier could be exposed alongside the authorization code. Impact Anyone who could capture the redirect URL could learn both the authorization code and the PKCE verifier, defeating PKCE's interception protection for that flow and enabling token redemption. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.4.1 - Patched versions: = 2026.4.2 - Latest published npm version: 2026.4.1 Fix Commit(s) - a26f4d0f3ef0757db6c6c40277cc06a5de76c52f — separate OAuth state from the PKCE verifier OpenClaw thanks @BG0ECV for reporting.
Recommended action: Upgrade to 2026.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps Current Maintainer Triage - Status: narrow - Assessment: Real in shipped v2026.3.28 Discord voice ingress, but impact is channel/member allowlist bypass rather than a broader critical auth break and mainline fix is unreleased. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - dba96e7507e0900f120e5e28e57755d69bf78759 — 2026-03-31T21:29:13+09:00 OpenClaw thanks @cyjhhh for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discord Component Interaction Misclassifies Group DM as Direct Message Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: Real on shipped v2026.3.24 component-interaction routing/auth in extensions/discord/src/monitor/agent-components-helpers.ts, but impact is limited to Group DM policy or session misclassification. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 8c83128fc38d5a3642b8ccbea58550755fdbbbaf — 2026-03-30T11:17:53-06:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @nexrin for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Remote onboarding preserves attacker-discovered endpoint after trust decline, routing gateway credentials to it Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real shipped onboarding trust-decline bug because the declined discovered URL survived into the manual prompt, but operator acceptance of that prefill is still required, so medium. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 2a75416634837c21ed05b8c3ed906eb7a7807060 — 2026-03-30T20:03:06+01:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @zsxsoft for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
diffs viewer misclassifies proxied remote requests as loopback when allowRemoteViewer is disabled Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Shipped v2026.3.28 misclassified proxied diff-viewer requests as local loopback in some cases, a real but low-severity access-control flaw. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 30a1690323088fd291abd11643a264a6828a002c — 2026-03-30T14:17:27-06:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @smaeljaish771 for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discord Slash Commands Bypass Group DM Channel Allowlist Current Maintainer Triage - Status: narrow - Normalized severity: moderate - Assessment: v2026.3.28 native Discord slash and autocomplete paths still skip the group-DM allowlist, but impact is limited to already-authorized Discord users bypassing a channel restriction rather than crossing a stronger trust boundary. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 8fdb19676ab44cf85d47ee13c578195f2e527591 — 2026-03-30T11:17:36-06:00 OpenClaw thanks @nexrin for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
macOS Wide-Area Discovery Accepts Arbitrary Tailnet Peer as DNS Authority and Exfiltrates Operator Credentials Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real shipped macOS discovery steering bug, but exploitation needs same-tailnet position, a CA-trusted endpoint, and user selection, so medium not high. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - a23c33a681f8c1b22dc793995acc4c5c4b568346 — 2026-03-31T10:04:11+01:00 OpenClaw thanks @nexrin for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Telegram legacy allowFrom migration fans default-account trust into all named accounts Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Shipped v2026.3.28 Telegram migration fans legacy default-account allowFrom trust into named accounts, which is an in-scope auth-boundary bug and low fits. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - d8c68c8d4265ea6fa5e8c5e056534c351bddef37 — 2026-03-31T12:51:38+01:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @smaeljaish771 for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: v2026.3.28 startup migration still treats empty-array settings as missing and can rehydrate revoked Tlon config from file state after restart. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - a4d72a83f01fedd35964c352e3473c7712a3511b — 2026-03-31T14:57:03+01:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @smaeljaish771 for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Bootstrap setup codes were not bound to the intended device role and scopes, allowing first-use privilege escalation during pairing. Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Real first-use bootstrap privilege-escalation bug fixed and shipped in v2026.3.22+, so keep open for publication with current severity. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.13-1 - Patched versions: = 2026.3.22 - First stable tag containing the fix: v2026.3.22 Fix Commit(s) - a600c72ed7d0045a27f58bf031d2b36ecb0141c9 — 2026-03-22T23:57:15-07:00 OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Node browser proxy allowProfiles bypass through persistent profile mutation and runtime profile selection Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Real released allowProfiles bypass through profile mutation and runtime profile selection, fixed and shipped in v2026.3.22+, so keep open for publish rather than close. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.13-1 - Patched versions: = 2026.3.22 - First stable tag containing the fix: v2026.3.22 Fix Commit(s) - eac93507c36ccd0c359fba18fa466ef6448be8a5 — 2026-03-23T00:56:44-07:00 Release Process Note - The fix is already present in released version 2026.3.22. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @smaeljaish771 for reporting.
Recommended action: Upgrade to 2026.3.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discord voice manager bypasses channel-level member access allowlist Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: v2026.3.28 still accepts Discord voice ingress before channel allowlist authorization, and main-only gating means this remains a real shipped access-control bug. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - dba96e7507e0900f120e5e28e57755d69bf78759 — 2026-03-31T21:29:13+09:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @zsxsoft for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Telegram audio preflight transcription enables resource consumption by unauthorized senders Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still lets unauthorized Telegram group senders trigger audio preflight before allowlist enforcement, but the real impact is resource or billing burn rather than direct data exposure or host compromise. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - c4fa8635d03943ffe9e294d501089521dca635c5 — 2026-03-30T12:19:31+01:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Paired node escalates to gateway RCE via unrestricted node.event agent dispatch Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still lets paired role=node clients drive node.event agent.request into broader gateway-side tool access than node RPCs, but critical is overstated because a trusted paired node foothold is already required. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - a77928b1087e90f2a8903f8e5aca6dec9237ac62 — 2026-03-30T14:22:15+01:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sandbox escape via TOCTOU race in remote FS bridge readFile Current Maintainer Triage - Normalized severity: critical - Assessment: v2026.3.28 remote sandbox reads still do path-check then separate file read, so the TOCTOU sandbox escape remains present in the latest shipped tag. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 121870a08583033ed6a0ed73d9ffea32991252bb — 2026-03-31T09:55:51+09:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Incomplete fix for CVE-2026-32062: voice-call still parses large WebSocket frames before start validation Current Maintainer Triage - Normalized severity: medium - Assessment: v2026.3.28 still parses oversized pre-start voice-call WebSocket frames before start validation, and the unreleased maxPayload fix confirms the shipped resource-consumption bug remains open. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 9abcfdadf591bf266d85fbdfe14ae833e557a110 — 2026-03-31T19:47:10+09:00 OpenClaw thanks @Kazamayc for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gateway device.token.rotate does not terminate active WebSocket sessions after credential rotation Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: v2026.3.28 rotates device tokens without disconnecting already-authenticated WebSocket sessions, which is a real but post-compromise revocation gap. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 91f7a6b0fd67b703897e6e307762d471ca09333d — 2026-03-31T09:05:34+09:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. Thanks @zsxsoft for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.