294 results · Clear filters · Feed
-
Medium 5.0
OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers
OpenClaw's `system.run` shell-wrapper detection did not recognize PowerShell `-EncodedCommand` forms as inline-command wrappers. In `allowlist` mode, a caller with access to `system.run` could invoke `pwsh` or `powershell` using `-EncodedCommand`, `-enc`, or …
-
Medium 6.3
OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots
### Summary `system.run` env override sanitization allowed dangerous override-only helper-command pivots to reach subprocesses. A caller who could invoke `system.run` with `env` overrides could bypass allowlist/approval intent by steering an allowlisted tool …
-
Medium 5.3
OpenClaw's hooks count non-POST requests toward auth lockout
OpenClaw's hooks HTTP handler counted hook authentication failures before rejecting unsupported HTTP methods. An unauthenticated client could send repeated non-`POST` requests (for example `GET`) with an invalid token to consume the hook auth failure budget a…
-
Medium 5.9
OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust
OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remoteAddress without validating forwarding headers, allowing bypass of configured we…
-
Medium 5.5
OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding
OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pres…
-
Medium 6.5
OpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibility
OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An external attacker can send …
-
Medium 6.1
OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation Commands
OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrary file writes outside the intended directory. Attackers can craft malicious archives that, when extr…
-
Medium 6.5
OpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matching
OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional extension must be enabled) that leaks bearer tokens to allowlisted suffix domains. When retrying dow…
-
Medium 6.5
OpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization
OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled usernames to bypass allo…
-
Medium 4.8
OpenClaw < 2026.2.13 - Timing Attack via Hook Token Comparison
OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can exploit timing side-channels…
-
Medium 5.3
OpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix Plugin
OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in which DM allowlist matching could be bypassed by exact-matching against sender display names and localparts without homeserver validation.…
-
Medium 6.5
OpenClaw < 2026.2.2 - SSRF via Attachment Media URL Hydration
OpenClaw versions prior to 2026.2.2 contain a server-side request forgery vulnerability in attachment and media URL hydration that allows remote attackers to fetch arbitrary HTTP(S) URLs. Attackers who can influence media URLs through model-controlled sendAtt…
-
Medium 5.9
OpenClaw < 2026.2.12 - Timing Attack in Hooks Token Authentication
OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can exploit timing side-channels…
-
Medium 6.1
OpenClaw < 2026.2.14 - Path Traversal in Sandbox Skill Mirroring via Name Parameter
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring (must be enabled) that uses the skill frontmatter name parameter unsanitized when copying skills into the sandbox workspace. Attackers who provide a crafted…
-
Medium 5.5
OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. R…
-
Medium 6.8
OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints
OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles witho…
-
Medium 6.5
OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl
OpenClaw version 2026.1.14-1 prior to 2026.2.12 contains an improper network binding vulnerability in the Chrome extension (must be installed and enabled) relay server that treats wildcard hosts as loopback addresses, allowing the relay HTTP/WS server to bind…
-
Medium 6.5
OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool
OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion by parsing oversized or deeply nested HTML responses. Remote attackers can social…
-
Medium —
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
## Summary A malicious or compromised MCP (Model Context Protocol) tool server can exfiltrate arbitrary local files from the host system by injecting `MEDIA:` directives into tool result text content. OpenClaw's tool result processing pipeline extracts file p…
-
Medium —
OpenClaw has agent avatar symlink traversal in gateway session metadata
## Summary A crafted local avatar path could follow a symlink outside the agent workspace and return arbitrary file contents as a base64 `data:` URL in gateway responses. ## Impact - Confidentiality impact: local file read in the gateway process context. - Ex…
-
Medium —
OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization
### Summary In certain elevated-mode configurations, `tools.elevated.allowFrom` accepted broader identity signals than intended. The fix tightens matching to sender-scoped identity by default and makes mutable metadata matching explicit. ### Context OpenClaw …
-
Medium —
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
## Summary OpenClaw's SSRF hostname/IP guard did not detect ISATAP embedded IPv4 addresses (`...:5efe:w.x.y.z`). A crafted URL containing an ISATAP IPv6 literal could embed a private IPv4 target (for example loopback) and bypass private-address filtering in U…
-
Medium —
OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch
A missing group-sender authorization check in the Zalo plugin allowed unauthorized `GROUP` messages to enter agent dispatch paths in configurations intended to restrict group traffic. ## Impact When Zalo group handling was configured with allowlist-style cont…
-
Medium —
OpenClaw has Canvas route hardening for mixed-trust deployments
## Summary This advisory tracks a defense-in-depth hardening for canvas routes. In mixed-trust or network-visible deployments, prior canvas auth/fallback behavior could broaden access beyond intended boundaries. ## Deployment Context OpenClaw’s default model …
-
Medium —
OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation
### Summary `tools.exec` allowlist/safe-bins evaluation could diverge from runtime execution for wrapper commands using GNU `env -S/--split-string` semantics. This allowed policy checks to treat a command as a benign safe-bin invocation while runtime executed…
-
Medium —
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
## Summary The exported session HTML viewer allowed stored XSS when untrusted session content included raw HTML markdown tokens or unescaped metadata fields. ## Impact Opening a crafted exported HTML session could execute attacker-controlled JavaScript in the…
-
Medium 6.5
OpenClaw has a Discord `allowFrom` slug-collision authorization bypass
OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry. ## Affected Packages / Ver…
-
Medium —
OpenClaw has a IPv6 multicast SSRF classifier bypass
### Summary OpenClaw's SSRF IP classifier did not treat IPv6 multicast literals (`ff00::/8`) as blocked/private-internal. This allowed literal multicast hosts to pass SSRF preflight checks. ### Impact A bypass in address classification existed for IPv6 multic…
-
Medium —
OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint
### Summary When the optional Chrome extension relay is enabled, `/extension` accepted unauthenticated WebSocket upgrades while `/json/*` and `/cdp` required auth. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `<= 2026.2.17` - Lates…
-
Medium 5.3
OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths
### Summary OpenClaw shell-env fallback trusted startup environment values and could execute attacker-influenced login-shell startup paths before loading env keys. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.1.5`…
-
Medium —
OpenClaw plugin runtime command execution is part of trusted plugin boundary
### Summary OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution (`runtime.system.runCommandWithTimeout`). ### Impact Plugins already execute with…
-
Medium —
OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption
### Summary In `openclaw` MS Teams file-consent flow, pending uploads were authorized by `uploadId` alone. `fileConsent/invoke` did not verify the invoke conversation against the conversation that created the pending upload. ### Impact An attacker who obtaine…
-
Medium —
OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows
## Summary In authenticated non-owner DM sessions, a narrow tool-invocation path could reach broader-than-intended owner-only gateway actions. ## Impact This requires an authenticated non-owner sender in a DM session and a specific tool invocation path. No un…
-
Medium —
OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)
## Summary Remote iMessage attachment fetches used SCP with trust-on-first-use host-key behavior and accepted unvalidated remote host tokens. Before the fix: - SCP used `StrictHostKeyChecking=accept-new` in the remote attachment path. - `channels.imessage.rem…
-
Medium 5.5
OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots
### Summary OpenClaw accepted `camera.snap` / `camera.clip` node payload `url` fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host. In OpenClaw's documented trust model, paired nodes are in the same operato…
-
Medium —
OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode
### Summary In `openclaw` allowlist mode, `tools.exec.safeBins` trusted PATH-derived directories for safe-bin resolution. A same-name binary placed in a trusted PATH directory could satisfy safe-bin checks and execute. ### Impact This is an allowlist bypass i…
-
Medium —
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check
## Impact In Telegram DM mode, inbound media was downloaded and written to disk before sender authorization checks completed. An unauthorized sender could trigger inbound media download/write activity (including media groups) even when DM access should be den…
-
Medium —
OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants
## Vulnerability The hook authentication throttle keyed failed attempts by raw socket `remoteAddress` text. IPv4 and IPv4-mapped IPv6 forms of the same client (for example `1.2.3.4` and `::ffff:1.2.3.4`) were treated as different clients, allowing separate ra…
-
Medium —
OpenClaw: Node exec approvals could be replayed across nodes
## Summary `exec.approval` requests for `host=node` were not explicitly bound to the target `nodeId`, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet. ## Impact An operator approval …
-
Medium —
OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization
### Summary Unauthorized senders could trigger two command paths without sender authorization checks: 1. stop-like natural-language abort triggers 2. `/models` command output ### Impact An unauthorized sender could disrupt active sessions and view model/auth …