OpenClaw: Zip extraction symlink traversal could write outside destination
### Summary
A path confinement bypass in OpenClaw ZIP extraction allowed writes outside the intended destination when a pre-existing symlink was present under the extraction root.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version at triage time: `2026.2.21-2`
- Affected versions: `<= 2026.2.21-2`
- Planned patched version for next release: `2026.2.22`
### Technical Details
The vulnerable path was in `src/infra/archive.ts` ZIP extraction logic. Output-path checks were lexical, but writes could still traverse an existing symlink in destination path segments.
The fix blocks this by:
- rejecting symlin
### Summary
When `tools.exec.safeBins` contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries (for example `python3`, `node`, `ruby`) execute inline payloads via flags like `-c`.
This requires explicit operator configuration to add such binaries to `safeBins`, so impact is limited to non-default/misconfigured deployments.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21-2`
- Patched in code: `>= 2026.2.22` (planned next npm release)
### Fix
- Remove generic safe-bin fallback duri
## Vulnerability
Webhook transform modules were validated with lexical path checks only. A symlink under the allowed hooks transform tree could resolve outside the intended directory and be dynamically imported.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21-2`
- Patched version (planned next release): `2026.2.22`
## Impact
When an attacker can cause a transform module path to reference a symlinked entry that resolves outside the trusted transform directory, the gateway may import and execute unintended JavaScript with gateway-process privileges.
## Attack Preconditions
- Hook transforms
OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity
### Summary
The voice-call Twilio webhook path accepted replay/dedupe identity from unsigned request metadata (`i-twilio-idempotency-token`), enabling replayed signed requests to bypass replay detection and manager dedupe by mutating only that header.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.25` (latest published npm version at triage time)
- Fixed on `main`: commit `1aadf26f9acc399affabd859937a09468a9c5cb4`
- Planned patched npm version: `2026.2.26`
### Impact
Deployments using the optional `voice-call` Twilio webhook path could accept replayed webhook events as fresh events when an attac
OpenClaw has multiple E2E/test Dockerfiles that run all processes as root
Three Dockerfiles in scripts/docker/ and scripts/e2e/ lack a USER directive, meaning all processes run as uid 0 (root). If any process is compromised, the attacker has root inside the container, making container breakout significantly easier.
**Partial fix (2026-02-08):** Commit 28e1a65e added USER sandbox to Dockerfile.sandbox and Dockerfile.sandbox-browser. The E2E/test Dockerfiles listed below remain unpatched.
**Affected components:**
- scripts/e2e/Dockerfile
- scripts/e2e/Dockerfile.qr-import
- scripts/docker/install-sh-e2e/Dockerfile
- scripts/docker/install-sh-nonroot/Dockerfile (runs as app but with NOPASSWD sudo — see related adviso
OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation
### Summary
`tools.exec` allowlist/safe-bins evaluation could diverge from runtime execution for wrapper commands using GNU `env -S/--split-string` semantics. This allowed policy checks to treat a command as a benign safe-bin invocation while runtime executed a different payload.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.22-2` (latest currently published npm version)
- Patched version (released): `2026.2.23`
### Impact
An attacker able to influence tool command text (for example via untrusted prompt/content injection reaching an exec-capable flow) could bypass allowlist/safe-bins intent a
OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model
## Impact
Microsoft Teams media handling used mixed fetch paths for Graph metadata/content and attachment auth-retry flows. Some paths bypassed the shared SSRF guard model and created inconsistent host/DNS enforcement across redirect/fetch hops.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published vulnerable version: `2026.2.25`
- Affected range: `<= 2026.2.25`
- Planned patched version for next release: `2026.2.26`
## Technical Details
The Microsoft Teams attachment/media code previously relied on plugin-local fetch behavior in parts of the flow, instead of uniformly using shared guarded fetch logic with pinned DN
OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt
### Summary
In `openclaw` versions up to and including `2026.2.22-2`, a non-default exec-approval configuration could allow a skill-name collision to bypass an `ask=on-miss` prompt.
When `autoAllowSkills=true`, a path-scoped executable such as `./skill-bin` could resolve to basename `skill-bin`, satisfy the `skills` allowlist segment, and run without prompting for approval.
### Affected Packages / Versions
- Package: `npm openclaw`
- Affected versions: `<= 2026.2.22-2`
- Patched versions: `>= 2026.2.23` (released)
### Configuration Scope (Not Default)
This behavior requires non-default settings and does not affect default installs.
Requir
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands
### Summary
`BASH_ENV` / `ENV` startup-file injection could lead to unintended pre-command shell execution when attacker-controlled environment values were admitted and then inherited by host command execution paths.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.19-2`
- Fixed on `main`: `2cdbadee1f8fcaa93302d7debbfc529e19868ea4`
- Planned patched release version: `2026.2.21`
### Details
The fix hardens environment handling across all relevant execution paths:
- Blocks dangerous startup/runtime env keys and prefixes in shared host env sanitization.
- Sanitizes inherited ambient environment even when no p
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
## Summary
The exported session HTML viewer allowed stored XSS when untrusted session content included raw HTML markdown tokens or unescaped metadata fields.
## Impact
Opening a crafted exported HTML session could execute attacker-controlled JavaScript in the viewer context. This can expose session content in the page and enable phishing or UI spoofing in the trusted export view.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.22-2`
- Patched version (released): `>= 2026.2.23`
## Technical Details
The exporter rendered markdown with `marked.parse(...)` and inserted HTML via `innerHTML`, but d
OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot
### Summary
A sandbox path validation bypass in `openclaw` allows host file reads outside `sandboxRoot` via the media path fallback tmp flow when the fallback tmp root is a symlink alias.
### Affected Packages / Versions
- Package: `npm openclaw`
- Affected versions: `<= 2026.2.24`
- Latest published npm version at triage time (February 26, 2026): `2026.2.24`
- Patched version : `2026.2.25`
### Details
When `/tmp/openclaw` is unavailable or unsafe, `resolvePreferredOpenClawTmpDir()` in `src/infra/tmp-openclaw-dir.ts` fell back to `os.tmpdir()/openclaw-<uid>` without verifying that fallback path was a trusted non-symlink directory.
`resolve
OpenClaw has a Discord `allowFrom` slug-collision authorization bypass
OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21-2`
- Patched versions: >= 2026.2.22
## What Changed
- `openclaw security audit` now warns on Discord name/tag allowlist entries (DM allowlists, guild/channel `users`, and pairing-store entries).
- Runtime authorization now prefers resolved user IDs when a configured name/tag can be resolved, without rewriting config fi
OpenClaw has a IPv6 multicast SSRF classifier bypass
### Summary
OpenClaw's SSRF IP classifier did not treat IPv6 multicast literals (`ff00::/8`) as blocked/private-internal. This allowed literal multicast hosts to pass SSRF preflight checks.
### Impact
A bypass in address classification existed for IPv6 multicast literals. OpenClaw's network fetch/navigation paths are constrained to HTTP/HTTPS and this was triaged as low-severity defense-in-depth hardening.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.24`
- Patched versions: `>= 2026.2.25`
### Technical Details
The IPv6 private/internal range set omitted `multicast`, so addresses like `ff02::
OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint
### Summary
When the optional Chrome extension relay is enabled, `/extension` accepted unauthenticated WebSocket upgrades while `/json/*` and `/cdp` required auth.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.17`
- Latest published npm version at triage time: `2026.2.17`
### Impact
This is a local-only issue on loopback (`127.0.0.1`) and only applies when the extension relay feature is in use. A local process on the same machine could connect to `/extension` without the token and interfere with extension-relay behavior.
No remote network exploit path is involved.
### Fix
- Require gateway-token a
OpenClaw plugin runtime command execution is part of trusted plugin boundary
### Summary
OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution (`runtime.system.runCommandWithTimeout`).
### Impact
Plugins already execute with the same OS privileges as the OpenClaw process. Exposing runtime command helpers does not cross an additional sandbox boundary.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published version reviewed: `2026.2.17`
- Affected range for this advisory record: `<= 2026.2.17`
- Planned patched version metadata: `2026.2.19` (next release line)
### Fix Commit(s)
- `2e
OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption
### Summary
In `openclaw` MS Teams file-consent flow, pending uploads were authorized by `uploadId` alone. `fileConsent/invoke` did not verify the invoke conversation against the conversation that created the pending upload.
### Impact
An attacker who obtained a valid `uploadId` within TTL could trigger cross-conversation upload completion (accept path) or cancel a victim pending upload (decline path).
### Technical Details
- Pending uploads stored `conversationId`, but invoke handling consumed by `uploadId` only.
- The invoke path did not enforce conversation binding before `uploadToConsentUrl(...)` and pending-upload removal.
- Fix binds
OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows
## Summary
In authenticated non-owner DM sessions, a narrow tool-invocation path could reach broader-than-intended owner-only gateway actions.
## Impact
This requires an authenticated non-owner sender in a DM session and a specific tool invocation path. No unauthenticated access is involved, and this does not provide direct code execution by itself.
## Root Cause
- Some gateway call paths were still using broader default scopes instead of method-level least-privilege scopes.
- Owner-only enforcement depended on tool-name checks and was not consistently metadata-driven across all call paths.
## Affected Packages / Versions
- Package: `o
OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)
## Summary
Remote iMessage attachment fetches used SCP with trust-on-first-use host-key behavior and accepted unvalidated remote host tokens.
Before the fix:
- SCP used `StrictHostKeyChecking=accept-new` in the remote attachment path.
- `channels.imessage.remoteHost` was not validated as a strict SSH host token.
## Impact
In remote iMessage deployments that use SCP attachment fetching, a first-connection MITM/DNS-poisoning scenario could cause the wrong host key to be trusted. Unsafe remote host token values could also alter SCP argument semantics.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm versio