OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass
OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. In deployments where the webhook endpoint is reachable by an attacker, this can allow forged Telegram updates (for example spoofing message.from.id). If an attacker can reach the webhook endpoint, they may be able to send forged updates that are processed as if they came from Telegram. Depending on enabled commands/tools and configuration, this could lead to unintended bot actions. Note: Telegram webhook mod
OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions
OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.
OpenClaw inter-session prompts could be treated as direct user instructions
## Summary
Inter-session messages sent via `sessions_send` could be interpreted as direct end-user instructions because they were persisted as `role: "user"` without provenance metadata.
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.12` (i.e. `< 2026.2.13`)
- Fixed in: `2026.2.13` (patched versions `>= 2026.2.13`)
## Impact
A delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input.
This is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in work
OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch
### Summary
Google Chat allowlisting supports matching by sender email in addition to immutable sender resource name (`users/<id>`). This weakens identity binding if a deployment assumes allowlists are strictly keyed by immutable principals.
### Affected Packages / Versions
(As of 2026-02-14; based on latest published npm versions)
- `openclaw` (npm): `<= 2026.2.13`
- `clawdbot` (npm): `<= 2026.1.24-3`
### Details
Affected component:
- `extensions/googlechat/src/monitor.ts`
The `allowFrom` checks accept:
- Immutable sender id (`users/<id>`)
- Raw email (`[email protected]`) for usability
Historically, `users/<email>` was also treated as a
OpenClaw log poisoning (indirect prompt injection) via WebSocket headers
### Summary
In `openclaw` versions prior to `2026.2.13`, OpenClaw logged certain WebSocket request headers (including `Origin` and `User-Agent`) without neutralization or length limits on the "closed before connect" path.
If an unauthenticated client can reach the gateway and send crafted header values, those values may be written into core logs. Under workflows where logs are later read or interpreted by an LLM (for example via AI-assisted debugging), this can increase the risk of indirect prompt injection (log poisoning).
### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.12`
- Fixed: `>= 2026.2.13`
### D
OpenClaw affected by SSRF in Image Tool Remote Fetch
## Summary
A server-side request forgery (SSRF) vulnerability in the Image tool allowed attackers to force OpenClaw to make HTTP requests to arbitrary internal or restricted network targets.
## Affected Versions
- npm: openclaw <= 2026.2.1
## Patched Versions
- npm: openclaw 2026.2.2 and later
## Fix Commits
- 81c68f582d4a9a20d9cca9f367d2da9edc5a65ae (guard remote media fetches with SSRF checks)
- 9bd64c8a1f91dda602afc1d5246a2ff2be164647 (expand SSRF guard coverage)
## Details
The Image tool accepts file paths, file:// URLs, data: URLs, and http(s) URLs. In vulnerable versions, http(s) URLs were fetched without SSRF protections, enab
## Summary
The issue is not deterministic session keys by itself. The exploitable path was accepting externally supplied `sessionKey` values on authenticated hook ingress, allowing a hook token holder to route messages into chosen sessions.
## Affected Behavior
- `POST /hooks/agent` accepted payload `sessionKey` and used it directly for session routing.
- Common session-key shapes (for example `agent:main:dm:<peerId>`) were often derivable from known metadata, making targeted routing practical when request-level override was enabled.
## Attack Preconditions
- Attacker can call hook endpoints with a valid hook token.
- Hook ingress allows re
OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply
OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.
OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30.