Security advisories

high2026-07-02

OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

openclaw/openclaw · GHSA-w5ww-7chg-mxcq

medium2026-07-02

CVE-2026-50185-Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set

rustcrypto/utils · GHSA-3rjw-m598-pq24

medium2026-07-02

CVE-2026-50149-Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

projectcontour/contour · GHSA-g3xr-5w5j-w4q4

high2026-07-02

CVE-2026-53811-OpenClaw: Matrix allowFrom could bind to mutable display names

openclaw/openclaw · GHSA-7hxm-f538-3xp6

medium2026-07-02

OpenClaw: Mattermost slash token revocation could lag until monitor refresh

openclaw/openclaw · GHSA-4m3v-q747-pc6h

high2026-07-02

CVE-2026-53816-OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

openclaw/openclaw · GHSA-3c6j-hq33-3jv4

high2026-07-02

CVE-2026-53806-OpenClaw: Combined POSIX shell options could confuse exec revalidation

openclaw/openclaw · GHSA-vxx3-6hc9-7cc3

medium2026-07-02

CVE-2026-53818-OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

openclaw/openclaw · GHSA-rj6p-xmxr-qj4h

medium2026-07-02

CVE-2026-53830-OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

openclaw/openclaw · GHSA-275c-xpvc-jgfw

low2026-07-02

OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement

openclaw/openclaw · GHSA-3wqp-prf6-2m72

medium2026-07-02

OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts

openclaw/openclaw · GHSA-6c4r-g249-wv3c

medium2026-07-02

CVE-2026-53809-OpenClaw: Embedded runner policy could be confused by provider aliases

openclaw/openclaw · GHSA-p39j-x9h5-q66m

high2026-07-02

CVE-2026-53813-OpenClaw: Fake package roots could influence memory-core artifact loading

openclaw/openclaw · GHSA-v8cx-933x-r976

high2026-07-02

CVE-2026-53819-OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

openclaw/openclaw · GHSA-8wg3-5mcm-fjq8

high2026-07-02

CVE-2026-53834-OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks

openclaw/openclaw · GHSA-77pv-3w4q-vrj5

high2026-07-02

OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes

openclaw/openclaw · GHSA-xr4f-mjxj-w6w5

medium2026-07-02

OpenClaw: Browser debug/export routes could reuse already-open blocked tabs

openclaw/openclaw · GHSA-hcm3-8f6r-6xwg

medium2026-07-02

OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

openclaw/openclaw · GHSA-grc3-2j34-p6gm

critical2026-07-02

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

openclaw/openclaw · GHSA-w4v6-g3wm-w36c

medium2026-07-02

CVE-2026-53837-OpenClaw: Mattermost handlers could fall open when channel type was missing

openclaw/openclaw · GHSA-gp79-m99v-gjmh