PT-2026-99228

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.10 through 2026.7.0 Description Persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the '/dreaming on' and '/dreaming off' commands to enable...

CVE-2026-100556: Incorrect Authorization

OpenClaw npm package openclaw versions = 2026.5.2 and 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or owner command authorization can issue the /new command to reset the...

CVE-2026-100582: Missing Authorization

OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...

CVE-2026-100575: Missing Authorization

OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies...

PT-2026-99217

Name of the Vulnerable Software and Affected Versions OpenClaw for iOS versions prior to 2026.8.11 Description The application stores Gateway credentials as cleartext JSON within App Group UserDefaults rather than using the secure device Keychain. This allows attackers who obtain unencrypted devi...

CVE-2026-100539: Incorrect Authorization

OpenClaw npm package 'openclaw' before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memorysearch and memoryget tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit...

CVE-2026-100581: Cleartext Storage of Sensitive Information

OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Attackers with access to unencrypted device backups or extracted App Group containers can recover valid Gateway tokens and passwords to authenticate with operat...

CVE-2026-100544: Missing Authorization

openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller...

PT-2026-99233

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description A time-of-check time-of-use TOCTOU race condition exists in OpenShell local mirror filesystem mutation operations. This occurs when the remove, mkdir, and rename operations act on a filesystem...

PT-2026-99186

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An issue exists in the QQBot voice attachment handling where filenames are decoded twice. This double decoding allows encoded traversal segments to reappear after the sanitization process, enabli...

PT-2026-99165

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description When a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot reload retains...

CVE-2026-100558: Uncontrolled Resource Consumption

OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade request...

PT-2026-99199

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An authorization bypass exists in the 'sessions.create' endpoint. This issue allows users with operator.write permissions to modify session configurations that should be restricted to the...

PT-2026-99223

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Insufficient validation of owner authorization occurs within the Codex computer-use installation command. This allows senders in a channel who are not owners to install arbitrary plugins and...

PT-2026-99183

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.7.2 through 2026.9.1 Description A race condition exists in the Discord realtime voice transcript path. This occurs when concurrent control-classified voice transcripts consume speaker context from another participant...

PT-2026-99190

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.6.9 through 2026.8.0 Description The Feishu unpin feature fails to declare the native chatId parameter as a delivery target. This allows unpin requests to bypass the shared same-provider cross-context target check. When...

CVE-2026-100586: Improper Privilege Management

OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native conversation bindings. Non-owner channel senders with command access can create bindings to the native Codex runtime and execute host-capable turns with access to files, tools, and processes...

CVE-2026-100577: Server-Side Request Forgery (SSRF)

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

CVE-2026-100576: Server-Side Request Forgery (SSRF)

OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or...

CVE-2026-100571: Uncontrolled Resource Consumption

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...