### Summary
OpenClaw accepted `camera.snap` / `camera.clip` node payload `url` fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host.
In OpenClaw's documented trust model, paired nodes are in the same operator trust boundary, so this is scoped as medium-severity hardening. A malicious or compromised paired node could still steer gateway-host fetches during camera URL retrieval.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `>= 2026.2.13 <= 2026.3.1`
- Latest vulnerable published version at time of update: `2026.3.1`
- Patched versions: `>= 2026.3.2` (rele
### Summary
In `openclaw` allowlist mode, `tools.exec.safeBins` trusted PATH-derived directories for safe-bin resolution. A same-name binary placed in a trusted PATH directory could satisfy safe-bin checks and execute.
### Impact
This is an allowlist bypass in exec policy that can lead to command execution in the OpenClaw runtime context when allowlist mode relies on safe bins and an attacker can influence trusted binary locations.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.21-2`
- Patched versions: `>= 2026.2.22` (planned next release)
- Latest published npm version at triage time (2026-0
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check
## Impact
In Telegram DM mode, inbound media was downloaded and written to disk before sender authorization checks completed. An unauthorized sender could trigger inbound media download/write activity (including media groups) even when DM access should be denied.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published version currently affected: `2026.2.23`
- Vulnerable range: `<= 2026.2.23`
- Patched in planned next release: `2026.2.24`
## Fix Commit(s)
- `9514201fb9b51de5d0b23151110d0ff5d9c8bd67`
## Technical Details
The Telegram handler flow now enforces DM authorization before media download/write paths execu
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
### Summary
In sandboxed runs, native prompt image auto-load did not honor `tools.fs.workspaceOnly=true`.
This optional hardening setting is **not enabled by default**. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths (for example `/agent/secret.png`) and load those image bytes for vision-capable model input.
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version at triage time: `2026.2.23`
- Vulnerable version range: `<= 2026.2.23`
- Patched version (planned next release): `2026.2.24`
### Conditions Required
This issue required all of the following:
- sa
OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants
## Vulnerability
The hook authentication throttle keyed failed attempts by raw socket `remoteAddress` text.
IPv4 and IPv4-mapped IPv6 forms of the same client (for example `1.2.3.4` and `::ffff:1.2.3.4`) were treated as different clients, allowing separate rate-limit buckets.
## Impact
An attacker could split failed hook-auth attempts across both address forms and effectively double the brute-force budget from 20 to 40 attempts per 60-second window.
## Affected Components
- `src/gateway/server-http.ts`
- `src/gateway/auth-rate-limit.ts`
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.21-2`
## Summary
OpenClaw Gateway exposes an authenticated HTTP endpoint (`POST /tools/invoke`) intended for invoking a constrained set of tools. Two issues could combine to significantly increase blast radius in misconfigured or exposed deployments:
- The HTTP gateway layer did not deny high-risk session orchestration tools by default, allowing a caller with Gateway auth to invoke tools like `sessions_spawn` / `sessions_send` and pivot into creating or controlling agent sessions.
- ACP clients could auto-approve permission requests for risky tools with insufficient user interaction/guardrails, reducing the friction that should normally prevent s
OpenClaw: Node exec approvals could be replayed across nodes
## Summary
`exec.approval` requests for `host=node` were not explicitly bound to the target `nodeId`, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.
## Impact
An operator approval for a `system.run` request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.22-2`
- Fixed: `2026.2.23` (released)
## Mitigation
Upgrade to `2026.2.23` or later once published.
## Fix Details
The fix requires and persists `nodeId` for
OpenClaw: Sandbox media TOCTOU could read files outside sandbox root
### Summary
Sandbox media handling had a time-of-check/time-of-use gap: media paths could be validated first and read later through a separate path. A symlink retarget between those steps could cause reads outside `sandboxRoot`.
### Impact
Affected versions could permit host file reads outside the intended sandbox root in media attachment/image flows.
### Fix
Media reads now use consolidated root-scoped, boundary-safe read paths at use time, removing check/use drift across call sites.
### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries
### Summary
A symlink-retarget TOCTOU race in `writeFileWithinRoot` could point an attacker-controlled path alias outside the configured root between resolution and write operations.
### Impact
Affected versions could cause out-of-root write side effects (including file creation or truncation) before final boundary validation.
### Fix
Root-scoped write flow now opens existing files without pre-truncation, creates missing files with exclusive create semantics, truncates only after post-open identity/boundary checks, and removes out-of-root artifacts when a race is detected.
### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patc
OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization
### Summary
Unauthorized senders could trigger two command paths without sender authorization checks:
1. stop-like natural-language abort triggers
2. `/models` command output
### Impact
An unauthorized sender could disrupt active sessions and view model/auth metadata that should be authorization-gated.
### Fix
Sender authorization is now enforced for stop-like abort triggers and `/models` listings.
### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists
### Summary
A paired node could supply Unicode-confusable `platform` or `deviceFamily` metadata that passed metadata pinning but classified differently for command policy resolution, broadening default node command allowlists.
### Impact
This is a policy-bypass issue within the paired-node trust boundary and can expand node command availability beyond intended defaults.
### Fix
Node metadata canonicalization was hardened against confusables, and unknown platform defaults were made conservative (excluding `system.run` and `system.which` unless explicitly allowlisted).
### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `
In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval. Only an exact string such as --compress-program was denied.
OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt payloads before forwarding them to chat.send. Because ACP runs over local stdio, this mainly affects local ACP clients (for example IDE integrations) that send unusually large inputs. This issue has been fixed in version 2026.2.19.
OpenClaw hardened cron webhook delivery against SSRF
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.
OpenClaw: Prevent shell injection in macOS keychain credential write
OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w .... Because OAuth tokens are user-controlled data, this created an OS command injection risk. This issue has been fixed in version 2026.2.14.
OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup
OpenClaw is a personal AI assistant. In versions 2026.2.13 and below of the OpenClaw CLI, the process cleanup uses system-wide process enumeration and pattern matching to terminate processes without verifying if they are owned by the current OpenClaw process. On shared hosts, unrelated processes can be terminated if they match the pattern. The CLI runner cleanup helpers can kill processes matched by command-line patterns without validating process ownership. This issue has been fixed in version 2026.2.14.
OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents. If exploited, this vulnerability can lead to potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact, but requires local execution of the packaging script on attacker-controlled skill
OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user can request moderation actions by spoofing sender identity fields. This issue has been fixed in version 2026.2.18.
OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `<script>` tag without script-context-safe escaping. A crafted value containing `</script>` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Version 2026.2.15 removed inline script injection and serve bootstrap config from a JSON endpoint and added a restrictive Content Security Policy for the Control UI (`script-src 'self'`, no inline scripts).