Openclaw
Monthly
Authentication bypass in OpenClaw (npm package, all versions before 2026.4.8) allows low-privileged attackers to exploit a stale JavaScript closure - resolvedAuth - that is not refreshed after a gateway configuration reload, causing newly accepted connections to authenticate against outdated auth state. The CVSS 4.0 score is 2.3 with EPSS at 0.05% (16th percentile), reflecting low real-world exploitation probability; no active exploitation is confirmed and no CISA KEV listing exists. The vendor's own advisory explicitly scopes the issue to OpenClaw's user-controlled local assistant trust model and explicitly excludes multi-tenant service boundaries, sharply limiting blast radius.
Git environment variable injection in OpenClaw (npm) before 2026.4.8 allows a local low-privileged attacker to redirect git operations by setting GIT_DIR and related plumbing variables in the process environment prior to host exec calls. The root cause is an incomplete denylist (CWE-184) that strips some but not all dangerous environment variables before shelling out. No public exploit or active exploitation has been identified at time of analysis; EPSS of 0.01% (3rd percentile) and SSVC exploitation status of 'none' corroborate low near-term exploitation likelihood.
Server-side request forgery in OpenClaw's QQ Bot Extension (npm package, all versions before 2026.4.8) allows authenticated users to route media fetch requests through unprotected endpoints, bypassing the configured SSRF guard and allowlist policies. Internal network resources - including metadata services and private APIs - are reachable via the subsequent-system scope change even though the OpenClaw host itself sustains no direct confidentiality impact. No public exploit code or active exploitation has been identified; EPSS stands at 0.03% and SSVC categorizes exploitation status as none.
Race condition in OpenClaw's shared-secret authentication subsystem allows unauthenticated network attackers to send concurrent async requests that race the per-key rate-limit budget counter on Tailscale-capable paths, bypassing intended throttling protections. All OpenClaw npm versions prior to 2026.4.4 are affected. No public exploit has been identified and SSVC classifies exploitation as none with partial technical impact; EPSS at 0.04% (12th percentile) reflects minimal real-world exploitation interest.
SSRF policy bypass in OpenClaw (npm) versions before 2026.4.8 allows low-privilege authenticated users to exploit browser interaction-triggered navigations that circumvent the application's DNS-pinning SSRF guards. The bypass is specific to the TRUSTED_ENV_PROXY execution mode, activated when proxy environment variables are present, causing the fetch guard to skip hostname resolution policy enforcement and permitting requests to restricted internal resources. No active exploitation is confirmed by CISA KEV; EPSS is 0.03% (7th percentile) and SSVC exploitation status is none, though the subsequent-system confidentiality impact is rated high.
Filesystem policy bypass in OpenClaw's Feishu docx upload pipeline (upload_file and upload_image endpoints) enables authenticated users to read local files outside the intended workspace-only boundary via path traversal. All npm versions of openclaw prior to 2026.4.8 are affected; this is explicitly an incomplete fix of a prior advisory (GHSA-qf48-qfv4-jjm9), indicating the original control was partially circumvented. No active exploitation has been identified - SSVC rates exploitation as none, EPSS sits at 0.04% (12th percentile), and the vulnerability is absent from CISA KEV - with a vendor-confirmed patch available at version 2026.4.8.
Cross-channel allowlist write bypass in OpenClaw before 2026.4.8 allows an authorized but non-owner sender to modify the /allowlist endpoint of channels they do not own, violating the product's intended authorization model. The flaw is classified under CWE-863 (Incorrect Authorization) and is explicitly scoped by the vendor to OpenClaw's single-user local assistant trust model - the advisory excludes multi-tenant service boundaries. With a CVSS 4.0 score of 2.3, EPSS of 0.05% at the 16th percentile, SSVC exploitation status of none, and no public exploit code identified at time of analysis, this is a low-priority integrity-only issue warranting a normal patch cycle rather than emergency response.
Disk exhaustion via unbounded Tlon media downloads affects OpenClaw versions up to and including 2026.3.28, where the Tlon extension bypasses the shared media runtime's file size cap (6 MB per file), per-message image count limit (8 images), and cleanup controls. An authenticated attacker with a valid Tlon account can craft posts containing large numbers of oversized image URLs, causing the OpenClaw instance to write unbounded media to local storage until disk space is exhausted. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04% (11th percentile), and SSVC classifies exploitation as none - vendor-released patch version 2026.3.31 resolves the issue.
OpenClaw before version 2026.4.2 leaks shared-secret length information through timing side-channel attacks in cryptographic comparison operations. The vulnerability stems from early length-mismatch checks in shared-secret comparison routines that violate constant-time security requirements, allowing remote attackers to measure timing differences and infer secret lengths without authentication. This weakens the cryptographic guarantees of the library's shared-secret handling.
OpenClaw before version 2026.3.31 contains a sender allowlist bypass vulnerability allowing remote attackers to access restricted messages by exploiting quoted, root, and thread context message retrieval mechanisms. The vulnerability affects default configurations and requires user interaction (CVSS UI:P), making it a moderate-risk authentication bypass that undermines message access controls.
OpenClaw before version 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer, allowing attackers to bypass the allowRemoteViewer access control restriction. Unauthenticated remote attackers can exploit this authentication bypass by sending specially crafted proxied requests that are incorrectly identified as local traffic, gaining unauthorized access to the diffs viewer functionality. The vulnerability requires network access and specific timing/proximity conditions (per CVSS AT:P vector), but once exploited results in confidentiality impact through unauthorized information disclosure.
OpenClaw before version 2026.3.31 allows authenticated attackers to bypass webhook replay protection through overly broad cache keying, enabling delivery of duplicate webhook messages to unintended sibling targets when the same messageId is reused. The vulnerability exploits insufficient scope isolation in the webhook replay cache deduplication mechanism, allowing message replay across organizational boundaries within a single authentication context.
OpenClaw before version 2026.3.31 fails to properly validate WebSocket frame sizes in its voice-call component before processing, allowing remote unauthenticated attackers to send oversized frames that trigger excessive resource consumption and denial of service. This vulnerability represents an incomplete remediation of CVE-2026-32062, demonstrating that the original fix did not address the root validation sequencing issue.
OpenClaw before version 2026.4.2 improperly trusts local-network pages in its iOS A2UI bridge, allowing attackers to inject unauthorized agent.request commands by serving malicious content from local-network or tailnet hosts. This can pollute session state and consume user budget without authentication, though exploitation requires user interaction and proximity to the target network.
OpenClaw before version 2026.3.31 accepts arbitrary tailnet peers as DNS authorities due to improper validation in its wide-area discovery mechanism, enabling attackers positioned within the same tailnet with CA-trusted endpoint access to manipulate DNS resolution and exfiltrate operator credentials. The vulnerability requires adjacent network access, high attack complexity, and user interaction, but results in high confidentiality impact through credential theft. No active exploitation has been publicly confirmed at the time of analysis.
OpenClaw before version 2026.3.31 allows local authenticated users with user interaction to bypass exec allowlist restrictions via shell initialization file options (--rcfile, --init-file, --startup-file), enabling them to load attacker-controlled initialization files and achieve high-impact unauthorized access to confined resources. Exploitation requires local access, low privileges, user interaction, and specific timing conditions, but bypasses a critical security control intended to restrict executable trust.
OpenClaw before version 2026.3.31 allows local authenticated attackers to redirect Python package-index traffic by injecting malicious URLs through unsanitized PIP_INDEX_URL and UV_INDEX_URL environment variables, enabling interception or manipulation of package management operations. The vulnerability requires local access and authentication but can result in high integrity impact through compromised package delivery. No active exploitation has been publicly confirmed, but the attack surface is direct and the remediation is straightforward.
OpenClaw before version 2026.3.31 allows remote attackers to bypass configuration revocation controls by restarting the application, which rehydrates revoked Tlon configuration settings from disk state due to improper handling of empty-array settings during startup migration. An attacker with network access and the ability to trigger application restarts can restore previously revoked authentication or authorization configurations without explicit re-enablement, potentially compromising intended security controls.
OpenClaw before version 2026.4.2 allows authenticated attackers to delete arbitrary remote directories during mirror mode synchronization operations by manipulating remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. An attacker with login credentials can craft malicious OpenShell config paths that cause the mirror sync function to delete unintended remote directory contents before replacing them with uploaded workspace data, resulting in data loss and potential service disruption.
OpenClaw before version 2026.3.31 allows authenticated attackers to bypass authorization controls on Discord voice channels through exploitation of stale-role validation gaps and improper channel name validation, enabling unauthorized access to restricted voice channels that should be protected by member and channel allowlists. The vulnerability requires valid Discord credentials but enables privilege escalation within voice channel access controls. No public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.31 contains an access control bypass in its Discord voice manager that allows authenticated attackers to send voice ingress requests before channel allowlist authorization checks are enforced, gaining unauthorized access to restricted voice channels. The vulnerability exploits a race condition or authorization sequencing flaw in the voice channel access control mechanism, affecting deployments with member-level access restrictions.
OpenClaw before version 2026.3.31 fails to block plugin installation when security scans detect threats, allowing authenticated users to install malicious plugins by ignoring visible scan warnings. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), but enables installation of untrusted code with moderate integrity impact when exploited.
OpenClaw before version 2026.3.31 fails to properly validate message senders in Matrix thread root and reply context handling, allowing remote unauthenticated attackers to bypass sender allowlists and access filtered messages. The vulnerability requires user interaction and has low attack complexity, but impact is limited to information disclosure of message context that should have been restricted by access controls.
OpenClaw before version 2026.3.31 performs Discord audio preflight transcription without validating member authorization, allowing unauthenticated remote attackers to trigger resource-intensive audio processing and cause denial of service through resource exhaustion.
OpenClaw before 2026.3.31 allows authenticated users with approved host-exec requests to execute arbitrary code during build processes by overriding compiler binary environment variables (CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER) through an incomplete host-env-security-policy.json configuration. The vulnerability requires local access and prior authentication to an OpenClaw instance, but enables full code execution with inherited privileges during compilation. No public exploit code has been identified at time of analysis.
OpenClaw before version 2026.4.2 fails to normalize trailing-dot localhost hostnames in Chrome DevTools Protocol (CDP) discovery responses, allowing attackers to bypass loopback address protections. An unauthenticated remote attacker can craft malicious CDP discovery responses that return 'localhost.' (with trailing dot) instead of the standard 'localhost', causing the browser control mechanism to treat it as a different hostname and redirect authenticated browser sessions to attacker-controlled endpoints, potentially exposing sensitive browser state and authentication tokens.
OpenClaw versions 2026.2.14 through 2026.3.24 fail to enforce guild and channel policy gates on Discord button and component interactions, allowing authenticated users to trigger privileged component actions from contexts where those actions should be blocked. The vulnerability bypasses channel policy enforcement via policy gate inconsistency, enabling privilege escalation within Discord servers where OpenClaw is deployed.
OpenClaw before version 2026.3.31 allows authenticated attackers to read arbitrary host files through improper validation in the appendLocalMediaParentRoots function, enabling exfiltration of credentials and sensitive data. The vulnerability permits model-initiated file access by exploiting a self-whitelisting mechanism that fails to properly validate media parent directory paths. Authentication is required, but the flaw affects confidentiality with a CVSS score of 6.0.
OpenClaw before version 2026.3.31 allows authenticated remote attackers to bypass sender allowlist filters when retrieving MS Teams thread history via Microsoft Graph API, enabling access to messages that should be restricted by security policies. The vulnerability affects organizations using OpenClaw's Teams integration and has been patched as of the specified version.
OpenClaw versions 2026.2.6 through 2026.3.24 allow authenticated remote attackers to read arbitrary files outside configured sandbox boundaries via path traversal in the Feishu extension's resolveUploadInput function during upload_image operations. The vulnerability bypasses file-system sandbox restrictions through improper path resolution, enabling confidentiality compromise of sensitive data accessible to the application process.
OpenClaw versions 2026.2.19 before 2026.3.31 allow authenticated attackers to suppress legitimate webhook events across different accounts in multi-tenant deployments by exploiting improper cache isolation in the Zalo webhook replay-deduplication mechanism. An attacker with control of one authenticated Zalo webhook path can match event_name and message_id parameters to suppress events on victim accounts, causing denial of service to webhook processing. No public exploit code or active exploitation has been identified, though the vulnerability requires valid authentication and incremental exploitation (AT:P), limiting immediate risk.
OpenClaw versions up to and including 2026.3.24 permit SSRF guard bypass because the IPv6 address classifier in `src/shared/net/ip.ts` and `src/infra/net/ssrf.*` omits four IPv6 special-use ranges, incorrectly treating those addresses as public. Authenticated users with the ability to supply fetch URLs can target internal or non-routable IPv6 services that the guard should block, with potential high confidentiality impact on downstream internal systems (SC:H in CVSS 4.0). No public exploit code or active exploitation has been identified; EPSS stands at 0.04% (12th percentile) and SSVC rates exploitation as none, placing real-world urgency at medium priority pending the available upgrade to 2026.3.28.
Approval integrity bypass in OpenClaw's pnpm dlx command-planning path (all versions up to 2026.4.1) allows a low-privileged local attacker to replace an approved local script between the approval decision and actual execution, running arbitrary code under a still-valid approval plan. The root cause is a TOCTOU flaw (CWE-367): unlike the parallel pnpm exec flow, pnpm dlx did not bind local script operands into the approval plan's mutable-file tracking, leaving the script file unmonitored after approval. No active exploitation is confirmed (EPSS 0.01%, SSVC exploitation: none), though SSVC rates technical impact as total given full C/I/A exposure on the vulnerable system.
Slack thread context injection in OpenClaw before 2026.4.2 allows non-allowlisted Slack users to insert arbitrary messages into the AI agent's model context by exploiting a gap in sender-allowlist enforcement on thread history. The sender allowlist - intended to gate which Slack users can interact with the agent - is applied to the triggering message but not to thread-starter or thread-history content fetched via the Slack conversations.replies API, enabling context manipulation when an allowlisted user replies in a thread containing the attacker's messages. A public proof-of-concept exists; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.01% (2nd percentile).
Environment variable leakage in OpenClaw (npm package, versions ≤2026.3.28) occurs because SSH-based sandbox backends pass the full unsanitized Node.js `process.env` object to SSH child processes, potentially exposing secrets such as API keys or credentials stored in the parent process environment. Exploitation is gated behind two non-default prerequisites: the SSH-based sandbox backend must be in use, and SSH environment variable forwarding must be enabled in the host's SSH daemon configuration. No active exploitation or public exploit code has been identified; EPSS sits at 0.01% (1st percentile) and SSVC rates exploitation as none, consistent with the vendor's own triage of this as a narrow, low-severity issue.
OpenClaw's gateway `device.token.rotate` method rotates device credentials without disconnecting live WebSocket sessions authenticated under the old token, leaving a post-compromise revocation gap in all npm `openclaw` releases up to and including 2026.3.28. An attacker who has already obtained valid device credentials and established an active WebSocket connection can maintain unauthorized gateway access indefinitely after an operator rotates the token - effectively nullifying the revocation action. No public exploit exists and CISA SSVC rates exploitation as none with partial technical impact; the low CVSS 4.0 score of 2.3 and EPSS of 0.03% (7th percentile) confirm this as a low-priority, post-compromise control gap rather than an initial access vector.
Arbitrary code execution in OpenClaw's OpenShell mirror mode (npm package versions <= 2026.3.24) allows attackers with mirror mode access to plant malicious JavaScript in the sandbox hooks/ directory, which is synced to the host workspace and executed during gateway startup. The GHSA advisory confirms this flaw shipped in production releases and rates it medium severity due to a narrow exploitation chain requiring four concurrent conditions. EPSS is 0.01% (2nd percentile) and SSVC indicates no active exploitation; no CISA KEV listing exists at time of analysis, though technical impact is rated total if successfully exploited. Vendor-released patch is available in v2026.3.28.
Silent message suppression in OpenClaw's Zalo webhook integration allows deduplicate key collisions across distinct conversations and senders, causing legitimate bot events to be silently dropped. All OpenClaw npm installations prior to version 2026.4.2 are affected via CPE cpe:2.3:a:openclaw:openclaw. An unauthenticated network attacker who can send or replay Zalo webhook events with a predictable message_id can cause cross-chat or cross-sender deduplication collisions, disrupting bot workflows without any visible error. No public exploit has been identified at time of analysis; EPSS is 0.04% (11th percentile) and SSVC confirms no active exploitation.
Replay detection bypass in the OpenClaw npm package (versions ≤ 2026.3.28) allows an attacker who has previously captured a valid Telnyx-signed webhook to re-encode the Ed25519 signature from standard Base64 to Base64URL and resubmit the payload as an apparently unreplayed request. Because Ed25519 cryptographic verification operates on the decoded byte sequence, both encodings pass signature validation; only the replay cache lookup - keyed on the raw uncanonicalised header string - is defeated, enabling duplicate event processing. No public exploit has been identified at time of analysis and EPSS stands at 0.03% (8th percentile), consistent with SSVC Exploitation: none and the maintainer's own normalized severity of low.
Session visibility bypass in OpenClaw (npm) versions through 2026.3.28 permits authenticated agents to read session metadata beyond their authorized scope by invoking session_status outside a sandboxed context. The visibility guard in session-status-tool.ts was conditionally applied only for sandboxed invocations or session-ID-resolved lookups, leaving unsandboxed callers entirely ungated against the tools.sessions.visibility policy. The maintainer triaged this as a same-agent session-policy bypass rather than a host-boundary breach; no public exploit exists and SSVC/EPSS signals indicate no active exploitation pressure.
OpenClaw's Discord integration (npm package, versions <= 2026.3.28) exposes an authorization bypass where authenticated Discord users invoke slash commands or trigger autocomplete in group DM channels outside the configured allowlist, circumventing the `dm.groupChannels` restriction in both the command dispatch and autocomplete paths. The impact is bounded: exploitation requires an already-authorized Discord user and a deployment with group DM allowlisting actively configured, limiting the trust boundary crossed to channel-level access rather than a broader privilege escalation. EPSS is 0.03% (7th percentile) and SSVC classifies exploitation as none; no public exploit code exists and the issue is not in CISA KEV.
Cross-site request forgery in OpenClaw's HTTP operator endpoints affects deployments running in trusted-proxy mode, allowing unauthenticated remote attackers to perform unauthorized actions by tricking an authenticated browser user into triggering a forged request. Affected versions are all OpenClaw npm releases up to and including 2026.3.28; the vulnerability is fully patched in 2026.3.31 released 2026-03-31. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS sits at 0.01% (3rd percentile), consistent with SSVC exploitation status of 'none' - real-world risk is low and narrowly scoped to identity-bearing trusted-proxy browser deployments.
Denial of service in OpenClaw versions 2026.2.26 through pre-2026.3.31 allows unauthenticated remote attackers to exhaust the shared pending pairing-request window on multi-account channel deployments, blocking legitimate accounts from initiating new pairing or onboarding. The root flaw is a quota-scoping error: the cap on pending requests was enforced per channel file rather than per account, so one actor's requests consume capacity allocated to unrelated accounts. The GHSA advisory confirms this is an availability-only impact - no cross-account data access, approval, or authorization bypass is possible. No public exploit or CISA KEV listing exists; EPSS probability is 0.10%, reflecting minimal real-world exploitation pressure at time of analysis.
OpenClaw npm package versions up to and including 2026.3.28 leaks Authorization headers to attacker-controlled servers by forwarding them intact across cross-origin HTTP redirects during media downloads. An attacker who can induce a victim's OpenClaw instance to fetch a media URL that redirects cross-origin - to an attacker-controlled host - receives the victim's full Authorization bearer token. No public exploit or CISA KEV listing exists; EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate low current exploitation activity, though the credential-theft impact class is high for any user whose authorization tokens are intercepted.
Privilege escalation in OpenClaw's chat.send gateway endpoint allows write-scoped API callers to bypass authorization controls and persist admin-only verboseLevel session overrides via the /verbose parameter. All OpenClaw npm package versions up to and including 2026.3.24 are affected; the vendor-released fix is version 2026.3.28. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation with only partial technical impact, aligning with an EPSS score in the 14th percentile.
Resource exhaustion in OpenClaw npm package versions up to 2026.3.28 allows remote unauthenticated attackers to degrade availability of the LINE webhook integration by flooding the endpoint with concurrent requests before signature verification occurs. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-privilege exploitation with bounded low availability impact; the vendor's own triage classifies severity as low due to the transient, non-persistent nature of the disruption. No public exploit code exists and no active exploitation is confirmed - SSVC marks exploitation status as none, though the attack is rated automatable.
Incorrect channel type routing in OpenClaw's Discord extension (versions up to 2026.3.28) allows authenticated Group DM participants to bypass Group DM policy enforcement by exploiting a logic error that treats Group DMs as regular Direct Messages. The flaw in `extensions/discord/src/monitor/agent-components-helpers.ts` causes the `isDirectMessage` flag to be set based solely on the absence of a guild ID, which is also true for Group DM channels, causing all Group DM-specific authorization checks (the `groupEnabled` toggle and channel allowlist) to be silently skipped. No public exploit exists, this vulnerability is not in the CISA KEV catalog, and EPSS at 0.01% (2nd percentile) reflects negligible exploitation interest.
OpenClaw's Telegram legacy `allowFrom` migration incorrectly propagates default-account trust to all configured named Telegram accounts in npm package versions through 2026.3.28, enabling Telegram users previously trusted only on the default account to bypass authentication controls and interact with named accounts they were never explicitly authorized to access. The vendor-confirmed fix is present in version 2026.3.31, released 2026-03-31. No public exploit exists; EPSS is 0.06% and CISA SSVC records exploitation as none at time of analysis.
Information disclosure in OpenClaw (npm) before 2026.4.2 allows low-privilege authenticated Gateway clients to recover host filesystem paths and deployment metadata that should be restricted to admin-scoped sessions. The Gateway `connect` success (`hello-ok`) snapshot unconditionally included `configPath`, `stateDir`, and `authMode` fields for all authenticated clients regardless of scope, exposing server-side deployment topology. No active exploitation has been identified (EPSS 0.03%, 8th percentile; no CISA KEV listing), but the disclosed paths materially assist host fingerprinting and can lower the cost of subsequent chained attacks against the gateway infrastructure.
Sandbox file-operation escape in OpenClaw npm versions <= 2026.3.28 allows a local low-privileged attacker to delete or create files outside the designated workspace root by winning a symlink-rebind race between path validation and filesystem execution in apply_patch, remove, and mkdir operations. The GHSA maintainer triage confirms the scope is narrow - limited to workspace-only mutation operations - and the fix in 2026.3.31 replaces check-then-act enforcement with atomic fd-safe path-within-root helpers. No public exploit exists and SSVC confirms exploitation status as none, placing real-world priority low despite the high integrity impact rating.
Callback origin mutation in OpenClaw's Plivo voice-call replay handler allows an attacker in possession of a captured valid Plivo webhook callback for a live call to inject a modified Host header during the replay window, causing OpenClaw to store an attacker-controlled domain as the callback base URL before replay rejection occurs. All npm releases of openclaw up to and including 2026.3.28 are affected; the vendor-triaged severity is low and scope is narrow, requiring pre-capture of a live call's callback as an explicit prerequisite. No public exploit identified at time of analysis, and EPSS sits at 0.03% (7th percentile), consistent with minimal observed exploitation activity.
OpenClaw's Control UI bootstrap HTTP endpoint exposed internal system metadata - specifically the server version string and assistant agent identifier - in its JSON response payload to any unauthenticated network client on versions up to and including 2026.3.28. This constitutes a fingerprinting/information disclosure vulnerability (CWE-497) that enables attackers to enumerate precise deployment versions and agent configurations without authentication. No active exploitation has been confirmed (not in CISA KEV, EPSS 0.03%), and the maintainer assessed severity as low-narrow; a patched release (2026.3.31) was published 2026-03-30.
Rate limiting bypass in OpenClaw's WebSocket gateway (npm package ≤ 2026.3.28) allows unauthenticated remote attackers to conduct unbounded brute-force attempts against shared-secret passwords by including a fake DeviceToken field in WebSocket handshake requests, suppressing the IP-based rate limiter. The maintainer's own triage classifies the practical risk as narrow, noting that only deployments relying on weak shared passwords face meaningful threat since high-entropy secrets remain non-bruteforceable regardless of rate limiting. No public exploit code exists, EPSS is 0.04%, and SSVC exploitation status is none - consistent with a low-priority patching target outside of weak-credential deployments.
Environment variable injection in OpenClaw (npm) versions through 2026.3.24 allows a local, low-privileged attacker who can submit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files, enabling untrusted code execution via git template hooks or malicious AWS credential loading. The root cause is an incomplete host-env blocklist - specifically, GIT_TEMPLATE_DIR and AWS_CONFIG_FILE were absent from the sanitization policy in src/infra/host-env-security-policy.json and src/infra/host-env-security.ts. No public exploit has been identified at time of analysis; EPSS sits at the 3rd percentile and SSVC rates exploitation as none, indicating no known active threat activity.
Improper authorization in OpenClaw's paired-device pairing management (npm package, versions before 2026.4.20) allows authenticated paired devices with limited `operator.pairing` scope to enumerate global pairing state and approve or reject pending device requests belonging to other devices within the same gateway scope. This is a same-gateway, authenticated privilege escalation bug - not a remote unauthenticated issue. No public exploit code exists and CISA has not listed this in KEV; SSVC assesses exploitation as none and technical impact as partial, consistent with the low EPSS score of 0.03%.
Scope enforcement bypass in OpenClaw's Control UI assistant-media route allows authenticated trusted-proxy callers lacking the `operator.read` scope to read protected assistant-media files and metadata. Affected versions are all OpenClaw npm releases before 2026.4.20; deployments not using trusted-proxy authentication mode are unaffected. No active exploitation is confirmed (absent from CISA KEV), EPSS is 0.03% (7th percentile), and SSVC rates exploitation as none with only partial technical impact, making this a low-urgency patch cycle item.
OpenClaw before version 2026.3.31 allows unauthenticated remote attackers to trigger resource-intensive audio transcription processing via Telegram without proper authorization, enabling denial-of-service through billing or infrastructure exhaustion. The vulnerability stems from insufficient allowlist enforcement that permits unauthorized group senders to initiate preflight transcription operations before authentication is validated, and no public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.31 fails to sanitize environment variables in its host exec policy, allowing authenticated local attackers to override proxy, TLS, Docker, and Git TLS security controls. An attacker with local access and limited privileges can bypass intended security restrictions by injecting malicious environment variables, potentially disabling certificate verification or redirecting traffic through unauthorized proxies. No public exploit code has been identified, and the vulnerability requires process interaction (AT:P) to trigger.
OpenClaw before version 2026.3.31 contains a server-side request forgery (SSRF) vulnerability in the marketplace plugin download functionality, where unguarded fetch() calls allow authenticated users with user interaction to make arbitrary network requests on behalf of the affected system. Remote attackers can access internal resources or interact with external services, potentially disclosing sensitive data or compromising internal infrastructure; no public exploit code or active exploitation has been identified at time of analysis.
OpenClaw 2026.3.22 through 2026.3.30 contain a signature verification bypass in the Nostr direct message (DM) ingress handler that processes pairing challenges before validating event signatures. Remote unauthenticated attackers can send forged DMs to create bogus pending pairing entries, exhaust shared pairing capacity, and trigger unbounded relay and logging work on the Nostr channel, causing denial of service. No public exploit code or active exploitation has been confirmed; a vendor patch is available in version 2026.3.31 and later.
OpenClaw before version 2026.3.31 fails to properly invalidate attacker-discovered endpoints during trust decline operations in remote onboarding workflows, allowing attackers to route gateway credentials to malicious endpoints by preserving their URLs through the trust decline process into manual operator acceptance prompts. The vulnerability requires user interaction (UI:A) but affects gateway credential confidentiality (VC:H), posing a significant risk to organizations using OpenClaw's remote onboarding feature with CVSS 6.9 (medium-high severity).
OpenClaw before version 2026.4.2 fails to enforce write-scope authorization on the POST /sessions/:sessionKey/kill endpoint, allowing authenticated users with read-only credentials to terminate arbitrary subagent sessions. The vulnerability requires valid API credentials with read scope but does NOT require write permissions, enabling privilege escalation within identity-bearing authentication modes. No public exploit code has been identified, and this is not listed as actively exploited by CISA; however, the low CVSS score of 5.3 reflects the requirement for prior authentication rather than the ease of exploitation once credentials are obtained.
OpenClaw before version 2026.3.31 allows authenticated users to exploit server-side request forgery (SSRF) through unvalidated HTTP redirects in the marketplace plugin download functionality, enabling access to internal resources and potential information disclosure. The marketplace.ts module fails to validate redirect destinations during archive downloads, permitting remote attackers with valid credentials and user interaction to redirect requests to arbitrary internal or external servers. Real-world exploitation is limited by authentication and interaction requirements, keeping the baseline CVSS at 4.8 (medium), though impact depends on network exposure of internal services.
OpenClaw before version 2026.4.2 transmits stored gateway credentials over unencrypted WebSocket (ws://) connections when accepting non-loopback endpoints, allowing adjacent network attackers with user interaction to forge discovery results or craft malicious setup codes that redirect clients to attacker-controlled endpoints and exfiltrate plaintext credentials. No public exploit code has been identified, but the vulnerability requires proximity to the target network and user interaction to trigger the credential disclosure.
OpenClaw versions 2026.4.7 through 2026.4.14 fail to enforce path containment on tool-result media references, enabling attackers to craft malicious tool-result inputs that trigger arbitrary local file reads or Windows UNC path access without authentication. An attacker can disclose sensitive files or extract credentials by exploiting this path-traversal weakness in the tool-result processing logic, requiring only network access and the ability to provide crafted tool-result media parameters to an exposed endpoint.
OpenClaw Client exposes PKCE verifier and stored credentials through unencrypted OAuth authorization URL query strings, allowing remote attackers to disclose authentication data when users initiate OAuth flows. The vulnerability requires user interaction (target must start authorization), has a CVSS score of 5.3 (medium), and affects all versions of OpenClaw Client. No active exploitation has been publicly reported, though the ZDI designation (ZDI-CAN-29381) indicates coordinated disclosure.
Authenticated remote attackers can traverse the file system through the OpenClaw canvas gateway endpoint to disclose sensitive information due to insufficient path validation. The vulnerability affects OpenClaw across unspecified versions and requires valid user credentials; attackers operating with low-privilege accounts can read arbitrary files in the service account context. No public exploit code or active exploitation has been identified at the time of analysis.
OpenClaw before version 2026.3.22 allows authenticated attackers to redirect webhook-triggered chat replies to unintended users by exploiting username-based recipient binding instead of stable numeric identifiers. An attacker with valid credentials can manipulate username changes to rebind webhook replies intended for one user to a different user, compromising message confidentiality and integrity. No public exploit code or active CISA exploitation data is available, but the vulnerability is confirmed patched by the vendor.
OpenClaw before version 2026.3.24 permits authenticated local attackers to trigger improper process termination via the !stop chat command, which uses an unpatched killProcessTree function that sends SIGKILL without graceful SIGTERM shutdown. This incomplete fix for CVE-2026-27486 enables attackers to corrupt data, leak resources, and skip security-sensitive cleanup operations, resulting in integrity compromise and denial of service.
OpenClaw before version 2026.3.24 allows unauthenticated remote denial of service via the Feishu webhook handler, which accepts request bodies up to 1MB with a 30-second timeout before verifying the request signature. An attacker can exhaust server connection resources by sending concurrent slow HTTP POST requests, blocking legitimate webhook deliveries and degrading service availability. This is an incomplete remediation of the earlier CVE-2026-32011.
OpenClaw before version 2026.3.25 contains an authentication bypass vulnerability in the raw card send surface that allows unauthenticated remote attackers to send malformed card commands, bypassing DM pairing restrictions and reaching callback handlers without proper authorization. This enables unpaired recipients to mint legacy callback payloads, resulting in integrity compromise of the messaging protocol. No public exploit code or active exploitation has been confirmed, but the low attack complexity and network accessibility make this a practical vulnerability.
OpenClaw before version 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing authenticated leaf subagents to bypass access control and message child sessions beyond their authorized scope. An authenticated attacker with subagent privileges can exploit this via the send action to communicate with restricted child sessions without proper validation, resulting in unauthorized inter-session message relay. No public exploit code has been identified, but the vulnerability has a moderate CVSS score of 4.3 reflecting the integrity impact and low attack complexity.
OpenClaw before 2026.3.25 allows remote attackers to bypass Telegram direct message pairing requirements and mutate session state through weaker callback-only authorization mechanisms. An unauthenticated attacker can craft malicious Telegram callback queries in direct messages to modify session state without satisfying the normal DM pairing security controls, resulting in unauthorized state modification with CVSS 5.3 (medium severity).
OpenClaw before version 2026.3.22 accepts unresolved Bonjour and DNS-SD service discovery metadata to influence CLI routing decisions, allowing attackers on adjacent networks to redirect traffic to attacker-controlled targets through malicious TXT records. The vulnerability requires user interaction and adjacent network access but can cause information disclosure and integrity compromise without authentication.
Filesystem boundary bypass in OpenClaw before 2026.3.2 allows authenticated attackers to read arbitrary files by traversing sandbox bridge mounts outside the configured workspace, circumventing the tools.fs.workspaceOnly restriction. The vulnerability affects the image tool specifically and results in unauthorized information disclosure accessible via network with low complexity.
OpenClaw before version 2026.3.22 contains an authentication bypass vulnerability in X-Forwarded-For header processing when trustedProxies is configured, allowing unauthenticated remote attackers to spoof loopback client addresses and bypass canvas authentication and rate-limiting protections. The vulnerability exploits improper validation of forwarding headers to masquerade as local loopback connections, with a CVSS score of 6.5 reflecting moderate confidentiality and integrity impact but no direct availability impact.
OpenClaw before version 2026.3.22 allows authenticated remote attackers to spoof tool identities through rawInput parameters, bypassing ACP permission resolution and suppressing dangerous-tool prompting via identity hint conflicts between rawInput and metadata. This authentication bypass with high integrity impact affects all versions prior to the fixed release, enabling attackers to circumvent security restrictions intended to prevent execution of dangerous operations.
OpenClaw before version 2026.3.25 allows unauthenticated remote attackers to bypass sender allowlist checks in Microsoft Teams feedback invoke endpoints, enabling unauthorized recording of session feedback. The vulnerability exploits improper authorization logic in feedback processing, granting attackers the ability to trigger feedback recording or reflection operations that should be restricted to authorized senders. No public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.22 suffers from an authorization bypass in its interactive callback dispatch mechanism that permits unauthenticated remote attackers to execute action handlers without sender allowlist validation. The vulnerability exploits a race condition or timing gap where callbacks are processed before security checks complete, enabling unauthorized state modification and availability impact. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and lack of authentication requirements make this a practical threat to exposed OpenClaw deployments.
OpenClaw versions 2026.2.13 through 2026.3.24 allow unauthenticated remote attackers to inject ANSI escape sequences into approval prompts and permission logs via malicious tool metadata, enabling spoofing of terminal output and manipulation of displayed information. The vulnerability requires user interaction (display of the approval prompt) and results in integrity impact only, with a CVSS score of 4.3. A vendor patch is available.
OpenClaw before version 2026.3.22 allows unauthenticated remote attackers to bypass access control denials by exploiting improper handling of empty allowlists during settings reconciliation, silently restoring previously revoked permissions. The vulnerability treats explicitly empty allowlists as unset rather than as explicit deny-all configurations, enabling attackers to undo intended access revocations without authentication. With a CVSS score of 6.5 and network-accessible attack vector, this represents a moderate-severity logic flaw affecting access control enforcement.
OpenClaw before version 2026.3.22 allows policy bypass through unvalidated queued node actions, enabling attackers to execute unauthorized commands by exploiting stale allowlists or policy declarations that persist after policy changes. The vulnerability requires network access and high attack complexity but no authentication, resulting in integrity impact without exposing confidentiality or availability. No public exploit code or active exploitation has been confirmed.
OpenClaw before version 2026.3.25 allows unauthenticated remote attackers to bypass direct message policy controls by sending verification notices to users outside configured allowed peer lists. The vulnerability stems from insufficient access validation checks applied to verification notice transmission, enabling attackers to contact users who have restricted direct messaging policies in place. CVSS score of 5.3 reflects moderate integrity impact with low attack complexity and no authentication requirements.
OpenClaw before version 2026.3.24 fails to enforce authorization checks in the /send and /allowlist chat command handlers, allowing authenticated users with operator.write scope to bypass owner-only restrictions and modify session delivery policies and allowlist configurations. Attackers can persistently alter sendPolicy settings and add entries to allowlists without proper admin authorization, resulting in integrity and availability impacts within the affected session.
OpenClaw before version 2026.3.24 allows authenticated operators with only operator.approvals scope to enumerate sensitive gateway model metadata via the HTTP /v1/models endpoint, bypassing stricter WebSocket RPC authorization controls. Attackers with limited operator privileges can access information that should be restricted to higher-privilege read scopes, resulting in unauthorized information disclosure.
Server-side request forgery (SSRF) in OpenClaw's assertPublicHostname handler (src/agents/tools/web-fetch.ts) allows remote attackers to craft requests that bypass hostname validation and reach internal or restricted systems. Affected versions up to 2026.1.26 are vulnerable; the attack requires high complexity but publicly available exploit code exists. Vendor-released patch version 2026.1.29 (commit b623557a2ec7e271bda003eb3ac33fbb2e218505) resolves the issue.
OpenClaw before version 2026.3.25 allows unauthenticated remote attackers to bypass pre-authentication rate limiting on webhook token validation, enabling brute-force attacks against weak webhook secrets through rapid successive requests. The vulnerability stems from absent throttling on invalid token rejection attempts, permitting attackers to enumerate valid tokens without login credentials or triggering defensive rate-limiting mechanisms.
OpenClaw before version 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that improperly uses a synthetic operator.admin runtime scope, allowing authenticated attackers to execute privileged operations with unintended administrative access by triggering session deletion without a request-scoped client. CVSS score of 6.1 reflects the requirement for low-level user authentication (PR:L) and network accessibility; patch availability is confirmed.
OpenClaw before version 2026.3.25 allows authenticated attackers to bypass authorization controls in mention-gated groups by triggering reaction events that circumvent the requireMention access control mechanism, enabling them to enqueue agent-visible system events that should remain restricted. This medium-severity vulnerability (CVSS 5.3) affects the integrity of group-based access policies and requires user interaction at the network level but leverages low privilege requirements.
OpenClaw before version 2026.3.25 processes JSON webhook request bodies before validating cryptographic signatures, allowing unauthenticated remote attackers to trigger denial of service by submitting malicious webhook payloads that force computationally expensive JSON parsing operations. The vulnerability exploits a logic-ordering defect where signature validation occurs after resource-intensive parsing, enabling attackers to exhaust server resources without valid credentials. No public exploit code has been identified at the time of analysis, though the attack requires only network access and is trivially exploitable.
Authentication bypass in OpenClaw (npm package, all versions before 2026.4.8) allows low-privileged attackers to exploit a stale JavaScript closure - resolvedAuth - that is not refreshed after a gateway configuration reload, causing newly accepted connections to authenticate against outdated auth state. The CVSS 4.0 score is 2.3 with EPSS at 0.05% (16th percentile), reflecting low real-world exploitation probability; no active exploitation is confirmed and no CISA KEV listing exists. The vendor's own advisory explicitly scopes the issue to OpenClaw's user-controlled local assistant trust model and explicitly excludes multi-tenant service boundaries, sharply limiting blast radius.
Git environment variable injection in OpenClaw (npm) before 2026.4.8 allows a local low-privileged attacker to redirect git operations by setting GIT_DIR and related plumbing variables in the process environment prior to host exec calls. The root cause is an incomplete denylist (CWE-184) that strips some but not all dangerous environment variables before shelling out. No public exploit or active exploitation has been identified at time of analysis; EPSS of 0.01% (3rd percentile) and SSVC exploitation status of 'none' corroborate low near-term exploitation likelihood.
Server-side request forgery in OpenClaw's QQ Bot Extension (npm package, all versions before 2026.4.8) allows authenticated users to route media fetch requests through unprotected endpoints, bypassing the configured SSRF guard and allowlist policies. Internal network resources - including metadata services and private APIs - are reachable via the subsequent-system scope change even though the OpenClaw host itself sustains no direct confidentiality impact. No public exploit code or active exploitation has been identified; EPSS stands at 0.03% and SSVC categorizes exploitation status as none.
Race condition in OpenClaw's shared-secret authentication subsystem allows unauthenticated network attackers to send concurrent async requests that race the per-key rate-limit budget counter on Tailscale-capable paths, bypassing intended throttling protections. All OpenClaw npm versions prior to 2026.4.4 are affected. No public exploit has been identified and SSVC classifies exploitation as none with partial technical impact; EPSS at 0.04% (12th percentile) reflects minimal real-world exploitation interest.
SSRF policy bypass in OpenClaw (npm) versions before 2026.4.8 allows low-privilege authenticated users to exploit browser interaction-triggered navigations that circumvent the application's DNS-pinning SSRF guards. The bypass is specific to the TRUSTED_ENV_PROXY execution mode, activated when proxy environment variables are present, causing the fetch guard to skip hostname resolution policy enforcement and permitting requests to restricted internal resources. No active exploitation is confirmed by CISA KEV; EPSS is 0.03% (7th percentile) and SSVC exploitation status is none, though the subsequent-system confidentiality impact is rated high.
Filesystem policy bypass in OpenClaw's Feishu docx upload pipeline (upload_file and upload_image endpoints) enables authenticated users to read local files outside the intended workspace-only boundary via path traversal. All npm versions of openclaw prior to 2026.4.8 are affected; this is explicitly an incomplete fix of a prior advisory (GHSA-qf48-qfv4-jjm9), indicating the original control was partially circumvented. No active exploitation has been identified - SSVC rates exploitation as none, EPSS sits at 0.04% (12th percentile), and the vulnerability is absent from CISA KEV - with a vendor-confirmed patch available at version 2026.4.8.
Cross-channel allowlist write bypass in OpenClaw before 2026.4.8 allows an authorized but non-owner sender to modify the /allowlist endpoint of channels they do not own, violating the product's intended authorization model. The flaw is classified under CWE-863 (Incorrect Authorization) and is explicitly scoped by the vendor to OpenClaw's single-user local assistant trust model - the advisory excludes multi-tenant service boundaries. With a CVSS 4.0 score of 2.3, EPSS of 0.05% at the 16th percentile, SSVC exploitation status of none, and no public exploit code identified at time of analysis, this is a low-priority integrity-only issue warranting a normal patch cycle rather than emergency response.
Disk exhaustion via unbounded Tlon media downloads affects OpenClaw versions up to and including 2026.3.28, where the Tlon extension bypasses the shared media runtime's file size cap (6 MB per file), per-message image count limit (8 images), and cleanup controls. An authenticated attacker with a valid Tlon account can craft posts containing large numbers of oversized image URLs, causing the OpenClaw instance to write unbounded media to local storage until disk space is exhausted. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04% (11th percentile), and SSVC classifies exploitation as none - vendor-released patch version 2026.3.31 resolves the issue.
OpenClaw before version 2026.4.2 leaks shared-secret length information through timing side-channel attacks in cryptographic comparison operations. The vulnerability stems from early length-mismatch checks in shared-secret comparison routines that violate constant-time security requirements, allowing remote attackers to measure timing differences and infer secret lengths without authentication. This weakens the cryptographic guarantees of the library's shared-secret handling.
OpenClaw before version 2026.3.31 contains a sender allowlist bypass vulnerability allowing remote attackers to access restricted messages by exploiting quoted, root, and thread context message retrieval mechanisms. The vulnerability affects default configurations and requires user interaction (CVSS UI:P), making it a moderate-risk authentication bypass that undermines message access controls.
OpenClaw before version 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer, allowing attackers to bypass the allowRemoteViewer access control restriction. Unauthenticated remote attackers can exploit this authentication bypass by sending specially crafted proxied requests that are incorrectly identified as local traffic, gaining unauthorized access to the diffs viewer functionality. The vulnerability requires network access and specific timing/proximity conditions (per CVSS AT:P vector), but once exploited results in confidentiality impact through unauthorized information disclosure.
OpenClaw before version 2026.3.31 allows authenticated attackers to bypass webhook replay protection through overly broad cache keying, enabling delivery of duplicate webhook messages to unintended sibling targets when the same messageId is reused. The vulnerability exploits insufficient scope isolation in the webhook replay cache deduplication mechanism, allowing message replay across organizational boundaries within a single authentication context.
OpenClaw before version 2026.3.31 fails to properly validate WebSocket frame sizes in its voice-call component before processing, allowing remote unauthenticated attackers to send oversized frames that trigger excessive resource consumption and denial of service. This vulnerability represents an incomplete remediation of CVE-2026-32062, demonstrating that the original fix did not address the root validation sequencing issue.
OpenClaw before version 2026.4.2 improperly trusts local-network pages in its iOS A2UI bridge, allowing attackers to inject unauthorized agent.request commands by serving malicious content from local-network or tailnet hosts. This can pollute session state and consume user budget without authentication, though exploitation requires user interaction and proximity to the target network.
OpenClaw before version 2026.3.31 accepts arbitrary tailnet peers as DNS authorities due to improper validation in its wide-area discovery mechanism, enabling attackers positioned within the same tailnet with CA-trusted endpoint access to manipulate DNS resolution and exfiltrate operator credentials. The vulnerability requires adjacent network access, high attack complexity, and user interaction, but results in high confidentiality impact through credential theft. No active exploitation has been publicly confirmed at the time of analysis.
OpenClaw before version 2026.3.31 allows local authenticated users with user interaction to bypass exec allowlist restrictions via shell initialization file options (--rcfile, --init-file, --startup-file), enabling them to load attacker-controlled initialization files and achieve high-impact unauthorized access to confined resources. Exploitation requires local access, low privileges, user interaction, and specific timing conditions, but bypasses a critical security control intended to restrict executable trust.
OpenClaw before version 2026.3.31 allows local authenticated attackers to redirect Python package-index traffic by injecting malicious URLs through unsanitized PIP_INDEX_URL and UV_INDEX_URL environment variables, enabling interception or manipulation of package management operations. The vulnerability requires local access and authentication but can result in high integrity impact through compromised package delivery. No active exploitation has been publicly confirmed, but the attack surface is direct and the remediation is straightforward.
OpenClaw before version 2026.3.31 allows remote attackers to bypass configuration revocation controls by restarting the application, which rehydrates revoked Tlon configuration settings from disk state due to improper handling of empty-array settings during startup migration. An attacker with network access and the ability to trigger application restarts can restore previously revoked authentication or authorization configurations without explicit re-enablement, potentially compromising intended security controls.
OpenClaw before version 2026.4.2 allows authenticated attackers to delete arbitrary remote directories during mirror mode synchronization operations by manipulating remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. An attacker with login credentials can craft malicious OpenShell config paths that cause the mirror sync function to delete unintended remote directory contents before replacing them with uploaded workspace data, resulting in data loss and potential service disruption.
OpenClaw before version 2026.3.31 allows authenticated attackers to bypass authorization controls on Discord voice channels through exploitation of stale-role validation gaps and improper channel name validation, enabling unauthorized access to restricted voice channels that should be protected by member and channel allowlists. The vulnerability requires valid Discord credentials but enables privilege escalation within voice channel access controls. No public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.31 contains an access control bypass in its Discord voice manager that allows authenticated attackers to send voice ingress requests before channel allowlist authorization checks are enforced, gaining unauthorized access to restricted voice channels. The vulnerability exploits a race condition or authorization sequencing flaw in the voice channel access control mechanism, affecting deployments with member-level access restrictions.
OpenClaw before version 2026.3.31 fails to block plugin installation when security scans detect threats, allowing authenticated users to install malicious plugins by ignoring visible scan warnings. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), but enables installation of untrusted code with moderate integrity impact when exploited.
OpenClaw before version 2026.3.31 fails to properly validate message senders in Matrix thread root and reply context handling, allowing remote unauthenticated attackers to bypass sender allowlists and access filtered messages. The vulnerability requires user interaction and has low attack complexity, but impact is limited to information disclosure of message context that should have been restricted by access controls.
OpenClaw before version 2026.3.31 performs Discord audio preflight transcription without validating member authorization, allowing unauthenticated remote attackers to trigger resource-intensive audio processing and cause denial of service through resource exhaustion.
OpenClaw before 2026.3.31 allows authenticated users with approved host-exec requests to execute arbitrary code during build processes by overriding compiler binary environment variables (CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER) through an incomplete host-env-security-policy.json configuration. The vulnerability requires local access and prior authentication to an OpenClaw instance, but enables full code execution with inherited privileges during compilation. No public exploit code has been identified at time of analysis.
OpenClaw before version 2026.4.2 fails to normalize trailing-dot localhost hostnames in Chrome DevTools Protocol (CDP) discovery responses, allowing attackers to bypass loopback address protections. An unauthenticated remote attacker can craft malicious CDP discovery responses that return 'localhost.' (with trailing dot) instead of the standard 'localhost', causing the browser control mechanism to treat it as a different hostname and redirect authenticated browser sessions to attacker-controlled endpoints, potentially exposing sensitive browser state and authentication tokens.
OpenClaw versions 2026.2.14 through 2026.3.24 fail to enforce guild and channel policy gates on Discord button and component interactions, allowing authenticated users to trigger privileged component actions from contexts where those actions should be blocked. The vulnerability bypasses channel policy enforcement via policy gate inconsistency, enabling privilege escalation within Discord servers where OpenClaw is deployed.
OpenClaw before version 2026.3.31 allows authenticated attackers to read arbitrary host files through improper validation in the appendLocalMediaParentRoots function, enabling exfiltration of credentials and sensitive data. The vulnerability permits model-initiated file access by exploiting a self-whitelisting mechanism that fails to properly validate media parent directory paths. Authentication is required, but the flaw affects confidentiality with a CVSS score of 6.0.
OpenClaw before version 2026.3.31 allows authenticated remote attackers to bypass sender allowlist filters when retrieving MS Teams thread history via Microsoft Graph API, enabling access to messages that should be restricted by security policies. The vulnerability affects organizations using OpenClaw's Teams integration and has been patched as of the specified version.
OpenClaw versions 2026.2.6 through 2026.3.24 allow authenticated remote attackers to read arbitrary files outside configured sandbox boundaries via path traversal in the Feishu extension's resolveUploadInput function during upload_image operations. The vulnerability bypasses file-system sandbox restrictions through improper path resolution, enabling confidentiality compromise of sensitive data accessible to the application process.
OpenClaw versions 2026.2.19 before 2026.3.31 allow authenticated attackers to suppress legitimate webhook events across different accounts in multi-tenant deployments by exploiting improper cache isolation in the Zalo webhook replay-deduplication mechanism. An attacker with control of one authenticated Zalo webhook path can match event_name and message_id parameters to suppress events on victim accounts, causing denial of service to webhook processing. No public exploit code or active exploitation has been identified, though the vulnerability requires valid authentication and incremental exploitation (AT:P), limiting immediate risk.
OpenClaw versions up to and including 2026.3.24 permit SSRF guard bypass because the IPv6 address classifier in `src/shared/net/ip.ts` and `src/infra/net/ssrf.*` omits four IPv6 special-use ranges, incorrectly treating those addresses as public. Authenticated users with the ability to supply fetch URLs can target internal or non-routable IPv6 services that the guard should block, with potential high confidentiality impact on downstream internal systems (SC:H in CVSS 4.0). No public exploit code or active exploitation has been identified; EPSS stands at 0.04% (12th percentile) and SSVC rates exploitation as none, placing real-world urgency at medium priority pending the available upgrade to 2026.3.28.
Approval integrity bypass in OpenClaw's pnpm dlx command-planning path (all versions up to 2026.4.1) allows a low-privileged local attacker to replace an approved local script between the approval decision and actual execution, running arbitrary code under a still-valid approval plan. The root cause is a TOCTOU flaw (CWE-367): unlike the parallel pnpm exec flow, pnpm dlx did not bind local script operands into the approval plan's mutable-file tracking, leaving the script file unmonitored after approval. No active exploitation is confirmed (EPSS 0.01%, SSVC exploitation: none), though SSVC rates technical impact as total given full C/I/A exposure on the vulnerable system.
Slack thread context injection in OpenClaw before 2026.4.2 allows non-allowlisted Slack users to insert arbitrary messages into the AI agent's model context by exploiting a gap in sender-allowlist enforcement on thread history. The sender allowlist - intended to gate which Slack users can interact with the agent - is applied to the triggering message but not to thread-starter or thread-history content fetched via the Slack conversations.replies API, enabling context manipulation when an allowlisted user replies in a thread containing the attacker's messages. A public proof-of-concept exists; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.01% (2nd percentile).
Environment variable leakage in OpenClaw (npm package, versions ≤2026.3.28) occurs because SSH-based sandbox backends pass the full unsanitized Node.js `process.env` object to SSH child processes, potentially exposing secrets such as API keys or credentials stored in the parent process environment. Exploitation is gated behind two non-default prerequisites: the SSH-based sandbox backend must be in use, and SSH environment variable forwarding must be enabled in the host's SSH daemon configuration. No active exploitation or public exploit code has been identified; EPSS sits at 0.01% (1st percentile) and SSVC rates exploitation as none, consistent with the vendor's own triage of this as a narrow, low-severity issue.
OpenClaw's gateway `device.token.rotate` method rotates device credentials without disconnecting live WebSocket sessions authenticated under the old token, leaving a post-compromise revocation gap in all npm `openclaw` releases up to and including 2026.3.28. An attacker who has already obtained valid device credentials and established an active WebSocket connection can maintain unauthorized gateway access indefinitely after an operator rotates the token - effectively nullifying the revocation action. No public exploit exists and CISA SSVC rates exploitation as none with partial technical impact; the low CVSS 4.0 score of 2.3 and EPSS of 0.03% (7th percentile) confirm this as a low-priority, post-compromise control gap rather than an initial access vector.
Arbitrary code execution in OpenClaw's OpenShell mirror mode (npm package versions <= 2026.3.24) allows attackers with mirror mode access to plant malicious JavaScript in the sandbox hooks/ directory, which is synced to the host workspace and executed during gateway startup. The GHSA advisory confirms this flaw shipped in production releases and rates it medium severity due to a narrow exploitation chain requiring four concurrent conditions. EPSS is 0.01% (2nd percentile) and SSVC indicates no active exploitation; no CISA KEV listing exists at time of analysis, though technical impact is rated total if successfully exploited. Vendor-released patch is available in v2026.3.28.
Silent message suppression in OpenClaw's Zalo webhook integration allows deduplicate key collisions across distinct conversations and senders, causing legitimate bot events to be silently dropped. All OpenClaw npm installations prior to version 2026.4.2 are affected via CPE cpe:2.3:a:openclaw:openclaw. An unauthenticated network attacker who can send or replay Zalo webhook events with a predictable message_id can cause cross-chat or cross-sender deduplication collisions, disrupting bot workflows without any visible error. No public exploit has been identified at time of analysis; EPSS is 0.04% (11th percentile) and SSVC confirms no active exploitation.
Replay detection bypass in the OpenClaw npm package (versions ≤ 2026.3.28) allows an attacker who has previously captured a valid Telnyx-signed webhook to re-encode the Ed25519 signature from standard Base64 to Base64URL and resubmit the payload as an apparently unreplayed request. Because Ed25519 cryptographic verification operates on the decoded byte sequence, both encodings pass signature validation; only the replay cache lookup - keyed on the raw uncanonicalised header string - is defeated, enabling duplicate event processing. No public exploit has been identified at time of analysis and EPSS stands at 0.03% (8th percentile), consistent with SSVC Exploitation: none and the maintainer's own normalized severity of low.
Session visibility bypass in OpenClaw (npm) versions through 2026.3.28 permits authenticated agents to read session metadata beyond their authorized scope by invoking session_status outside a sandboxed context. The visibility guard in session-status-tool.ts was conditionally applied only for sandboxed invocations or session-ID-resolved lookups, leaving unsandboxed callers entirely ungated against the tools.sessions.visibility policy. The maintainer triaged this as a same-agent session-policy bypass rather than a host-boundary breach; no public exploit exists and SSVC/EPSS signals indicate no active exploitation pressure.
OpenClaw's Discord integration (npm package, versions <= 2026.3.28) exposes an authorization bypass where authenticated Discord users invoke slash commands or trigger autocomplete in group DM channels outside the configured allowlist, circumventing the `dm.groupChannels` restriction in both the command dispatch and autocomplete paths. The impact is bounded: exploitation requires an already-authorized Discord user and a deployment with group DM allowlisting actively configured, limiting the trust boundary crossed to channel-level access rather than a broader privilege escalation. EPSS is 0.03% (7th percentile) and SSVC classifies exploitation as none; no public exploit code exists and the issue is not in CISA KEV.
Cross-site request forgery in OpenClaw's HTTP operator endpoints affects deployments running in trusted-proxy mode, allowing unauthenticated remote attackers to perform unauthorized actions by tricking an authenticated browser user into triggering a forged request. Affected versions are all OpenClaw npm releases up to and including 2026.3.28; the vulnerability is fully patched in 2026.3.31 released 2026-03-31. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS sits at 0.01% (3rd percentile), consistent with SSVC exploitation status of 'none' - real-world risk is low and narrowly scoped to identity-bearing trusted-proxy browser deployments.
Denial of service in OpenClaw versions 2026.2.26 through pre-2026.3.31 allows unauthenticated remote attackers to exhaust the shared pending pairing-request window on multi-account channel deployments, blocking legitimate accounts from initiating new pairing or onboarding. The root flaw is a quota-scoping error: the cap on pending requests was enforced per channel file rather than per account, so one actor's requests consume capacity allocated to unrelated accounts. The GHSA advisory confirms this is an availability-only impact - no cross-account data access, approval, or authorization bypass is possible. No public exploit or CISA KEV listing exists; EPSS probability is 0.10%, reflecting minimal real-world exploitation pressure at time of analysis.
OpenClaw npm package versions up to and including 2026.3.28 leaks Authorization headers to attacker-controlled servers by forwarding them intact across cross-origin HTTP redirects during media downloads. An attacker who can induce a victim's OpenClaw instance to fetch a media URL that redirects cross-origin - to an attacker-controlled host - receives the victim's full Authorization bearer token. No public exploit or CISA KEV listing exists; EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate low current exploitation activity, though the credential-theft impact class is high for any user whose authorization tokens are intercepted.
Privilege escalation in OpenClaw's chat.send gateway endpoint allows write-scoped API callers to bypass authorization controls and persist admin-only verboseLevel session overrides via the /verbose parameter. All OpenClaw npm package versions up to and including 2026.3.24 are affected; the vendor-released fix is version 2026.3.28. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation with only partial technical impact, aligning with an EPSS score in the 14th percentile.
Resource exhaustion in OpenClaw npm package versions up to 2026.3.28 allows remote unauthenticated attackers to degrade availability of the LINE webhook integration by flooding the endpoint with concurrent requests before signature verification occurs. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-privilege exploitation with bounded low availability impact; the vendor's own triage classifies severity as low due to the transient, non-persistent nature of the disruption. No public exploit code exists and no active exploitation is confirmed - SSVC marks exploitation status as none, though the attack is rated automatable.
Incorrect channel type routing in OpenClaw's Discord extension (versions up to 2026.3.28) allows authenticated Group DM participants to bypass Group DM policy enforcement by exploiting a logic error that treats Group DMs as regular Direct Messages. The flaw in `extensions/discord/src/monitor/agent-components-helpers.ts` causes the `isDirectMessage` flag to be set based solely on the absence of a guild ID, which is also true for Group DM channels, causing all Group DM-specific authorization checks (the `groupEnabled` toggle and channel allowlist) to be silently skipped. No public exploit exists, this vulnerability is not in the CISA KEV catalog, and EPSS at 0.01% (2nd percentile) reflects negligible exploitation interest.
OpenClaw's Telegram legacy `allowFrom` migration incorrectly propagates default-account trust to all configured named Telegram accounts in npm package versions through 2026.3.28, enabling Telegram users previously trusted only on the default account to bypass authentication controls and interact with named accounts they were never explicitly authorized to access. The vendor-confirmed fix is present in version 2026.3.31, released 2026-03-31. No public exploit exists; EPSS is 0.06% and CISA SSVC records exploitation as none at time of analysis.
Information disclosure in OpenClaw (npm) before 2026.4.2 allows low-privilege authenticated Gateway clients to recover host filesystem paths and deployment metadata that should be restricted to admin-scoped sessions. The Gateway `connect` success (`hello-ok`) snapshot unconditionally included `configPath`, `stateDir`, and `authMode` fields for all authenticated clients regardless of scope, exposing server-side deployment topology. No active exploitation has been identified (EPSS 0.03%, 8th percentile; no CISA KEV listing), but the disclosed paths materially assist host fingerprinting and can lower the cost of subsequent chained attacks against the gateway infrastructure.
Sandbox file-operation escape in OpenClaw npm versions <= 2026.3.28 allows a local low-privileged attacker to delete or create files outside the designated workspace root by winning a symlink-rebind race between path validation and filesystem execution in apply_patch, remove, and mkdir operations. The GHSA maintainer triage confirms the scope is narrow - limited to workspace-only mutation operations - and the fix in 2026.3.31 replaces check-then-act enforcement with atomic fd-safe path-within-root helpers. No public exploit exists and SSVC confirms exploitation status as none, placing real-world priority low despite the high integrity impact rating.
Callback origin mutation in OpenClaw's Plivo voice-call replay handler allows an attacker in possession of a captured valid Plivo webhook callback for a live call to inject a modified Host header during the replay window, causing OpenClaw to store an attacker-controlled domain as the callback base URL before replay rejection occurs. All npm releases of openclaw up to and including 2026.3.28 are affected; the vendor-triaged severity is low and scope is narrow, requiring pre-capture of a live call's callback as an explicit prerequisite. No public exploit identified at time of analysis, and EPSS sits at 0.03% (7th percentile), consistent with minimal observed exploitation activity.
OpenClaw's Control UI bootstrap HTTP endpoint exposed internal system metadata - specifically the server version string and assistant agent identifier - in its JSON response payload to any unauthenticated network client on versions up to and including 2026.3.28. This constitutes a fingerprinting/information disclosure vulnerability (CWE-497) that enables attackers to enumerate precise deployment versions and agent configurations without authentication. No active exploitation has been confirmed (not in CISA KEV, EPSS 0.03%), and the maintainer assessed severity as low-narrow; a patched release (2026.3.31) was published 2026-03-30.
Rate limiting bypass in OpenClaw's WebSocket gateway (npm package ≤ 2026.3.28) allows unauthenticated remote attackers to conduct unbounded brute-force attempts against shared-secret passwords by including a fake DeviceToken field in WebSocket handshake requests, suppressing the IP-based rate limiter. The maintainer's own triage classifies the practical risk as narrow, noting that only deployments relying on weak shared passwords face meaningful threat since high-entropy secrets remain non-bruteforceable regardless of rate limiting. No public exploit code exists, EPSS is 0.04%, and SSVC exploitation status is none - consistent with a low-priority patching target outside of weak-credential deployments.
Environment variable injection in OpenClaw (npm) versions through 2026.3.24 allows a local, low-privileged attacker who can submit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files, enabling untrusted code execution via git template hooks or malicious AWS credential loading. The root cause is an incomplete host-env blocklist - specifically, GIT_TEMPLATE_DIR and AWS_CONFIG_FILE were absent from the sanitization policy in src/infra/host-env-security-policy.json and src/infra/host-env-security.ts. No public exploit has been identified at time of analysis; EPSS sits at the 3rd percentile and SSVC rates exploitation as none, indicating no known active threat activity.
Improper authorization in OpenClaw's paired-device pairing management (npm package, versions before 2026.4.20) allows authenticated paired devices with limited `operator.pairing` scope to enumerate global pairing state and approve or reject pending device requests belonging to other devices within the same gateway scope. This is a same-gateway, authenticated privilege escalation bug - not a remote unauthenticated issue. No public exploit code exists and CISA has not listed this in KEV; SSVC assesses exploitation as none and technical impact as partial, consistent with the low EPSS score of 0.03%.
Scope enforcement bypass in OpenClaw's Control UI assistant-media route allows authenticated trusted-proxy callers lacking the `operator.read` scope to read protected assistant-media files and metadata. Affected versions are all OpenClaw npm releases before 2026.4.20; deployments not using trusted-proxy authentication mode are unaffected. No active exploitation is confirmed (absent from CISA KEV), EPSS is 0.03% (7th percentile), and SSVC rates exploitation as none with only partial technical impact, making this a low-urgency patch cycle item.
OpenClaw before version 2026.3.31 allows unauthenticated remote attackers to trigger resource-intensive audio transcription processing via Telegram without proper authorization, enabling denial-of-service through billing or infrastructure exhaustion. The vulnerability stems from insufficient allowlist enforcement that permits unauthorized group senders to initiate preflight transcription operations before authentication is validated, and no public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.31 fails to sanitize environment variables in its host exec policy, allowing authenticated local attackers to override proxy, TLS, Docker, and Git TLS security controls. An attacker with local access and limited privileges can bypass intended security restrictions by injecting malicious environment variables, potentially disabling certificate verification or redirecting traffic through unauthorized proxies. No public exploit code has been identified, and the vulnerability requires process interaction (AT:P) to trigger.
OpenClaw before version 2026.3.31 contains a server-side request forgery (SSRF) vulnerability in the marketplace plugin download functionality, where unguarded fetch() calls allow authenticated users with user interaction to make arbitrary network requests on behalf of the affected system. Remote attackers can access internal resources or interact with external services, potentially disclosing sensitive data or compromising internal infrastructure; no public exploit code or active exploitation has been identified at time of analysis.
OpenClaw 2026.3.22 through 2026.3.30 contain a signature verification bypass in the Nostr direct message (DM) ingress handler that processes pairing challenges before validating event signatures. Remote unauthenticated attackers can send forged DMs to create bogus pending pairing entries, exhaust shared pairing capacity, and trigger unbounded relay and logging work on the Nostr channel, causing denial of service. No public exploit code or active exploitation has been confirmed; a vendor patch is available in version 2026.3.31 and later.
OpenClaw before version 2026.3.31 fails to properly invalidate attacker-discovered endpoints during trust decline operations in remote onboarding workflows, allowing attackers to route gateway credentials to malicious endpoints by preserving their URLs through the trust decline process into manual operator acceptance prompts. The vulnerability requires user interaction (UI:A) but affects gateway credential confidentiality (VC:H), posing a significant risk to organizations using OpenClaw's remote onboarding feature with CVSS 6.9 (medium-high severity).
OpenClaw before version 2026.4.2 fails to enforce write-scope authorization on the POST /sessions/:sessionKey/kill endpoint, allowing authenticated users with read-only credentials to terminate arbitrary subagent sessions. The vulnerability requires valid API credentials with read scope but does NOT require write permissions, enabling privilege escalation within identity-bearing authentication modes. No public exploit code has been identified, and this is not listed as actively exploited by CISA; however, the low CVSS score of 5.3 reflects the requirement for prior authentication rather than the ease of exploitation once credentials are obtained.
OpenClaw before version 2026.3.31 allows authenticated users to exploit server-side request forgery (SSRF) through unvalidated HTTP redirects in the marketplace plugin download functionality, enabling access to internal resources and potential information disclosure. The marketplace.ts module fails to validate redirect destinations during archive downloads, permitting remote attackers with valid credentials and user interaction to redirect requests to arbitrary internal or external servers. Real-world exploitation is limited by authentication and interaction requirements, keeping the baseline CVSS at 4.8 (medium), though impact depends on network exposure of internal services.
OpenClaw before version 2026.4.2 transmits stored gateway credentials over unencrypted WebSocket (ws://) connections when accepting non-loopback endpoints, allowing adjacent network attackers with user interaction to forge discovery results or craft malicious setup codes that redirect clients to attacker-controlled endpoints and exfiltrate plaintext credentials. No public exploit code has been identified, but the vulnerability requires proximity to the target network and user interaction to trigger the credential disclosure.
OpenClaw versions 2026.4.7 through 2026.4.14 fail to enforce path containment on tool-result media references, enabling attackers to craft malicious tool-result inputs that trigger arbitrary local file reads or Windows UNC path access without authentication. An attacker can disclose sensitive files or extract credentials by exploiting this path-traversal weakness in the tool-result processing logic, requiring only network access and the ability to provide crafted tool-result media parameters to an exposed endpoint.
OpenClaw Client exposes PKCE verifier and stored credentials through unencrypted OAuth authorization URL query strings, allowing remote attackers to disclose authentication data when users initiate OAuth flows. The vulnerability requires user interaction (target must start authorization), has a CVSS score of 5.3 (medium), and affects all versions of OpenClaw Client. No active exploitation has been publicly reported, though the ZDI designation (ZDI-CAN-29381) indicates coordinated disclosure.
Authenticated remote attackers can traverse the file system through the OpenClaw canvas gateway endpoint to disclose sensitive information due to insufficient path validation. The vulnerability affects OpenClaw across unspecified versions and requires valid user credentials; attackers operating with low-privilege accounts can read arbitrary files in the service account context. No public exploit code or active exploitation has been identified at the time of analysis.
OpenClaw before version 2026.3.22 allows authenticated attackers to redirect webhook-triggered chat replies to unintended users by exploiting username-based recipient binding instead of stable numeric identifiers. An attacker with valid credentials can manipulate username changes to rebind webhook replies intended for one user to a different user, compromising message confidentiality and integrity. No public exploit code or active CISA exploitation data is available, but the vulnerability is confirmed patched by the vendor.
OpenClaw before version 2026.3.24 permits authenticated local attackers to trigger improper process termination via the !stop chat command, which uses an unpatched killProcessTree function that sends SIGKILL without graceful SIGTERM shutdown. This incomplete fix for CVE-2026-27486 enables attackers to corrupt data, leak resources, and skip security-sensitive cleanup operations, resulting in integrity compromise and denial of service.
OpenClaw before version 2026.3.24 allows unauthenticated remote denial of service via the Feishu webhook handler, which accepts request bodies up to 1MB with a 30-second timeout before verifying the request signature. An attacker can exhaust server connection resources by sending concurrent slow HTTP POST requests, blocking legitimate webhook deliveries and degrading service availability. This is an incomplete remediation of the earlier CVE-2026-32011.
OpenClaw before version 2026.3.25 contains an authentication bypass vulnerability in the raw card send surface that allows unauthenticated remote attackers to send malformed card commands, bypassing DM pairing restrictions and reaching callback handlers without proper authorization. This enables unpaired recipients to mint legacy callback payloads, resulting in integrity compromise of the messaging protocol. No public exploit code or active exploitation has been confirmed, but the low attack complexity and network accessibility make this a practical vulnerability.
OpenClaw before version 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing authenticated leaf subagents to bypass access control and message child sessions beyond their authorized scope. An authenticated attacker with subagent privileges can exploit this via the send action to communicate with restricted child sessions without proper validation, resulting in unauthorized inter-session message relay. No public exploit code has been identified, but the vulnerability has a moderate CVSS score of 4.3 reflecting the integrity impact and low attack complexity.
OpenClaw before 2026.3.25 allows remote attackers to bypass Telegram direct message pairing requirements and mutate session state through weaker callback-only authorization mechanisms. An unauthenticated attacker can craft malicious Telegram callback queries in direct messages to modify session state without satisfying the normal DM pairing security controls, resulting in unauthorized state modification with CVSS 5.3 (medium severity).
OpenClaw before version 2026.3.22 accepts unresolved Bonjour and DNS-SD service discovery metadata to influence CLI routing decisions, allowing attackers on adjacent networks to redirect traffic to attacker-controlled targets through malicious TXT records. The vulnerability requires user interaction and adjacent network access but can cause information disclosure and integrity compromise without authentication.
Filesystem boundary bypass in OpenClaw before 2026.3.2 allows authenticated attackers to read arbitrary files by traversing sandbox bridge mounts outside the configured workspace, circumventing the tools.fs.workspaceOnly restriction. The vulnerability affects the image tool specifically and results in unauthorized information disclosure accessible via network with low complexity.
OpenClaw before version 2026.3.22 contains an authentication bypass vulnerability in X-Forwarded-For header processing when trustedProxies is configured, allowing unauthenticated remote attackers to spoof loopback client addresses and bypass canvas authentication and rate-limiting protections. The vulnerability exploits improper validation of forwarding headers to masquerade as local loopback connections, with a CVSS score of 6.5 reflecting moderate confidentiality and integrity impact but no direct availability impact.
OpenClaw before version 2026.3.22 allows authenticated remote attackers to spoof tool identities through rawInput parameters, bypassing ACP permission resolution and suppressing dangerous-tool prompting via identity hint conflicts between rawInput and metadata. This authentication bypass with high integrity impact affects all versions prior to the fixed release, enabling attackers to circumvent security restrictions intended to prevent execution of dangerous operations.
OpenClaw before version 2026.3.25 allows unauthenticated remote attackers to bypass sender allowlist checks in Microsoft Teams feedback invoke endpoints, enabling unauthorized recording of session feedback. The vulnerability exploits improper authorization logic in feedback processing, granting attackers the ability to trigger feedback recording or reflection operations that should be restricted to authorized senders. No public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.22 suffers from an authorization bypass in its interactive callback dispatch mechanism that permits unauthenticated remote attackers to execute action handlers without sender allowlist validation. The vulnerability exploits a race condition or timing gap where callbacks are processed before security checks complete, enabling unauthorized state modification and availability impact. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and lack of authentication requirements make this a practical threat to exposed OpenClaw deployments.
OpenClaw versions 2026.2.13 through 2026.3.24 allow unauthenticated remote attackers to inject ANSI escape sequences into approval prompts and permission logs via malicious tool metadata, enabling spoofing of terminal output and manipulation of displayed information. The vulnerability requires user interaction (display of the approval prompt) and results in integrity impact only, with a CVSS score of 4.3. A vendor patch is available.
OpenClaw before version 2026.3.22 allows unauthenticated remote attackers to bypass access control denials by exploiting improper handling of empty allowlists during settings reconciliation, silently restoring previously revoked permissions. The vulnerability treats explicitly empty allowlists as unset rather than as explicit deny-all configurations, enabling attackers to undo intended access revocations without authentication. With a CVSS score of 6.5 and network-accessible attack vector, this represents a moderate-severity logic flaw affecting access control enforcement.
OpenClaw before version 2026.3.22 allows policy bypass through unvalidated queued node actions, enabling attackers to execute unauthorized commands by exploiting stale allowlists or policy declarations that persist after policy changes. The vulnerability requires network access and high attack complexity but no authentication, resulting in integrity impact without exposing confidentiality or availability. No public exploit code or active exploitation has been confirmed.
OpenClaw before version 2026.3.25 allows unauthenticated remote attackers to bypass direct message policy controls by sending verification notices to users outside configured allowed peer lists. The vulnerability stems from insufficient access validation checks applied to verification notice transmission, enabling attackers to contact users who have restricted direct messaging policies in place. CVSS score of 5.3 reflects moderate integrity impact with low attack complexity and no authentication requirements.
OpenClaw before version 2026.3.24 fails to enforce authorization checks in the /send and /allowlist chat command handlers, allowing authenticated users with operator.write scope to bypass owner-only restrictions and modify session delivery policies and allowlist configurations. Attackers can persistently alter sendPolicy settings and add entries to allowlists without proper admin authorization, resulting in integrity and availability impacts within the affected session.
OpenClaw before version 2026.3.24 allows authenticated operators with only operator.approvals scope to enumerate sensitive gateway model metadata via the HTTP /v1/models endpoint, bypassing stricter WebSocket RPC authorization controls. Attackers with limited operator privileges can access information that should be restricted to higher-privilege read scopes, resulting in unauthorized information disclosure.
Server-side request forgery (SSRF) in OpenClaw's assertPublicHostname handler (src/agents/tools/web-fetch.ts) allows remote attackers to craft requests that bypass hostname validation and reach internal or restricted systems. Affected versions up to 2026.1.26 are vulnerable; the attack requires high complexity but publicly available exploit code exists. Vendor-released patch version 2026.1.29 (commit b623557a2ec7e271bda003eb3ac33fbb2e218505) resolves the issue.
OpenClaw before version 2026.3.25 allows unauthenticated remote attackers to bypass pre-authentication rate limiting on webhook token validation, enabling brute-force attacks against weak webhook secrets through rapid successive requests. The vulnerability stems from absent throttling on invalid token rejection attempts, permitting attackers to enumerate valid tokens without login credentials or triggering defensive rate-limiting mechanisms.
OpenClaw before version 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that improperly uses a synthetic operator.admin runtime scope, allowing authenticated attackers to execute privileged operations with unintended administrative access by triggering session deletion without a request-scoped client. CVSS score of 6.1 reflects the requirement for low-level user authentication (PR:L) and network accessibility; patch availability is confirmed.
OpenClaw before version 2026.3.25 allows authenticated attackers to bypass authorization controls in mention-gated groups by triggering reaction events that circumvent the requireMention access control mechanism, enabling them to enqueue agent-visible system events that should remain restricted. This medium-severity vulnerability (CVSS 5.3) affects the integrity of group-based access policies and requires user interaction at the network level but leverages low privilege requirements.
OpenClaw before version 2026.3.25 processes JSON webhook request bodies before validating cryptographic signatures, allowing unauthenticated remote attackers to trigger denial of service by submitting malicious webhook payloads that force computationally expensive JSON parsing operations. The vulnerability exploits a logic-ordering defect where signature validation occurs after resource-intensive parsing, enabling attackers to exhaust server resources without valid credentials. No public exploit code has been identified at the time of analysis, though the attack requires only network access and is trivially exploitable.