PT-2026-20952

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 Description The Gateway tool in OpenClaw accepted a tool-supplied gatewayUrl without sufficient restrictions, potentially causing the OpenClaw host to attempt outbound WebSocket connections to user-specifie...

PT-2026-22457

Summary The BlueBubbles webhook handler previously treated any request whose socket remoteAddress was loopback 127.0.0.1, ::1, ::ffff:127.0.0.1 as authenticated. When OpenClaw Gateway is behind a reverse proxy Tailscale Serve/Funnel, nginx, Cloudflare Tunnel, ngrok, the proxy typically connects t...

PT-2026-22431

Summary An authentication bypass in the optional voice-call extension/plugin allowed unapproved or anonymous callers to reach the voice-call agent when inbound policy was set to allowlist or pairing. Deployments that do not install/enable the voice-call extension are not affected. Affected Packag...

PT-2026-23536

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.12 Description OpenClaw versions prior to 2026.2.12 do not properly validate the sessionFile path parameter, potentially allowing authenticated gateway clients to write transcript data to arbitrary locations o...

PT-2026-23525

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.2 Description An authentication bypass exists in the optional voice-call extension when inbound allowlist policy validation is used. The system accepts empty caller IDs and uses suffix-based matching instead o...

PT-2026-20950

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.6 through 2026.2.13 Description The OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links lacking an unattended key, the application displays a confirmation dialog...

PT-2026-22448

Summary The Chrome extension relay ensureChromeExtensionRelayServer previously treated wildcard hosts 0.0.0.0 / :: as loopback, which could make it bind the relay HTTP/WS server to all interfaces when a wildcard cdpUrl was passed. Impact If configured with a wildcard cdpUrl, relay HTTP endpoints...

PT-2026-23524

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.1.14-1 through 2026.2.11 Description The software contains an improper network binding issue in the Chrome extension relay server. The server incorrectly handles wildcard hosts, treating them as loopback addresses. This...

PT-2026-22432

Summary A server-side request forgery SSRF vulnerability in the Image tool allowed attackers to force OpenClaw to make HTTP requests to arbitrary internal or restricted network targets. Affected Versions - npm: openclaw = 2026.2.1 Patched Versions - npm: openclaw 2026.2.2 and later Fix Commits -...

PT-2026-22430

Affected Packages / Versions This issue affects the optional voice-call plugin only. It is not enabled by default; it only applies to installations where the plugin is installed and enabled. - Package: @openclaw/voice-call - Vulnerable versions: = 2026.2.3 Legacy package name if you are still usi...

Malicious Package

Overview cline is a malicious package. NPM publishing token for this package was compromised and useb by an unauthorized party to publish version 2.3.0 containing a modified package.json with an added postinstall script "postinstall": "npm install -g openclaw@latest". This causes openclaw an...

Infostealer Steals OpenClaw AI Agent Configuration Files and Gateway Tokens

Cybersecurity researchers disclosed they have detected a case of an information stealer infection successfully exfiltrating a victim's OpenClaw formerly Clawdbot and Moltbot configuration environment. "This finding marks a significant milestone in the evolution of infostealer behavior: the...

The vulnerability of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) arises from the lack of validation for incoming requests, allowing a malicious actor to gain unauthorized access to the system and execute arbitrary code.

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to the lack of validation for the correctness of the requests received. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the system and execute...

PT-2026-23555

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 clawdbot versions prior to 2026.1.24-3 Description The Telegram allowlist authorization mechanism incorrectly matched on mutable usernames @username instead of immutable numeric sender IDs. This allowed...

OpenClaw Access Control Error Vulnerability (CNVD-2026-13431)

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw suffers from an Access Control Error vulnerability that originates from the fact that an unauthenticated local client can use the Gateway WebSocket API to write a configuration via config.apply and set insecure cliPath...

OpenClaw OS Command Injection Vulnerability

OpenClaw is openclaw open source an intelligent artificial assistant. An operating system command injection vulnerability exists in versions prior to OpenClaw 2026.1.29, which stems from the sshNodeCommand function failing to properly filter construct command special characters, commands, etc. An...

OpenClaw OS Command Injection Vulnerability (CNVD-2026-13291)

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw there is an operating system command injection vulnerability , the vulnerability stems from the Docker sandbox execution mechanism when constructing shell commands on the PATH environment variable handling insecurity ,...

OpenClaw Information Disclosure Vulnerability

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw has an information disclosure vulnerability that stems from the isValidMedia function allowing arbitrary file paths, which can be exploited by an attacker to cause the reading of arbitrary files and the disclosure of...

OpenClaw < 2026.1.20 Command Injection (GHSA-g55j-c2v4-pjcg)

The version of the OpenClaw AI assistant installed on the remote host is prior to 2026.1.20. It is, therefore, affected by a command injection vulnerability: - An unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that...

OpenClaw < 2026.1.30 Path Traversal (GHSA-r8g4-86fx-92mq)

The version of the OpenClaw AI assistant installed on the remote host is prior to 2026.1.30. It is, therefore, affected by a path traversal vulnerability: - The isValidMedia function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory...