OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines

OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming

OpenClaw before 2026.7.1 Authentication Bypass via Active Memory

OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset

OpenClaw before 2026.8.1 Authentication Bypass via Session Reset

OpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass

OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download

OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery

OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path

OpenClaw < 2026.3.1 - Server-Side Request Forgery via web_search Citation Redirect

OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML

OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment

OpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL Handling

OpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution Policy

OpenClaw < 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.ts

OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash Commands

OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command

OpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL Interpolation

OpenClaw 2026.2.22 < 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix Fallback

OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation

OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS

OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions

OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter

OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust

OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload

OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery

OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths

OpenClaw < 2026.2.14 - Server-Side Request Forgery in Tlon Extension Authentication

OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

OpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpoints

OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution

OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension

OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override

OpenClaw before 2026.8.1 Authentication Bypass via File URL

OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json

OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command

OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting

OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript Files

OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installation

OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler

OpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions

OpenClaw File Existence tools.exec.safeBins information exposure

OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation Commands

OpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlist

OpenClaw session tool visibility hardening and Telegram webhook secret fallback

OpenClaw: Telegram bot token exposure via logs

OpenClaw before 2026.7.1 Authentication Bypass via activation

OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates

OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export

OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels