Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Fake DeviceToken Bypasses Shared Auth Rate Limiting Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: Real in shipped mixed WS auth flow, but practical risk is mostly weak shared-password deployments since strong shared tokens remain non-bruteforceable. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - af0c0862f22ca4492406a3103d05e3628f94cbe9 — 2026-03-31T09:08:57+09:00 Release Process Note - The fix is already present in released version 2026.3.31. OpenClaw thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables Current Maintainer Triage - Normalized severity: medium - Assessment: v2026.3.28 also misses the broader package, registry, compiler, Docker, and TLS env family in the shipped host-env policy, and the unreleased main fix means this is a real medium-severity open issue. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - eb8de6715f02949c21c4e895fffc8a6dcb00975c — 2026-03-31T19:37:43+09:00 OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read Current Maintainer Triage - Normalized severity: medium - Assessment: v2026.3.28 ACP dispatch still reads attachment paths outside the guarded attachment-cache or root checks, and the root-enforcement fix is not yet shipped. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 566fb73d9da2d73c0be0d9b8e5b762e4dcd8e81d — 2026-03-30T14:04:02+01:00 OpenClaw thanks @north-echo for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode Current Maintainer Triage - Normalized severity: high - Assessment: v2026.3.28 still misses trusted-proxy scope clearing for non-Control-UI clients, so self-declared operator scopes can survive on a real identity-bearing auth path; the complete fix is unreleased. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 8b88b927cb0747ad24d95b07d35682bf85dc5b0e — 2026-03-30T14:19:00+01:00 OpenClaw thanks @north-echo for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw <= 2026.3.24 Media Parsing Path Traversal to Arbitrary File Read Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.24 - Patched versions: = 2026.3.28 - First stable tag containing the fix: v2026.3.28 Fix Commit(s) - 4797bbc5b96e2cca5532e43b58915c051746fe37 — 2026-03-25T13:35:16-06:00 Release Process Note - The fix is already present in released version 2026.3.28.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Agentic Consent Bypass: LLM Agent Can Silently Disable Exec Approval via config.patch Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Maintainers accepted this issue, fixed it in 76411b2afc4ae721e36c12e0ea24fd23e2fed61e on 2026-03-27, and that fix shipped in v2026.3.28, so normalize it as a fixed released draft rather than a close-by-trust-model call. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.24 - Patched versions: = 2026.3.28 - First stable tag containing the fix: v2026.3.28 Fix Commit(s) - 76411b2afc4ae721e36c12e0ea24fd23e2fed61e — 2026-03-27T09:42:15Z OpenClaw thanks @YLChen-007 for reporting.
Recommended action: Upgrade to 2026.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw Gateway Control Interface Information Disclosure Vulnerability Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: Released Control UI bootstrap JSON did expose version and assistant agent id, but that is low-severity fingerprinting or info disclosure only; unreleased c5c10adc trims the payload. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - c5c10adc022f42eb75ebb3bf364dd607738683b3 — 2026-03-30T15:08:19+01:00 OpenClaw thanks @topsec-bunney for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Released workspace-only applypatch remove and mkdir operations were still check-then-act, but the draft overstates scope by bundling broader edit paths; keep it open but narrow it to the actual sandbox-workspace mutation boundary. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 32a4a47d602e0618f87b3e59f94d8c142767f860 — 2026-03-30T16:49:49+01:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Shipped v2026.3.28 image processing could fail open on oversized pixel counts and allow decompression-bomb DoS, an availability issue that is valid at medium. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 0ed4f8a72bb140045962e97ab01c94c076b758a4 — 2026-03-31T22:52:55+09:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Incomplete host-env-security-policy.json allows untrusted model to substitute compiler binaries (CC, CXX, CARGOBUILDRUSTC, CMAKECCOMPILER) via env overrides on approved host exec requests Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Shipped v2026.3.28 host-env policy missed compiler override vars, but exploitation still requires an approved host-exec request inside the existing exec trust domain, so medium not high. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - e277a37f896b5011a1df06e6490c6630074d0afa — 2026-03-30T20:06:32+01:00 OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Device-Paired Node Skips Node Scope Gate → Host RCE.md Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Real in shipped v2026.3.28 because a merely device-paired node could expose node commands without node pairing, but high is sufficient given the pairing/setup prerequisites. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 3886b65ef21d02808c1a106fa1f9f69e22f71c32 — 2026-03-30T17:29:28+01:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: Shipped v2026.3.28 replay hashing treated equivalent Telnyx Base64/Base64URL signatures as distinct requests, but signature verification still held, so lower to low. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - ad77666054651c1fd77b1dc60fd6a8db6600a29a — 2026-03-30T20:01:43+01:00 Release Process Note - The fix is already present in released version 2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work. OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Real in shipped v2026.3.28: host exec env policy still missed proxy, TLS, Docker, and Git TLS variables until 4d912e0451 on 2026-03-31; maintainers already accepted it and the fix is unreleased. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 4d912e04519b4bd53b248437c53748cdebce9a41 — 2026-03-31T21:25:36+09:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discord audio preflight transcription before member authorization Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still runs Discord audio preflight before member allowlist rejection, but this is the same pre-auth resource-consumption class and not the high-severity auth-bypass framing in the draft. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - ee52f64226a03efadfdf1e3b759e13424a3d4e41 — 2026-03-30T14:38:22+01:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HTTP operator endpoints lack browser-origin validation in trusted-proxy mode Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: This is a real trusted-proxy HTTP CSRF or browser-origin gap in released tags, but it is not critical because it depends on identity-bearing trusted-proxy browser deployments rather than the shared-secret HTTP operator model. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d — 2026-03-31T19:49:26+09:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: v2026.3.28 still parses Teams JSON after only a Bearer-prefix gate and before real JWT validation, and the auth-before-parse fix is not yet shipped. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 3834d47099dd13c8244ed6de8b9ea9855c553623 — 2026-03-30T13:46:40+01:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Media Local Roots Self-Whitelisting in appendLocalMediaParentRoots Allows Model-Initiated Arbitrary Host File Read and Credential Exfiltration Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still self-whitelists media parent dirs in src/media/local-roots.ts, but only after config already permits tool-fs root expansion, so the impact is narrower than the default-critical framing. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 1ca4261d7e055d0be141ed79ebb1365d0fbc7364 — 2026-03-30T17:15:03+01:00 OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Media download follows cross-origin redirects with Authorization headers intact Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Shipped v2026.3.28 media downloads forwarded Authorization across cross-origin redirects, a real in-scope credential-leak class that fits medium. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - e704323ff388ed21f6963f9b8e0b1b8dfaaabc5f — 2026-03-31T19:57:42+09:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenShell Mirror Sync: Sandbox Escape via Unrestricted File Sync + Symlink Traversal Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still has the mirror-boundary bug because shipped c02ee8 only excluded hooks while unreleased 3b9dab is the first full symlink-free upload and download hardening. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - c02ee8a3a4cb390b23afdf21317aa8b2096854d1 — 2026-03-25T19:59:07Z - 3b9dab0ece4643a9643e6a45459f5c709d3ce320 — 2026-03-30T14:51:44+01:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Workspace .env can override the bundled plugin trust root Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: v2026.3.28 still lets workspace .env override OPENCLAWBUNDLEDPLUGINSDIR, but critical is too high because exploitation still depends on attacker-controlled workspace loading, not a universal remote break. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 330a9f98cb29c79b1c16a2117e03d6276a0d6289 — 2026-03-31T19:25:12+09:00 OpenClaw thanks @nexrin for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security Scan Failure Does Not Block Plugin Installation (Fail-Open) Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Real in shipped v2026.3.28 plugin install flow, but low severity fits because it still requires an operator to choose installation of an untrusted package and the scan failure was visible rather than silent. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 7a953a52271b9188a5fa830739a4366614ff9916 — 2026-03-30T15:36:08+01:00 - 44b993613601280d46a5b88190e46669fc13d669 — 2026-03-31T23:16:11+09:00 - 0d7f1e2c84eca65df7dee890d9c30e2a841c030a — 2026-03-31T23:27:20+09:00 - bf96c67fd1954740aeabfadc7cfe3098bcfc6b68 — 2026-03-31T15:53:29+01:00 OpenClaw thanks @davidluzsilva for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Real in shipped v2026.3.28: SSH sandbox tar upload lacked pre-upload symlink escape rejection until 3d5af14984 on 2026-03-31; maintainers already accepted it and the fix is unreleased. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 3d5af14984ac1976c747a8e11581d697bd0829dc — 2026-03-31T19:56:45+09:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SSRF via Unguarded fetch() in Marketplace Plugin Download and Ollama Model Discovery Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Keep the shipped marketplace archive-fetch SSRF, but narrow out the Ollama half because it is operator-configured and overlaps weaker trust-model or duplicate SSRF ground. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 8deb9522f3d2680820588b190adb4a2a52f3670b — 2026-03-30T20:08:38+01:00 OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SSH-based sandbox backends pass unsanitized process.env to child processes Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: Shipped SSH sandbox paths leaked unsanitized env into local SSH child processes, but remote leakage needs non-default SSH env forwarding, so lower to low. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - cfe14459531e002a1c61c27d97ec7dc8aecddc1f — 2026-03-30T20:05:57+01:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
MSTeams thread history bypasses sender allowlist via Graph API Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Real in shipped v2026.3.28 MS Teams because Graph-fetched thread history bypasses sender allowlists, with unreleased mainline filtering fix. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.3.31 - Vulnerable version range: <=2026.3.28 - Patched versions: = 2026.3.31 - First stable tag containing the fix: v2026.3.31 Fix Commit(s) - 5cca38084074fb5095aa11b6a59820d63e4937c9 — 2026-03-30T15:38:26+01:00 OpenClaw thanks @AntAISecurityLab for reporting.
Recommended action: Upgrade to 2026.3.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.