EUVD-2026-36622

OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. Attackers can invoke slash commands before configured access control policies are applied, potentially triggering comman...

EUVD-2026-36616

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without proper policy enforcement. Attackers can trigger native command handling to bypass the configured owner-command access contro...

EUVD-2026-36618

OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active after secrets.reload. Attackers can exploit the stale-secret window to deliver webhook events after operator-expected secret revocation,...

EUVD-2026-36619

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved commands to read unintended node-loca...

Duplicate Advisory: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j472-gf56-x589. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allo...

Duplicate Advisory: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mhq8-78pj-5j79. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation tha...

Duplicate Advisory: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-275c-xpvc-jgfw. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack a...

EUVD-2026-36621

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching t...

EUVD-2026-36624

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators can bypass execution allowlist checks...

Duplicate Advisory: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rggc-m335-3wvj. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to...

Duplicate Advisory: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jvm4-4j77-39p6. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows...

Duplicate Advisory: OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-77pv-3w4q-vrj5. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that...

EUVD-2026-36617

OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes to execute unauthorized operations after approval...

EUVD-2026-36613

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers with operator.write access can specify arbitrary local file...

EUVD-2026-36612

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash command behavior briefly after token revocation, potentially...

EUVD-2026-36608

OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to bypass intended command restrictions. Attackers can reach the affected bundled MCP session-spawn path to start sessions with broader command...

EUVD-2026-36611

OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other...

EUVD-2026-36614

OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exploit this by spawning child sessions from sandboxed parents to reveal host workspace location or related memory context ...

EUVD-2026-36609

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execut...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the trusted-proxy Control UI WebSocket process. An attacker can gain unauthorized administrative privileges by connecting as an unpaired or restricted client and...