Insufficiently Protected Credentials

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the media download process. An attacker can obtain sensitive credentials by triggering cross-origin redirects that cause Authorization headers to ...

OpenClaw: Media download follows cross-origin redirects with Authorization headers intact

Summary Media download follows cross-origin redirects with Authorization headers intact Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Shipped v2026.3.28 media downloads forwarded Authorization across cross-origin redirects, a real in-scope credential-leak...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41345 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41345 Source advisory: OSV:GHSA-68V4-HMWV-F43H...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41345 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41345 Source advisory: SNYK:JS-OPENCLAW-15894815...

Arbitrary File Upload

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Arbitrary File Upload via the Mirror Sync process. An attacker can escape the intended sandbox and gain unauthorized access to files outside the designated directory by exploiting...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41397 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41397 Source advisory: SNYK:JS-OPENCLAW-15894828...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41397 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41397 Source advisory: OSV:GHSA-CWF8-44X6-32C2...

OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal

Summary OpenShell Mirror Sync: Sandbox Escape via Unrestricted File Sync + Symlink Traversal Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still has the mirror-boundary bug because shipped c02ee8 only excluded hooks while unreleased 3b9dab is the...

GHSA-QCJ9-WWGW-6GM8 OpenClaw: Workspace `.env` can override the bundled plugin trust root

Summary Workspace .env can override the bundled plugin trust root Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: v2026.3.28 still lets workspace .env override OPENCLAWBUNDLEDPLUGINSDIR, but critical is too high because exploitation still depends on...

External Control of System or Configuration Setting

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of System or Configuration Setting via the handling of the .env file, which can override the trusted root directory for bundled plugins. An attacker can influence the...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41396 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41396 Source advisory: SNYK:JS-OPENCLAW-15895899...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41396 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41396 Source advisory: OSV:GHSA-QCJ9-WWGW-6GM8...

OpenClaw: Workspace `.env` can override the bundled plugin trust root

Summary Workspace .env can override the bundled plugin trust root Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: v2026.3.28 still lets workspace .env override OPENCLAWBUNDLEDPLUGINSDIR, but critical is too high because exploitation still depends on...

PT-2026-30235

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.2 Description The application reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. An attacker capturing the redirect URL can obtain both the...

PT-2026-35771

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22 Description An issue exists where bootstrap setup codes are not bound to intended device roles and scopes during pairing. This allows attackers to escalate privileges beyond their intended role and scope...

A Systematic Security Evaluation of OpenClaw and Its Variants

Tool-augmented AI agents substantially extend the practical capabilities of large language models, but they also introduce security risks that cannot be identified through model-only evaluation. In this paper, we present a systematic security assessment of six representative OpenClaw-series agent...

OpenClaw 安全特征问题漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.2 had security feature vulnerabilities. These vulnerabilities stemmed from the reuse of the PKCE verifier as a state parameter in the Gemini OAuth process, which could lead to t...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs through the validateScriptFileForShellBleed process. An attacker can execute unauthorized script content by crafting piped, substituted, or subshell...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-34425 via openclaw (>=2026.3.22, <=2026.4.1)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-34425 Source advisory: SNYK:JS-OPENCLAW-15920466...

Duplicate Advisory: OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h3x4-hc5v-v2gm. This link is maintained to preserve external references. Original Description OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment...