@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41385 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41385 Source advisory: OSV:GHSA-JJW7-3VJF-FG5J...

OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get

Summary OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: v2026.3.28 still models Nostr privateKey as plain string so config views can expose it, and the secret-schema f...

Reliance on Untrusted Inputs in a Security Decision

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the PIPINDEXURL and UVINDEXURL environment variables, which bypass host execution environment sanitization and redirect Python...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41391 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41391 Source advisory: OSV:GHSA-7GGG-PVRF-458V...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41391 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41391 Source advisory: SNYK:JS-OPENCLAW-15899601...

OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Summary PIPINDEXURL and UVINDEXURL bypass host exec env sanitization and redirect Python package-index traffic Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay...

GHSA-7GGG-PVRF-458V OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Summary PIPINDEXURL and UVINDEXURL bypass host exec env sanitization and redirect Python package-index traffic Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay...

Replay Attack

Overview @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Replay Attack in the callback process. An attacker can alter the origin of a Plivo callback before it is rejected by replaying a captured valid callback for a live call. Remediation...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41337 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41337 Source advisory: OSV:GHSA-89R3-6X4J-V7WF...

Replay Attack

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Replay Attack in the callback process. An attacker can alter the origin of a Plivo callback before it is rejected by replaying a captured valid callback for a live call. Remediation Upgra...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41337 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41337 Source advisory: SNYK:JS-OPENCLAW-15900041...

OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection

Summary Voice-call Plivo replay mutates in-process callback origin before replay rejection Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: v2026.3.28 can still mutate Plivo callback origin before replay rejection, but this needs a captured valid callback for a...

GHSA-89R3-6X4J-V7WF OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection

Summary Voice-call Plivo replay mutates in-process callback origin before replay rejection Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: v2026.3.28 can still mutate Plivo callback origin before replay rejection, but this needs a captured valid callback for a...

GHSA-MHGQ-XPFQ-6R66 OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

Summary Unauthenticated plugin-auth HTTP routes receive operator runtime scopes Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still gives auth:"plugin" routes operator WRITESCOPE, but impact should stay limited to plugin routes that actually tou...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via unauthenticated plugin-auth HTTP routes receiving operator runtime scopes. An attacker can gain unauthorized access to privileged runtime actions by sending...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41394 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41394 Source advisory: OSV:GHSA-MHGQ-XPFQ-6R66...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41394 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41394 Source advisory: SNYK:JS-OPENCLAW-15897594...

OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

Summary Unauthenticated plugin-auth HTTP routes receive operator runtime scopes Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still gives auth:"plugin" routes operator WRITESCOPE, but impact should stay limited to plugin routes that actually tou...

CVE-2026-34426

OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment variables into execution without approval system validation...

CVE-2026-34425

OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content by using piped or complex command forms that the parser fails to recognize. Attackers can craft commands such as piped...