Security advisories

medium2026-03-03

CVE-2026-32017-OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write

openclaw/openclaw · GHSA-3x3x-h76w-hp98

medium2026-03-03

OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint

openclaw/openclaw · GHSA-pfv7-rr5m-qmv6

high2026-03-03

CVE-2026-32059-OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode

openclaw/openclaw · GHSA-3c6h-g97w-fg78

medium2026-03-03

CVE-2026-32021-OpenClaw has a Feishu allowFrom authorization bypass via display-name collision

openclaw/openclaw · GHSA-j4xf-96qf-rx69

high2026-03-03

CVE-2026-22179-OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution

openclaw/openclaw · GHSA-9p38-94jf-hgjj

medium2026-03-03

OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths

openclaw/openclaw · GHSA-5h2c-8v84-qpvr

medium2026-03-03

OpenClaw plugin runtime command execution is part of trusted plugin boundary

openclaw/openclaw · GHSA-ff98-w8hj-qrxf

medium2026-03-03

OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth

openclaw/openclaw · GHSA-553v-f69r-656j

medium2026-03-03

CVE-2026-32008-OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files

openclaw/openclaw · GHSA-45cg-2683-gfmq

high2026-03-03

CVE-2026-31994-OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling

openclaw/openclaw · GHSA-mqr9-vqhq-3jxw

high2026-03-03

CVE-2026-32007-OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)

openclaw/openclaw · GHSA-h9xm-j4qg-fvpg

medium2026-03-03

OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption

openclaw/openclaw · GHSA-j26j-7qc4-3mrf

medium2026-03-03

OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows

openclaw/openclaw · GHSA-2hm8-rqrm-xfjq

medium2026-03-03

CVE-2026-22217-OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

openclaw/openclaw · GHSA-p4wh-cr8m-gm6c

medium2026-03-03

CVE-2026-32896-OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)

openclaw/openclaw · GHSA-5mx2-2mgw-x8rm

medium2026-03-03

OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)

openclaw/openclaw · GHSA-2mc2-g238-722j

high2026-03-03

CVE-2026-32009-OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)

openclaw/openclaw · GHSA-5gj7-jf77-q2q2

medium2026-03-03

OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)

openclaw/openclaw · GHSA-77hf-7fqf-f227

medium2026-03-03

CVE-2026-32035-OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels

openclaw/openclaw · GHSA-wpg9-4g4v-f9rc

high2026-03-03

OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization

openclaw/openclaw · GHSA-474h-prjg-mmw3