npm / openclaw

OpenClaw's andbox browser noVNC observer lacked VNC authentication

Modified: 3/30/2026

OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallback

Modified: 3/30/2026

OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths

Modified: 5/6/2026

OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes

Modified: 5/8/2026

OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

Modified: 3/25/2026

OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots

Modified: 3/4/2026

OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From

Modified: 3/4/2026

OpenClaw: busybox and toybox applet execution weakened exec approval binding

Modified: 5/8/2026

OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

Modified: 5/6/2026

OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)

Modified: 3/30/2026

OpenClaw validates Zalo outbound photo URLs through the SSRF guard

Modified: 5/12/2026

OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows

Modified: 3/4/2026

OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)

Modified: 3/4/2026

OpenClaw's device removal and token revocation do not terminate active WebSocket sessions

Modified: 4/6/2026

OpenClaw: Unsanitized CWD path injection into LLM prompts

Modified: 2/20/2026

OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

Modified: 4/20/2026

OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions

Modified: 3/25/2026

OpenClaw: Gateway `agent` calls could override the workspace boundary

Modified: 3/14/2026

OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)

Modified: 5/6/2026

OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation

Modified: 3/30/2026

OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

Modified: 4/6/2026

OpenClaw: Hook mapping templates could bypass hook session-key opt-in

Modified: 5/19/2026

OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`

Modified: 4/10/2026

Temporary path handling could write outside OpenClaw temp boundary

Modified: 3/20/2026

OpenClaw Twitch allowFrom is not enforced in optional plugin, unauthorized chat users can trigger agent pipeline

Modified: 3/13/2026

OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups

Modified: 3/20/2026

OpenClaw contains a symlink traversal vulnerability

Modified: 5/8/2026

OpenClaw has browser trace/download path symlink escape in temp output handling

Modified: 3/27/2026

OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

Modified: 2/20/2026

OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding

Modified: 5/6/2026

OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists

Modified: 3/4/2026

OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy

Modified: 4/10/2026

OpenClaw has Inconsistent Host Exec Environment Override Sanitization

Modified: 4/10/2026

OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode

Modified: 3/13/2026

OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access

Modified: 3/25/2026

OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

Modified: 5/8/2026

OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints

Modified: 2/20/2026

OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths

Modified: 4/28/2026

OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers

Modified: 3/9/2026

OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

Modified: 4/10/2026

OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes

Modified: 3/6/2026

OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations

Modified: 3/4/2026

OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config

Modified: 4/28/2026

OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows

Modified: 3/18/2026

OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send

Modified: 4/28/2026

OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

Modified: 5/6/2026

OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification

Modified: 5/6/2026

OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement

Modified: 3/26/2026

OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write

Modified: 3/30/2026

OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)

Modified: 6/8/2026

OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled

Modified: 5/6/2026

OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

Modified: 5/6/2026

OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container

Modified: 3/30/2026

OpenClaw: Prevent shell injection in macOS keychain credential write

Modified: 2/23/2026

OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files

Modified: 4/2/2026

OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags

Modified: 3/19/2026

OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization

Modified: 3/4/2026

OpenClaw: Config writes could persist resolved ${VAR} secrets to disk

Modified: 3/6/2026

OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths

Modified: 3/26/2026

OpenClaw has allowlist exec-guard bypass via env -S

Modified: 3/20/2026

OpenClaw: Empty approver lists could grant explicit approval authorization

Modified: 5/8/2026

OpenClaw has a Discord `allowFrom` slug-collision authorization bypass

Modified: 3/4/2026

OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`

Modified: 6/8/2026

OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk

Modified: 5/6/2026

In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program

Modified: 3/30/2026

OpenClaw is Missing Webhook Authentication in Telnyx Provider Allows Unauthenticated Requests

Modified: 2/20/2026

OpenClaw has ACP CLI approval prompt ANSI escape sequence injection

Modified: 5/5/2026

OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE

Modified: 3/14/2026

OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch

Modified: 4/28/2026

OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure

Modified: 4/10/2026

OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching)

Modified: 3/13/2026

OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard

Modified: 5/5/2026

OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries

Modified: 3/14/2026

OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0

Modified: 4/17/2026

OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement

Modified: 5/8/2026

OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Modified: 4/18/2026

OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts

Modified: 4/10/2026

OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch

Modified: 3/4/2026

OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage

Modified: 5/12/2026

OpenClaw: Browser SSRF policy default allowed private-network navigation

Modified: 5/8/2026

OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth

Modified: 4/2/2026

OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

Modified: 5/19/2026

OpenClaw affected by SSRF in Image Tool Remote Fetch

Modified: 2/22/2026

OpenClaw vulnerable to arbitrary file read via $include directive

Modified: 3/13/2026

OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration

Modified: 4/3/2026

OpenClaw: Isolated cron awareness events were recorded as trusted system events

Modified: 5/19/2026

OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants

Modified: 3/4/2026

OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read

Modified: 4/3/2026

OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains

Modified: 3/19/2026

OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)

Modified: 4/28/2026

OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read

Modified: 3/19/2026

OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)

Modified: 3/30/2026

OpenClaw: Memory dreaming config persistence was reachable from operator.write commands

Modified: 5/5/2026

OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths

Modified: 3/4/2026

OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose`

Modified: 5/8/2026

OpenClaw: Existing WS sessions survive shared gateway token rotation

Modified: 4/28/2026

OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

Modified: 5/12/2026

OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

Modified: 5/5/2026

OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope

Modified: 4/10/2026

OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

Modified: 4/6/2026