Security advisories

high2026-04-01

OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`

openclaw/openclaw · GHSA-5r8f-96gm-5j6g

medium2026-04-01

CVE-2026-33577-OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

openclaw/openclaw · GHSA-2x4x-cc5g-qmmg

high2026-03-31

CVE-2026-41390-OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper

openclaw/openclaw · GHSA-6pfc-6m7w-m8fx

high2026-03-31

CVE-2026-41387-OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

openclaw/openclaw · GHSA-j7p2-qcwm-94v4

medium2026-03-31

CVE-2026-33580-OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication

openclaw/openclaw · GHSA-9528-x887-j2fp

low2026-03-31

OpenClaw SSRF guard misses four IPv6 special-use ranges

openclaw/openclaw · GHSA-g86v-f9qv-rh6m

medium2026-03-31

OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement

openclaw/openclaw · GHSA-jp4j-q5fc-58gv

high2026-03-31

CVE-2026-41299-OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing

openclaw/openclaw · GHSA-6xg4-82hv-cp6f

medium2026-03-31

CVE-2026-41344-OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose`

openclaw/openclaw · GHSA-5h2w-qmfp-ggp6

medium2026-03-31

CVE-2026-41332-OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

openclaw/openclaw · GHSA-m866-6qv5-p2fg

high2026-03-31

OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure

openclaw/openclaw · GHSA-jccr-rrw2-vc8h

high2026-03-31

CVE-2026-33581-OpenClaw's message tool media parameter bypasses tool policy filesystem isolation

openclaw/openclaw · GHSA-v8wv-jg3q-qwpq

medium2026-03-31

CVE-2026-41399-OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades

openclaw/openclaw · GHSA-f44p-c7w9-7xr7

medium2026-03-31

CVE-2026-41363-OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image

openclaw/openclaw · GHSA-qf48-qfv4-jjm9

high2026-03-31

CVE-2026-41303-OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals

openclaw/openclaw · GHSA-98hh-7ghg-x6rq

high2026-03-31

CVE-2026-34503-OpenClaw's device removal and token revocation do not terminate active WebSocket sessions

openclaw/openclaw · GHSA-2pr2-hcv6-7gwv

high2026-03-31

CVE-2026-41342-OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

openclaw/openclaw · GHSA-3cw3-5vxw-g2h3

medium2026-03-31

CVE-2026-33576-OpenClaw: Zalo channel downloads media before sender authorization

openclaw/openclaw · GHSA-v2v2-f783-358j

critical2026-03-31

CVE-2026-33579-OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

openclaw/openclaw · GHSA-hc5h-pmr3-3497

high2026-03-31

CVE-2026-41395-OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering

openclaw/openclaw · GHSA-8689-gm9g-jgr6