241 results · Clear filters · Feed
-
High 7.2
OpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling
OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths before passing them to dynamic import(), allowing code execution. An attacker with gateway configurat…
-
High 7.5
OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook
OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge Teleg…
-
High 7.5
OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive Extraction
OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory. Attackers can craft malicious archives with traversal sequences like ../../ to wr…
-
High 8.3
OpenClaw < 2026.2.14 - SSRF via Feishu Extension Media Fetching
OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remote URLs without SSRF protections via sendMediaFeishu function and markdown image processing.…
-
High 7.3
OpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control
OpenClaw versions 2026.1.29 prior to 2026.2.1 contain a vulnerability in the Twitch plugin (must be installed and enabled) in which it fails to enforce the allowFrom allowlist when allowedRoles is unset or empty, allowing unauthorized Twitch users to trigger …
-
High 8.1
OpenClaw 2026.1.29-beta.1 < 2026.2.1 - Path Traversal in Plugin Installation via Package Name
OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensions directory. Attackers can craft scoped package names containing path traversa…
-
High 7.7
OpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path Traversal
OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter accepts absolute paths and traversal sequences…
-
High 7.5
OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages
OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slas…
-
High —
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations
### Summary In certain workspace-restricted configurations, OpenClaw could follow hardlink aliases inside the workspace that reference files outside the workspace boundary. By default, `tools.fs.workspaceOnly` is off. This primarily affects deployments that i…
-
High —
OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From
### Summary `commands.allowFrom` is documented as a sender authorization allowlist for commands/directives, but command authorization could include `ctx.From` (conversation identity) as a sender candidate. When `commands.allowFrom` contained conversation-like…
-
High —
OpenClaw: Zip extraction symlink traversal could write outside destination
### Summary A path confinement bypass in OpenClaw ZIP extraction allowed writes outside the intended destination when a pre-existing symlink was present under the extraction root. ### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published…
-
High —
OpenClaw hook transform path containment missed symlink-resolved escapes
## Vulnerability Webhook transform modules were validated with lexical path checks only. A symlink under the allowed hooks transform tree could resolve outside the intended directory and be dynamically imported. ## Affected Packages / Versions - Package: `ope…
-
High —
OpenClaw has multiple E2E/test Dockerfiles that run all processes as root
Three Dockerfiles in scripts/docker/ and scripts/e2e/ lack a USER directive, meaning all processes run as uid 0 (root). If any process is compromised, the attacker has root inside the container, making container breakout significantly easier. **Partial fix (2…
-
High —
OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt
### Summary In `openclaw` versions up to and including `2026.2.22-2`, a non-default exec-approval configuration could allow a skill-name collision to bypass an `ask=on-miss` prompt. When `autoAllowSkills=true`, a path-scoped executable such as `./skill-bin` c…
-
High —
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands
### Summary `BASH_ENV` / `ENV` startup-file injection could lead to unintended pre-command shell execution when attacker-controlled environment values were admitted and then inherited by host command execution paths. ### Affected Packages / Versions - Package…
-
High —
OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot
### Summary A sandbox path validation bypass in `openclaw` allows host file reads outside `sandboxRoot` via the media path fallback tmp flow when the fallback tmp root is a symlink alias. ### Affected Packages / Versions - Package: `npm openclaw` - Affected v…
-
High 8.0
OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization
### Summary Sandboxed `sessions_spawn(runtime="acp")` could bypass sandbox inheritance and initialize host-side ACP runtime. The fix now fail-closes ACP spawn from sandboxed requester sessions and rejects `sandbox="require"` for `runtime="acp"`. ### Affected …
-
High —
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
### Summary In sandboxed runs, native prompt image auto-load did not honor `tools.fs.workspaceOnly=true`. This optional hardening setting is **not enabled by default**. When operators enabled it, prompt text could still reference mounted out-of-workspace imag…
-
High —
OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection
A missing sender-authorization check in Telegram `message_reaction` handling allowed unauthorized users to trigger reaction-derived system events. ## Affected Packages / Versions - Package: `openclaw` (npm) - Introduced: `2026.2.17` - Affected: `>= 2026.2.17`…
-
High 8.8
OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval
## Summary OpenClaw Gateway exposes an authenticated HTTP endpoint (`POST /tools/invoke`) intended for invoking a constrained set of tools. Two issues could combine to significantly increase blast radius in misconfigured or exposed deployments: - The HTTP gat…
-
High —
OpenClaw: Sandbox media TOCTOU could read files outside sandbox root
### Summary Sandbox media handling had a time-of-check/time-of-use gap: media paths could be validated first and read later through a separate path. A symlink retarget between those steps could cause reads outside `sandboxRoot`. ### Impact Affected versions c…
-
High —
OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries
### Summary A symlink-retarget TOCTOU race in `writeFileWithinRoot` could point an attacker-controlled path alias outside the configured root between resolution and write operations. ### Impact Affected versions could cause out-of-root write side effects (inc…
-
High 7.6
OpenClaw: Prevent shell injection in macOS keychain credential write
OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because …
-
High 7.7
OpenClaw: Docker container escape via unvalidated bind mount config injection
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or ho…
-
High 8.6
OpenClaw: Unsanitized CWD path injection into LLM prompts
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, OpenClaw embedded the current working directory (workspace path) into the agent system prompt without sanitization. If an attacker can cause OpenClaw to run inside a directory whose name contain…
-
High 7.1
OpenClaw has a path traversal in browser upload allows local file read
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, authenticated attackers can read arbitrary files from the Gateway host by supplying absolute paths or path traversal sequences to the browser tool's `upload` action. The server passed these path…
-
High 7.1
OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning
OpenClaw is a personal AI assistant. Discovery beacons (Bonjour/mDNS and DNS-SD) include TXT records such as `lanHost`, `tailnetDns`, `gatewayPort`, and `gatewayTlsSha256`. TXT records are unauthenticated. Prior to version 2026.2.14, some clients treated TXT …
-
High 7.2
OpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, a mismatch between `rawCommand` and `command[]` in the node host `system.run` handler could cause allowlist/approval evaluation to be performed on one command while executing a different argv. T…
-
High 7.5
OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, OpenClaw's SSRF protection could be bypassed using full-form IPv4-mapped IPv6 literals such as `0:0:0:0:0:ffff:7f00:1` (which is `127.0.0.1`). This could allow requests that should be blocked (l…
-
High 8.6
OpenClaw has a command injection in maintainer clawtributors updater
OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script `scripts/update-clawtributors.ts`. The issue affects contributors/maintainers (or CI) who run `bun scripts/update-clawtributors.ts` …
-
High 7.6
OpenClaw Gateway tool allowed unrestricted gatewayUrl override
OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Gateway tool accepted a tool-supplied `gatewayUrl` without sufficient restrictions, which could cause the OpenClaw host to attempt outbound WebSocket connections to user-specified t…
-
High 7.5
OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension
OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. If an attacker can influence t…
-
High 7.1
OpenClaw macOS deep link confirmation truncation can conceal executed agent message
OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unattended `key`, the app shows a confirmation dialog that previously displayed only the first 240 characte…
-
High 7.5
OpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated Requests
OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbound webhook requests when telnyx.publicKey is not configured, enabling unauthenticated callers to fo…
-
High 7.1
OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints
OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiate…
-
High 7.5
OpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust
OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) even when the c…
-
High 7.5
OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass
OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. In deployments where…
-
High —
OpenClaw inter-session prompts could be treated as direct user instructions
## Summary Inter-session messages sent via `sessions_send` could be interpreted as direct end-user instructions because they were persisted as `role: "user"` without provenance metadata. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected v…
-
High 7.6
OpenClaw affected by SSRF in Image Tool Remote Fetch
## Summary A server-side request forgery (SSRF) vulnerability in the Image tool allowed attackers to force OpenClaw to make HTTP requests to arbitrary internal or restricted network targets. ## Affected Versions - npm: openclaw <= 2026.2.1 ## Patched Versions…
-
High 7.1
OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing
## Summary The issue is not deterministic session keys by itself. The exploitable path was accepting externally supplied `sessionKey` values on authenticated hook ingress, allowing a hook token holder to route messages into chosen sessions. ## Affected Behavi…