openclaw

OpenClaw < 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOS

Affected: fixed in 2026.5.12.

Fixed in 2026.5.12 (released May 14, 2026, 33 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.5% of openclaw downloads last week were affected versions (70.1K).

OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing

Affected: fixed in 2026.4.25.

Fixed in 2026.4.25 (released Apr 27, 2026, 50 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (60.7K).

OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass

Affected: fixed in 2026.5.12.

Fixed in 2026.5.12 (released May 14, 2026, 33 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.5% of openclaw downloads last week were affected versions (70.1K).

OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command

Affected: fixed in 2026.4.25.

Fixed in 2026.4.25 (released Apr 27, 2026, 50 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (60.7K).

OpenClaw < 2026.5.7 - Privilege Escalation via Mutable Discord Display Names in allowFrom

Affected: fixed in 2026.5.7.

Fixed in 2026.5.7 (released May 7, 2026, 40 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (67.6K).

OpenClaw < 2026.5.26 - Exec Allowlist Bypass via Transparent Command Wrappers

Affected: fixed in 2026.5.26.

Fixed in 2026.5.26 (released May 27, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.7% of openclaw downloads last week were affected versions (75.2K).

OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope

Affected: fixed in 2026.5.6.

Fixed in 2026.5.6 (released May 6, 2026, 41 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (67.3K).

OpenClaw < 2026.4.29 - Arbitrary Package Manager Execution via Workspace .env npm_execpath

Affected: fixed in 2026.4.29.

Fixed in 2026.4.29 (released Apr 30, 2026, 47 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (62.6K).

OpenClaw < 2026.5.6 - Skill-Command Dispatch Hook Bypass via Before-Tool-Call Hook Skipping

Affected: fixed in 2026.5.6.

Fixed in 2026.5.6 (released May 6, 2026, 41 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (67.3K).

OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search

Affected: fixed in 2026.4.29.

Fixed in 2026.4.29 (released Apr 30, 2026, 47 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (62.6K).

OpenClaw < 2026.5.26 - Node Token Revocation Bypass via Pairing-Scoped Device Session

Affected: fixed in 2026.5.26.

Fixed in 2026.5.26 (released May 27, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.7% of openclaw downloads last week were affected versions (75.2K).

OpenClaw < 2026.5.2 - Arbitrary Python Runtime Execution via CLOUDSDK_PYTHON Environment Variable

Affected: fixed in 2026.5.2.

Fixed in 2026.5.2 (released May 3, 2026, 44 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.3% of openclaw downloads last week were affected versions (63.6K).

OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML

Affected: fixed in 2026.5.12.

Fixed in 2026.5.12 (released May 14, 2026, 33 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.5% of openclaw downloads last week were affected versions (70.1K).

OpenClaw < 2026.5.12 - Custom Header Leakage via MCP Streamable HTTP Cross-Origin Redirects

Affected: fixed in 2026.5.12.

Fixed in 2026.5.12 (released May 14, 2026, 33 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.5% of openclaw downloads last week were affected versions (70.1K).

OpenClaw < 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint Validation

Affected: fixed in 2026.5.7.

Fixed in 2026.5.7 (released May 7, 2026, 36 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (67.6K).

OpenClaw < 2026.5.27 - Node Pairing State Mutation via Reconnection

Affected: fixed in 2026.5.27.

Fixed in 2026.5.27 (released May 28, 2026, 15 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.7% of openclaw downloads last week were affected versions (76K).

OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers

Affected: fixed in 2026.5.6.

Fixed in 2026.5.6 (released May 6, 2026, 37 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (67.3K).

OpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliases

Affected: fixed in 2026.5.12.

Fixed in 2026.5.12 (released May 14, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.5% of openclaw downloads last week were affected versions (70.1K).

OpenClaw < 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent Bindings

Affected: fixed in 2026.5.6.

Fixed in 2026.5.6 (released May 6, 2026, 37 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (67.3K).

OpenClaw < 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash Commands

Affected: fixed in 2026.4.27.

Fixed in 2026.4.27 (released Apr 29, 2026, 44 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (62.3K).

QQBot for OpenClaw < 2026.4.29 - Authorization Bypass via QQBot Streaming Command

Affected: fixed in 2026.4.29.

Fixed in 2026.4.29 (released Apr 30, 2026, 43 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (62.6K).

OpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration

Affected: fixed in 2026.5.18.

Fixed in 2026.5.18 (released May 18, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.5K).

OpenClaw < 2026.5.18 - Arbitrary File Read via Shell Expansion in system.run Safe-bin Allowlist

Affected: fixed in 2026.5.18.

Fixed in 2026.5.18 (released May 18, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.5K).

OpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reload

Affected: fixed in 2026.4.22.

Fixed in 2026.4.22 (released Apr 23, 2026, 50 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.9K).

OpenClaw < 2026.5.18 - Command Truncation in Exec Approval Display

Affected: fixed in 2026.5.18.

Fixed in 2026.5.18 (released May 18, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.5K).

OpenClaw < 2026.5.6 - Native Command Authorization Bypass via Owner-Command Enforcement

Affected: fixed in 2026.5.6.

Fixed in 2026.5.6 (released May 6, 2026, 37 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (67.3K).

OpenClaw < 2026.5.2 - Credential Exposure via Model-Supplied Loopback URLs in message.action Forwarding

Affected: fixed in 2026.5.2.

Fixed in 2026.5.2 (released May 3, 2026, 40 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.3% of openclaw downloads last week were affected versions (63.6K).

OpenClaw < 2026.4.26 - Information Disclosure via Sandboxed Session Spawn

Affected: fixed in 2026.4.26.

Fixed in 2026.4.26 (released Apr 28, 2026, 45 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (60.9K).

OpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write Scope

Affected: fixed in 2026.5.12.

Fixed in 2026.5.12 (released May 14, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.5% of openclaw downloads last week were affected versions (70.1K).

Mattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delay

Affected: fixed in 2026.4.24.

Fixed in 2026.4.24 (released Apr 25, 2026, 48 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (60.3K).

OpenClaw < 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFrom

Affected: fixed in 2026.5.3.

Fixed in 2026.5.3 (released May 4, 2026, 39 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.3% of openclaw downloads last week were affected versions (64.6K).

OpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Execution

Affected: fixed in 2026.5.18.

Fixed in 2026.5.18 (released May 18, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.5K).

OpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocket

Affected: fixed in 2026.5.18.

Fixed in 2026.5.18 (released May 18, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.5K).

OpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session Spawn

Affected: fixed in 2026.5.12.

Fixed in 2026.5.12 (released May 14, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.5% of openclaw downloads last week were affected versions (70.1K).

OpenClaw < 2026.5.27 - Arbitrary Homebrew Executable Execution via Workspace .env Override

Affected: fixed in 2026.5.27.

Fixed in 2026.5.27 (released May 28, 2026, 14 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.7% of openclaw downloads last week were affected versions (76K).

OpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP Loopback

Affected: fixed in 2026.4.24.

Fixed in 2026.4.24 (released Apr 25, 2026, 47 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (60.3K).

OpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing

Affected: fixed in 2026.5.22.

Fixed in 2026.5.22 (released May 24, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (73.7K).

OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node

Affected: fixed in 2026.5.18.

Fixed in 2026.5.18 (released May 18, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.5K).

OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions

Affected: fixed in 2026.5.19.

Fixed in 2026.5.19 (released May 20, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.9K).

OpenClaw < 2026.5.20 - Privilege Escalation via Hook-Triggered CLI MCP Tool Authority

Affected: fixed in 2026.5.20.

Fixed in 2026.5.20 (released May 21, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (73.2K).

OpenClaw < 2026.4.25 - Arbitrary Artifact Loading via Fake Package Root Resolution

Affected: fixed in 2026.4.25.

Fixed in 2026.4.25 (released Apr 27, 2026, 45 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (60.7K).

OpenClaw < 2026.5.18 - Private-Network Navigation Bypass via Browser Act Interactions

Affected: fixed in 2026.5.18.

Fixed in 2026.5.18 (released May 18, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.5K).

OpenClaw < 2026.5.7 - Privilege Escalation via Mutable Display Names in Matrix allowFrom

Affected: fixed in 2026.5.7.

Fixed in 2026.5.7 (released May 7, 2026, 35 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (67.6K).

OpenClaw < 2026.5.18 - Arbitrary Code Execution via Unscanned Marketplace Runtime Extension Metadata

Affected: fixed in 2026.5.18.

Fixed in 2026.5.18 (released May 18, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.5K).

OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy

Affected: fixed in 2026.4.25.

Fixed in 2026.4.25 (released Apr 27, 2026, 45 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (60.7K).

OpenClaw < 2026.5.6 - Approval Policy Bypass in Skill Workshop Apply Flow

Affected: fixed in 2026.5.6.

Fixed in 2026.5.6 (released May 6, 2026, 36 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (67.3K).

OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom

Affected: fixed in 2026.5.6.

Fixed in 2026.5.6 (released May 6, 2026, 36 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (67.3K).

OpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec Revalidation

Affected: fixed in 2026.5.12.

Fixed in 2026.5.12 (released May 14, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.5% of openclaw downloads last week were affected versions (70.1K).

OpenClaw < 2026.5.18 - Scope Bypass via Inherited chat.send Route

Affected: fixed in 2026.5.18.

Fixed in 2026.5.18 (released May 18, 2026, 11 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.5K).

OpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export Routes

Affected: fixed in 2026.4.29.

Fixed in 2026.4.29 (released Apr 30, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (62.6K).

OpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons

Affected: fixed in 2026.5.18.

Fixed in 2026.5.18 (released May 18, 2026, 11 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.6% of openclaw downloads last week were affected versions (72.5K).

OpenClaw < 2026.4.29 - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom Checks

Affected: fixed in 2026.4.29.

Fixed in 2026.4.29 (released Apr 30, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.2% of openclaw downloads last week were affected versions (62.6K).

OpenClaw < 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver Gate

Affected: fixed in 2026.5.12.

Fixed in 2026.5.12 (released May 14, 2026, 15 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.5% of openclaw downloads last week were affected versions (70.1K).

OpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command

Affected: fixed in 2026.5.4.

Fixed in 2026.5.4 (released May 5, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.4% of openclaw downloads last week were affected versions (66.9K).

OpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypass

Affected: fixed in 2026.4.23.

Fixed in 2026.4.23 (released Apr 24, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (60K).

OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation

Affected: fixed in 2026.4.23.

Fixed in 2026.4.23 (released Apr 24, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (60K).

OpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory

Affected: fixed in 2026.4.23.

Fixed in 2026.4.23 (released Apr 24, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (60K).

OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files

Affected: fixed in 2026.4.22.

Fixed in 2026.4.22 (released Apr 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.9K).

OpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template Mapping

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile Creation

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw < 2026.4.20 - Improper Trust Labeling in Isolated Cron Awareness Events

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw < 2026.4.20 - Tool Policy Bypass via Bundled MCP/LSP Tools

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw < 2026.4.22 - Security Envelope Constraint Bypass in ACP Child Sessions

Affected: fixed in 2026.4.22.

Fixed in 2026.4.22 (released Apr 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.9K).

OpenClaw < 2026.4.15 - Arbitrary Local File Read via Webchat Audio Embedding

Affected: fixed in 2026.4.15.

Fixed in 2026.4.15 (released Apr 16, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.8% of openclaw downloads last week were affected versions (51.4K).

OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment Variables

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint

Affected: fixed in 2026.4.22.

Fixed in 2026.4.22 (released Apr 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.9K).

OpenClaw < 2026.4.20 - Direct Message Misclassification in Feishu Card Actions

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw 2026.4.5 through 2026.4.19 - MiniMax API Host Override via Workspace dotenv

Affected: from 2026.4.5, fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.5% of openclaw downloads last week were affected versions (14K).

OpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel Senders

Affected: fixed in 2026.4.21.

Fixed in 2026.4.21 (released Apr 22, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.6K).

OpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token Header

Affected: fixed in 2026.4.22.

Fixed in 2026.4.22 (released Apr 23, 2026, 13 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.9K).

OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 15 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validation

Affected: fixed in 2026.4.22.

Fixed in 2026.4.22 (released Apr 23, 2026, 13 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.9K).

OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlist

Affected: fixed in 2026.4.22.

Fixed in 2026.4.22 (released Apr 23, 2026, 13 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.9K).

OpenClaw < 2026.4.20 - Environment Variable Namespace Collision via Workspace dotenv

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 15 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw < 2026.4.22 - Time-of-Check/Time-of-Use Race Condition in OpenShell FS Bridge

Affected: fixed in 2026.4.22.

Fixed in 2026.4.22 (released Apr 23, 2026, 13 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.9K).

OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes

Affected: fixed in 2026.4.22.

Fixed in 2026.4.22 (released Apr 23, 2026, 13 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.9K).

OpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_get

Affected: fixed in 2026.4.15.

Fixed in 2026.4.15 (released Apr 16, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.8% of openclaw downloads last week were affected versions (51.4K).

OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation

Affected: fixed in 2026.4.15.

Fixed in 2026.4.15 (released Apr 16, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.8% of openclaw downloads last week were affected versions (51.4K).

OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution

Affected: fixed in 2026.4.15.

Fixed in 2026.4.15 (released Apr 16, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.8% of openclaw downloads last week were affected versions (51.4K).

OpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec Policy

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw 2026.4.10 < 2026.4.14 - Loss of Group Tool-Policy Context in Delivery Queue Recovery

Affected: from 2026.4.10, fixed in 2026.4.14.

Fixed in 2026.4.14 (released Apr 14, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (734).

OpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay Binding

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner Downgrade

Affected: from 2026.3.31, fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.3% of openclaw downloads last week were affected versions (8.4K).

OpenClaw < 2026.4.9 - Arbitrary File Read via Browser Interaction Routes

Affected: fixed in 2026.4.9.

Fixed in 2026.4.9 (released Apr 9, 2026, 27 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (45.1K).

OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL

Affected: fixed in 2026.4.5.

Fixed in 2026.4.5 (released Apr 6, 2026, 30 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.4K).

OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route

Affected: from 2026.2.21, fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (29.8K).

OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists

Affected: fixed in 2026.4.12.

Fixed in 2026.4.12 (released Apr 13, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.8% of openclaw downloads last week were affected versions (49.3K).

OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler

Affected: from 2026.4.10, fixed in 2026.4.14.

Fixed in 2026.4.14 (released Apr 14, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (734).

OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling

Affected: from 2026.3.22, fixed in 2026.4.5.

Fixed in 2026.4.5 (released Apr 6, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.4% of openclaw downloads last week were affected versions (11.8K).

OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider Auth

Affected: fixed in 2026.4.9.

Fixed in 2026.4.9 (released Apr 9, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (45.1K).

OpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint

Affected: from 2026.4.5, fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.2% of openclaw downloads last week were affected versions (4.3K).

OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events

Affected: from 2026.4.7, fixed in 2026.4.14.

Fixed in 2026.4.14 (released Apr 14, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.2% of openclaw downloads last week were affected versions (4.8K).

OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches

Affected: fixed in 2026.4.14.

Fixed in 2026.4.14 (released Apr 14, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.8% of openclaw downloads last week were affected versions (49.5K).

OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image

Affected: from 2026.4.7, fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.1% of openclaw downloads last week were affected versions (4K).

OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File

Affected: fixed in 2026.4.9.

Fixed in 2026.4.9 (released Apr 9, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (45.1K).

OpenClaw 2026.2.23 < 2026.4.12 - Weakened Exec Approval Binding via busybox and toybox Applet Execution

Affected: from 2026.2.23, fixed in 2026.4.12.

Fixed in 2026.4.12 (released Apr 13, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (29.8K).

OpenClaw < 2026.4.10 - Time-of-Check-Time-of-Use (TOCTOU) Race Condition in exec Script Preflight Validator

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases

Affected: fixed in 2026.4.14.

Fixed in 2026.4.14 (released Apr 14, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.8% of openclaw downloads last week were affected versions (49.5K).

OpenClaw < 2026.4.14 - Server-Side Request Forgery via Private Network Navigation

Affected: fixed in 2026.4.14.

Fixed in 2026.4.14 (released Apr 14, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.8% of openclaw downloads last week were affected versions (49.5K).

OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling

Affected: fixed in 2026.4.12.

Fixed in 2026.4.12 (released Apr 13, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.8% of openclaw downloads last week were affected versions (49.3K).

OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw 2026.4.9 < 2026.4.10 - Sender Policy Bypass in Host Media Attachment Reads

Affected: from 2026.4.9, fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.1% of openclaw downloads last week were affected versions (3.7K).

OpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime Path

Affected: from 2026.4.9, fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.1% of openclaw downloads last week were affected versions (3.7K).

OpenClaw < 2026.4.14 - Internal Page Content Exposure via Browser Snapshot and Screenshot Routes

Affected: fixed in 2026.4.14.

Fixed in 2026.4.14 (released Apr 14, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.8% of openclaw downloads last week were affected versions (49.5K).

OpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment Injection

Affected: from 2026.2.22, fixed in 2026.4.12.

Fixed in 2026.4.12 (released Apr 13, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30K).

OpenClaw 2026.4.5 < 2026.4.10 - Sandbox Escape via host Parameter Override in Exec Routing

Affected: from 2026.4.5, fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.2% of openclaw downloads last week were affected versions (4.3K).

OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

Affected: fixed in 2026.4.10.

Fixed in 2026.4.10 (released Apr 11, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.7% of openclaw downloads last week were affected versions (48.8K).

OpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypass

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Strict Browser SSRF Bypass via Playwright Redirect Handling

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Privilege Escalation via Gateway Plugin HTTP Authentication

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Remote Code Execution via Build Tool Environment Variable Injection

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Local File Exfiltration via Shared Reply MEDIA Paths

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Improper Base64 Decoding Size Validation

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.4 - Rate-Limit Bypass via Concurrent Async Authentication Attempts

Affected: fixed in 2026.4.4.

Fixed in 2026.4.5 (released Apr 6, 2026, 22 days before disclosure, the advisory names 2026.4.4, which was never published).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.4K).

OpenClaw < 2026.4.8 - Server-Side Request Forgery Policy Bypass via Interaction-Triggered Navigation

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.8 - Missing Owner-Only Enforcement in /allowlist Cross-Channel Writes

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypass

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.4.2 - Timing Side Channel in Shared-Secret Comparison

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Operator Admin Privilege Escalation via Trusted-Proxy Authentication

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-call

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket Upgrades

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 30 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI Bridge

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink Traversal

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust Root

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 30 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Exec Allowlist Bypass via Shell Init-File Options

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL Handling

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 30 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitization

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 36 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 36 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend

Affected: fixed in 2026.3.24.

Fixed in 2026.3.24 (released Mar 25, 2026, 34 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (36.9K).

OpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.31 - Discord Voice Ingress Authorization Bypass via Channel and Role Validation Gaps

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 30 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.28 - Privilege Escalation via chat.send to Admin-Class Talk Voice Config

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 30 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 30 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution Policy

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset Command

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.31 - Path Traversal via Inbound Channel Attachment Path in ACP Dispatch

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 27 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host Execution

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 27 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter Bypass

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions

Affected: from 2026.2.14, fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.5K).

OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 27 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 27 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar Upload

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 27 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter

Affected: from 2026.2.6, fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.1K).

OpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication

Affected: from 2026.2.19, fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 27 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.8% of openclaw downloads last week were affected versions (21.7K).

OpenClaw < 2026.3.28 - SSRF Guard Bypass via IPv6 Special-Use Ranges

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistence

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Context

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.31 - Unsanitized Environment Variable Leakage in SSH Sandbox Backends

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotate

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Arbitrary Code Execution via Mirror Mode Sandbox File Conversion

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 31 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Webhook Replay Detection Bypass via Base64 Signature Re-encoding

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Session Visibility Bypass via session_status in Unsandboxed Invocations

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.31 - Group DM Channel Allowlist Bypass via Discord Slash Commands

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Cross-Site Request Forgery via Missing Browser-Origin Validation in HTTP Operator Endpoints

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcement

Affected: from 2026.2.26, fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.9K).

OpenClaw < 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media Download

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Privilege Escalation via chat.send /verbose Parameter

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Unauthenticated Discovery Endpoint Credential Exfiltration via Remote Onboarding

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord Extension

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect Snapshot

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File Operations

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Arbitrary Hook Code Execution via OPENCLAW_BUNDLED_HOOKS_DIR Environment Variable Override

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard Bypass

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklist

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.4.20 - Improper Authorization in Paired-Device Pairing Actions

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw < 2026.4.20 - Scope Enforcement Bypass in Assistant-Media Route

Affected: fixed in 2026.4.20.

Fixed in 2026.4.20 (released Apr 21, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

2.1% of openclaw downloads last week were affected versions (58.4K).

OpenClaw < 2026.3.31 - Resource Consumption via Unauthorized Telegram Audio Preflight Transcription

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Environment Variable Override via Host Exec Policy

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalation

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commands

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass

Affected: from 2026.3.22, fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.3% of openclaw downloads last week were affected versions (7.7K).

OpenClaw < 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboarding

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guard

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpoint

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirect

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.3.31 - Sandbox Escape via TOCTOU Race in Remote FS Bridge readFile

Affected: fixed in 2026.3.31.

Fixed in 2026.3.31 (released Mar 31, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.4% of openclaw downloads last week were affected versions (40.3K).

OpenClaw < 2026.4.2 - Untrusted Workspace Channel Shadow Code Execution during Built-in Channel Setup

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpoints

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths

Affected: from 2026.4.7, fixed in 2026.4.15.

Fixed in 2026.4.15 (released Apr 16, 2026, 4 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.2% of openclaw downloads last week were affected versions (6.6K).

OpenClaw < 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology Chat

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope

Affected: through 2026.3.24.

Fixed in 2026.3.28 (released Mar 29, 2026, 12 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.24 - Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl Parameters

Affected: fixed in 2026.3.24.

Fixed in 2026.3.24 (released Mar 25, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (36.9K).

OpenClaw < 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.ts

Affected: fixed in 2026.3.24.

Fixed in 2026.3.24 (released Mar 25, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (36.9K).

OpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch Wrapper

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing

Affected: fixed in 2026.3.24.

Fixed in 2026.3.24 (released Mar 25, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (36.9K).

OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 12 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim

Affected: through 2026.3.24.

Fixed in 2026.3.28 (released Mar 29, 2026, 12 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send Action

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 12 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset

Affected: fixed in 2026.3.23.

Fixed in 2026.3.23 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (34.7K).

OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool

Affected: fixed in 2026.3.2.

Fixed in 2026.3.2 (released Mar 3, 2026, 38 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.9K).

OpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route

Affected: fixed in 2026.3.25.

Fixed in 2026.3.28 (released Mar 29, 2026, 12 days before disclosure, the advisory names 2026.3.25, which was never published).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate Limiter

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 12 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.request

Affected: fixed in 2026.3.24.

Fixed in 2026.3.24 (released Mar 25, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (36.9K).

OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval Prompt

Affected: from 2026.2.13, fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 12 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.7K).

OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitization

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification Notices

Affected: through 2026.3.24.

Fixed in 2026.3.28 (released Mar 29, 2026, 12 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation

Affected: fixed in 2026.3.24.

Fixed in 2026.3.24 (released Mar 25, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (36.9K).

OpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence

Affected: fixed in 2026.3.24.

Fixed in 2026.3.24 (released Mar 25, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (36.9K).

OpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commands

Affected: fixed in 2026.3.24.

Fixed in 2026.3.24 (released Mar 25, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (36.9K).

OpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint

Affected: fixed in 2026.3.24.

Fixed in 2026.3.24 (released Mar 25, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (36.9K).

OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass

Affected: through 2026.3.24.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request Parsing

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UI

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution

Affected: from 2026.3.11, fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.3% of openclaw downloads last week were affected versions (7.2K).

OpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway

Affected: fixed in 2026.3.23.

Fixed in 2026.3.23 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (34.7K).

OpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responses

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update

Affected: through 2026.2.22.

Fixed in 2026.2.23 (released Feb 24, 2026, 44 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.4K).

OpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat Commands

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.25 - Server-Side Request Forgery via Unguarded Configured Base URLs in Channel Extensions

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting

Affected: through 2026.3.24.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM Handling

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect

Affected: through 2026.3.24.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limiting

Affected: through 2026.3.24.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat Webhook

Affected: fixed in 2026.3.22.

Fixed in 2026.3.22 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (32.6K).

OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification

Affected: fixed in 2026.3.23.

Fixed in 2026.3.23 (released Mar 23, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.2% of openclaw downloads last week were affected versions (34.7K).

OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint

Affected: through 2026.3.24.

Fixed in 2026.3.28 (released Mar 29, 2026, 11 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects

Affected: fixed in 2026.4.8.

Fixed in 2026.4.8 (released Apr 8, 2026, the day of disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (44.8K).

OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, 1 day before disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw - Approval Bypass via Environment Variable Normalization

Affected: fixed in 2026.3.22; fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, the day of disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw - Shell-Bleed Protection Preflight Validation Bypass

Affected: fixed in 2026.4.2.

Fixed in 2026.4.2 (released Apr 2, 2026, the day of disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders

Affected: fixed in 2026.4.2; fixed in 2026.3.22.

Fixed in 2026.4.2 (released Apr 2, 2026, 1 day after disclosure).

The latest release, 2026.11.1, is not affected.

1.6% of openclaw downloads last week were affected versions (43.9K).

OpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Provider

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters

Affected: fixed in 2026.3.24.

Fixed in 2026.3.24 (released Mar 25, 2026, 6 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (36.9K).

OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel

Affected: fixed in 2026.3.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration

Affected: fixed in 2026.3.8.

Fixed in 2026.3.8 (released Mar 9, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (29.8K).

OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation

Affected: fixed in 2026.3.12.

Fixed in 2026.3.12 (released Mar 13, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.6K).

OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unvalidated Temporary File Creation

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.13 - Telegram Bot Token Exposure in Media Fetch Error Logs

Affected: fixed in 2026.3.13.

Fixed in 2026.3.13 (released Mar 14, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.8K).

OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.11 - Node-Host Approval UI Mismatch Allows Execution of Unintended Commands

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.11 - Credential Fallback Logic Bypass via Unavailable Local Auth SecretRefs

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run

Affected: fixed in 2026.3.8.

Fixed in 2026.3.8 (released Mar 9, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (29.8K).

OpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace Plugins

Affected: fixed in 2026.3.12.

Fixed in 2026.3.12 (released Mar 13, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.6K).

OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP

Affected: fixed in 2026.3.13.

Fixed in 2026.3.13 (released Mar 14, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.8K).

OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes

Affected: from 2026.3.7, fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (661).

OpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes

Affected: fixed in 2026.3.12.

Fixed in 2026.3.12 (released Mar 13, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.6K).

OpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download

Affected: fixed in 2026.3.8.

Fixed in 2026.3.8 (released Mar 9, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (29.8K).

OpenClaw < 2026.3.11 - Workspace Boundary Bypass via Agent RPC Parameters

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript Files

Affected: fixed in 2026.2.17.

Fixed in 2026.2.17 (released Feb 18, 2026, 39 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (18.2K).

OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing

Affected: fixed in 2026.3.13.

Fixed in 2026.3.13 (released Mar 14, 2026, 15 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.8K).

OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request

Affected: fixed in 2026.3.13.

Fixed in 2026.3.13 (released Mar 14, 2026, 15 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.8K).

OpenClaw < 2026.3.11 - Unbound Interpreter and Runtime Commands Bypass in node-host Approval

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist

Affected: fixed in 2026.3.12.

Fixed in 2026.3.12 (released Mar 13, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.6K).

OpenClaw < 2026.3.12 - Forged Event Injection via Feishu Webhook Verification Token

Affected: fixed in 2026.3.12.

Fixed in 2026.3.12 (released Mar 13, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.6K).

OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.11 - Authorization Bypass in Browser Profile Management via browser.request

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in Feishu

Affected: fixed in 2026.3.12.

Fixed in 2026.3.12 (released Mar 13, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.6K).

OpenClaw < 2026.3.11 - Authorization Bypass in Discord Guild Reaction Allowlist Enforcement

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash Commands

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Subagent Control Surface

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug Endpoints

Affected: fixed in 2026.3.12.

Fixed in 2026.3.12 (released Mar 13, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.6K).

OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read

Affected: fixed in 2026.3.28; fixed in 2026.03.28.

Fixed in 2026.3.28 (released Mar 29, 2026, 3 days after disclosure).

The latest release, 2026.11.1, is not affected.

1.3% of openclaw downloads last week were affected versions (37.4K).

OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects

Affected: fixed in 2026.3.7.

Fixed in 2026.3.7 (released Mar 8, 2026, 15 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (29.6K).

OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command

Affected: fixed in 2026.3.7.

Fixed in 2026.3.7 (released Mar 8, 2026, 15 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (29.6K).

OpenClaw < 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatch

Affected: fixed in 2026.3.7.

Fixed in 2026.3.7 (released Mar 8, 2026, 15 days before disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (29.6K).

OpenClaw < 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event Handlers

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata

Affected: fixed in 2026.2.23.

Fixed in 2026.2.23 (released Feb 24, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.5K).

OpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallback

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin

Affected: fixed in 2026.2.21.

Fixed in 2026.2.21 (released Feb 21, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19K).

OpenClaw < 2026.2.26 - Sender Authorization Bypass in Slack System Event Handlers

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.2.26 - Cross-Account Authorization Bypass in DM Pairing Store

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command Execution

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer

Affected: fixed in 2026.2.21.

Fixed in 2026.2.21 (released Feb 21, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19K).

OpenClaw < 2026.2.26 - Approval Context-Binding Weakness in system.run via host=node

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id Parameter

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.26 - Workspace Path Boundary Bypass via Non-existent Symlink

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path Handling

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalization

Affected: fixed in 2026.2.23.

Fixed in 2026.2.23 (released Feb 24, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.5K).

OpenClaw < 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv Carriers

Affected: fixed in 2026.2.24.

Fixed in 2026.2.24 (released Feb 25, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.6K).

OpenClaw < 2026.3.1 - Authorization Bypass in Agent Runs via Owner-Only Tool Access

Affected: fixed in 2026.3.1.

Fixed in 2026.3.1 (released Mar 2, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.6K).

OpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check Bypass

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn

Affected: fixed in 2026.3.1.

Fixed in 2026.3.1 (released Mar 2, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.6K).

OpenClaw < 2026.2.21 - OS-level Sandbox Bypass via --no-sandbox Flag

Affected: fixed in 2026.2.21.

Fixed in 2026.2.21 (released Feb 21, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19K).

OpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale Auth

Affected: fixed in 2026.2.21.

Fixed in 2026.2.21 (released Feb 21, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19K).

OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installation

Affected: fixed in 2026.3.2.

Fixed in 2026.3.2 (released Mar 3, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.9K).

OpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway Authentication

Affected: from 2026.2.22, fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (715).

OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap

Affected: fixed in 2026.3.1.

Fixed in 2026.3.1 (released Mar 2, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.6K).

OpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL Interpolation

Affected: fixed in 2026.2.23.

Fixed in 2026.2.23 (released Feb 24, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.5K).

OpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter

Affected: fixed in 2026.2.24.

Fixed in 2026.2.24 (released Feb 25, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.6K).

OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript Handler

Affected: fixed in 2026.3.2.

Fixed in 2026.3.2 (released Mar 3, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.9K).

OpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP

Affected: fixed in 2026.2.21.

Fixed in 2026.2.21 (released Feb 21, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19K).

OpenClaw < 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validation

Affected: fixed in 2026.2.24.

Fixed in 2026.2.24 (released Feb 25, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.6K).

OpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variable

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.26 - Authentication Bypass via Path Canonicalization Mismatch in /api/channels Gateway

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.2.19 - Sensitive File Disclosure via stageSandboxMedia Path Traversal

Affected: fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (18.6K).

OpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing

Affected: fixed in 2026.2.21.

Fixed in 2026.2.21 (released Feb 21, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19K).

OpenClaw < 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingress

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.2.26 - Improper Authorization via DM Pairing Store Identity Inheritance in Group Allowlist

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.2.24 - Arbitrary File Read via Improper Temporary Path Validation in Sandbox

Affected: fixed in 2026.2.24.

Fixed in 2026.2.24 (released Feb 25, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.6K).

OpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypass

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.2.22 - Symlink Traversal in Avatar Handling

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.24 - Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in system.run

Affected: fixed in 2026.2.24.

Fixed in 2026.2.24 (released Feb 25, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.6K).

OpenClaw < 2026.2.21 - Arbitrary File Read via grep -e Flag Policy Bypass

Affected: fixed in 2026.2.21.

Fixed in 2026.2.21 (released Feb 21, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19K).

OpenClaw < 2026.2.22 - Authorization Bypass via Display Name Collision in Feishu allowFrom

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guard

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operations

Affected: fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (18.6K).

OpenClaw < 2026.2.19 - Arbitrary File Write via Short-Option Bypass in exec Allowlist

Affected: fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (18.6K).

OpenClaw < 2026.2.22 - Path Traversal via Basename-Only Allowlist Matching on macOS

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw 2026.1.21 < 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Validation

Affected: from 2026.1.21, fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.1% of openclaw downloads last week were affected versions (3.2K).

OpenClaw < 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform Fields

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.3.2 - Slow-Request Denial of Service via Pre-Auth Webhook Body Parsing

Affected: fixed in 2026.3.2.

Fixed in 2026.3.2 (released Mar 3, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.9K).

OpenClaw < 2026.2.22 - Allowlist Bypass via sort --compress-program Parameter

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.24 - Binary Hijacking via Static Default Trusted Directories in safeBins

Affected: fixed in 2026.2.24.

Fixed in 2026.2.24 (released Feb 25, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.6K).

OpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard

Affected: fixed in 2026.2.21.

Fixed in 2026.2.21 (released Feb 21, 2026, 26 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19K).

OpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass

Affected: fixed in 2026.2.23.

Fixed in 2026.2.23 (released Feb 24, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.5K).

OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Fallback in Group Allowlist

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.2.25 - Authorization Bypass in Interactive Callbacks via Sender Check Skip

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.3.2 - Authentication Bypass via Encoded Path in /api/channels Route

Affected: fixed in 2026.3.2.

Fixed in 2026.3.2 (released Mar 3, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.9K).

OpenClaw < 2026.2.22 - Remote Code Execution via SHELLOPTS/PS4 Environment Injection in system.run

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.23 - Sandbox Boundary Bypass via Image Tool workspaceOnly Bypass

Affected: fixed in 2026.2.23.

Fixed in 2026.2.23 (released Feb 24, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.5K).

OpenClaw < 2026.2.22 - Node Role Device-Identity Bypass via WebSocket Authentication

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution

Affected: fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (18.6K).

OpenClaw 2026.2.26 < 2026.3.1 - Current Working Directory Injection via Windows Wrapper Resolution Fallback

Affected: from 2026.2.26, fixed in 2026.3.1.

Fixed in 2026.3.1 (released Mar 2, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (217).

OpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIds

Affected: from 2026.2.22, fixed in 2026.2.24.

Fixed in 2026.2.24 (released Feb 25, 2026, 22 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (326).

OpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals

Affected: fixed in 2026.3.1.

Fixed in 2026.3.1 (released Mar 2, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.6K).

OpenClaw < 2026.2.19 - safeBins stdin-only bypass via sort output and recursive grep flags

Affected: fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (18.6K).

OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension

Affected: from 2026.1.21, fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.1% of openclaw downloads last week were affected versions (3.2K).

OpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generation

Affected: fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 28 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (18.6K).

OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S

Affected: fixed in 2026.2.23.

Fixed in 2026.2.23 (released Feb 24, 2026, 23 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.5K).

OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination

Affected: fixed in 2026.3.2.

Fixed in 2026.3.2 (released Mar 3, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.9K).

OpenClaw < 2026.3.1 - Server-Side Request Forgery via web_search Citation Redirect

Affected: fixed in 2026.3.1.

Fixed in 2026.3.1 (released Mar 2, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.6K).

OpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting

Affected: from 2026.3.1, fixed in 2026.3.2.

Fixed in 2026.3.2 (released Mar 3, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (244).

OpenClaw < 2026.2.22 - Authorization Bypass via allow-always Wrapper Persistence

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn

Affected: fixed in 2026.3.1.

Fixed in 2026.3.1 (released Mar 2, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.6K).

OpenClaw < 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution in system.run

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression

Affected: fixed in 2026.2.25.

Fixed in 2026.2.25 (released Feb 26, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20K).

OpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition

Affected: fixed in 2026.3.2.

Fixed in 2026.3.2 (released Mar 3, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.9K).

OpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind

Affected: fixed in 2026.2.26.

Fixed in 2026.2.26 (released Feb 26, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (20.4K).

OpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Path

Affected: fixed in 2026.2.21.

Fixed in 2026.2.21 (released Feb 21, 2026, 25 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19K).

OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths

Affected: fixed in 2026.2.24.

Fixed in 2026.2.24 (released Feb 25, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.6K).

OpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions

Affected: fixed in 2026.2.24.

Fixed in 2026.2.24 (released Feb 25, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.6K).

OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode

Affected: fixed in 2026.3.11.

Fixed in 2026.3.11 (released Mar 12, 2026, the day of disclosure).

The latest release, 2026.11.1, is not affected.

1.1% of openclaw downloads last week were affected versions (30.2K).

OpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit Generation

Affected: fixed in 2026.2.21.

Fixed in 2026.2.21 (released Feb 21, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19K).

OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream

Affected: fixed in 2026.2.22.

Fixed in 2026.2.22 (released Feb 23, 2026, 16 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.3K).

OpenClaw < 2026.2.17 - Arbitrary File Read via $include Directive Path Traversal

Affected: fixed in 2026.2.17.

Fixed in 2026.2.17 (released Feb 18, 2026, 21 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (18.2K).

OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 24 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBins

Affected: fixed in 2026.2.23.

Fixed in 2026.2.23 (released Feb 24, 2026, 15 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.5K).

OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust

Affected: fixed in 2026.2.12.

Fixed in 2026.2.12 (released Feb 13, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.6K).

OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media Handling

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH Handling

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibility

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation Commands

Affected: from 2026.1.16-2, fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (2.5K).

OpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parameters

Affected: fixed in 2026.2.12.

Fixed in 2026.2.12 (released Feb 13, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.6K).

OpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matching

Affected: fixed in 2026.2.1.

Fixed in 2026.2.1 (released Feb 2, 2026, 31 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (16.3K).

OpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration

Affected: fixed in 2026.2.15.

Fixed in 2026.2.15 (released Feb 16, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (18K).

OpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering

Affected: fixed in 2026.2.13.

Fixed in 2026.2.13 (released Feb 14, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.8K).

OpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flow

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.14 - Server-Side Request Forgery in Tlon Extension Authentication

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.13 - Timing Attack via Hook Token Comparison

Affected: fixed in 2026.2.13.

Fixed in 2026.2.13 (released Feb 14, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.8K).

OpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Command

Affected: fixed in 2026.2.2.

Fixed in 2026.2.2 (released Feb 4, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (16.8K).

OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake

Affected: fixed in 2026.2.2.

Fixed in 2026.2.2 (released Feb 4, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (16.8K).

OpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix Plugin

Affected: from 2026.1.14-1, fixed in 2026.2.2.

Fixed in 2026.2.2 (released Feb 4, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (1.5K).

OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes

Affected: fixed in 2026.2.2.

Fixed in 2026.2.2 (released Feb 4, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (16.8K).

OpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw 2026.1.29-beta.1 < 2026.2.14 - Authentication Bypass in Sandbox Browser Bridge Server

Affected: from 2026.1.29-beta.1, fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (2.5K).

OpenClaw < 2026.2.2 - SSRF via Attachment Media URL Hydration

Affected: fixed in 2026.2.2.

Fixed in 2026.2.2 (released Feb 4, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (16.8K).

OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.12 - Timing Attack in Hooks Token Authentication

Affected: fixed in 2026.2.12.

Fixed in 2026.2.12 (released Feb 13, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.6K).

OpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlist

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths

Affected: fixed in 2026.2.13.

Fixed in 2026.2.13 (released Feb 14, 2026, 19 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.8K).

OpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Path

Affected: fixed in 2026.2.12.

Fixed in 2026.2.12 (released Feb 13, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.6K).

OpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket Endpoint

Affected: from 2026.1.20, fixed in 2026.2.1.

Fixed in 2026.2.1 (released Feb 2, 2026, 31 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (867).

OpenClaw < 2026.2.14 - Path Traversal in Sandbox Skill Mirroring via Name Parameter

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling

Affected: from 2026.1.5, fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (2.5K).

OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook

Affected: fixed in 2026.2.1.

Fixed in 2026.2.1 (released Feb 2, 2026, 31 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (16.3K).

OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive Extraction

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.14 - SSRF via Feishu Extension Media Fetching

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints

Affected: fixed in 2026.2.12.

Fixed in 2026.2.12 (released Feb 13, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.6K).

OpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control

Affected: from 2026.1.29, fixed in 2026.2.1.

Fixed in 2026.2.1 (released Feb 2, 2026, 31 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (409).

OpenClaw 2026.1.29-beta.1 < 2026.2.1 - Path Traversal in Plugin Installation via Package Name

Affected: from 2026.1.20, fixed in 2026.2.1.

Fixed in 2026.2.1 (released Feb 2, 2026, 31 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (867).

OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching

Affected: fixed in 2026.2.2.

Fixed in 2026.2.2 (released Feb 4, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (16.8K).

OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl

Affected: from 2026.1.14-1, fixed in 2026.2.12.

Fixed in 2026.2.12 (released Feb 13, 2026, 20 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (2.2K).

OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool

Affected: fixed in 2026.2.15.

Fixed in 2026.2.15 (released Feb 16, 2026, 17 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (18K).

OpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path Traversal

Affected: from 2.0.0-beta3, fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

<0.1% of openclaw downloads last week were affected versions (2.5K).

OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 18 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement

Affected: fixed in 2026.2.2.

Fixed in 2026.2.2 (released Feb 4, 2026, 29 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (16.8K).

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as…

Affected: fixed in 2026.2.23.

Fixed in 2026.2.23 (released Feb 24, 2026, 3 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (19.5K).

OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs

Affected: fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (18.6K).

OpenClaw hardened cron webhook delivery against SSRF

Affected: fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (18.6K).

OpenClaw: Prevent shell injection in macOS keychain credential write

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 6 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup

Affected: fixed in 2026.2.14.

Fixed in 2026.2.14 (released Feb 15, 2026, 6 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (17.9K).

OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

Affected: fixed in 2026.2.19.

Fixed in 2026.2.19 (released Feb 19, 2026, 2 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (18.6K).

OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows

Affected: fixed in 2026.2.18.

Fixed in 2026.2.19 (released Feb 19, 2026, 2 days before disclosure, the advisory names 2026.2.18, which was never published).

The latest release, 2026.11.1, is not affected.

0.7% of openclaw downloads last week were affected versions (18.5K).

OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

Affected: fixed in 2026.2.15.

Fixed in 2026.2.15 (released Feb 16, 2026, 3 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (18K).

OpenClaw hardened the skill download target directory validation

Affected: fixed in 2026.2.15.

Fixed in 2026.2.15 (released Feb 16, 2026, 3 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (18K).

OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation

Affected: fixed in 2026.2.15.

Fixed in 2026.2.15 (released Feb 16, 2026, 3 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (18K).

OpenClaw session tool visibility hardening and Telegram webhook secret fallback

Affected: fixed in 2026.2.15.

Fixed in 2026.2.15 (released Feb 16, 2026, 3 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (18K).

OpenClaw: Telegram bot token exposure via logs

Affected: fixed in 2026.2.15.

Fixed in 2026.2.15 (released Feb 16, 2026, 3 days before disclosure).

The latest release, 2026.11.1, is not affected.

0.6% of openclaw downloads last week were affected versions (18K).