PT-2026-99194

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An authorization bypass exists in the skill tool dispatch mechanism that fails to properly verify the owner status of the sender. This allows non-owner users who are authorized to invoke skill...

PT-2026-99173

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description Insufficient validation of source fields in structured message attachments allows attackers to bypass sandbox path validation. By providing multiple source fields, an attacker can hide unvalidate...

PT-2026-99169

Name of the Vulnerable Software and Affected Versions @openclaw/whatsapp versions prior to 2026.8.1 Description The software exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, failing to enforce the owner-only tool...

PT-2026-99205

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.25 through 2026.8.0 Description The workspace environment-variable filter fails to block variables ending in ENDPOINT. This allows an untrusted workspace .env file to set the AZURE SPEECH ENDPOINT variable. Because Azu...

PT-2026-99234

Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.7.1 Description The software incorrectly binds Signal approval reactions. When unrelated outbound messages and a pending approval exist in the same conversation, a reaction intended for a structured approval...

PT-2026-99231

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description An authorization bypass exists in the diagnostics export command. This flaw allows non-owner channel senders to access host diagnostic bundles reserved for owners, enabling them to request and...

PT-2026-99230

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description An authorization bypass exists in the '/export-trajectory' endpoint, allowing non-owner senders to request and receive trajectory bundles intended only for the owner. This occurs due to...

PT-2026-99229

Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.7.1 Description The software fails to enforce the owner-only requirement for persistent policy changes via the /activation endpoint in group channels. This allows an authorized sender who is not the owner to...

PT-2026-99227

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Global Active Memory toggle mutations may omit owner authorization checks. This allows an authorized non-owner external-channel sender to persistently enable or disable Active Memory for the...

PT-2026-99224

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description The software fails to enforce the administrator scope requirement for browser control when accessed via the node.invoke method, despite direct browser.request access requiring such scope. In...

PT-2026-99187

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An access-control bypass exists in the Microsoft Teams integration. When the groupPolicy is configured as allowlist, a missing or unsupported access group results in a denied group-resolution tha...

PT-2026-99185

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.3.28 through 2026.8.0 Description A credential exposure issue exists in the memory embedding failover mechanism. When remote embedding fallback is configured and the primary embedding provider fails, the system may send...

PT-2026-99200

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description The Control UI fails to neutralize leading characters that spreadsheet applications interpret as formulas when exporting session data to CSV. A lower-trust participant capable of influencing a...

PT-2026-99188

Name of the Vulnerable Software and Affected Versions OpenClaw for iOS versions 2026.7.1 through 2026.8.10 Description The Control UI fails to enforce saved Gateway TLS pins. While native connections maintain the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews...

PT-2026-99184

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.7.1 through 2026.7.2 Description OpenClaw, distributed as the npm package openclaw, contains an issue where alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP are treated as relative path...

PT-2026-99197

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An authorization bypass exists on macOS and Linux where Allow Always approvals for exact commands are persisted as path-only grants. This allows an attacker to reuse the same executable with...

PT-2026-99203

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.5 through 2026.8.0 Description The Gateway validates a single DNS resolution result for a configured remote Chrome DevTools Protocol CDP hostname, but the raw WebSocket and Playwright transports perform a subsequent,...

PT-2026-99212

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An issue exists in browser wait predicates that allows attackers to bypass server-side request forgery SSRF protections. By using the wait --fn function against an existing browser session, an...

PT-2026-99211

Name of the Vulnerable Software and Affected Versions OpenClaw Slack versions prior to 2026.8.1 Description Multi-person direct messages fail to properly enforce sender allowlists. This allows unauthorized participants to bypass configured sender policies, enabling them to trigger Slack agents an...

PT-2026-99210

Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.8.1 Description A server-side request forgery SSRF issue exists in the trusted-host DNS checks. When fetches utilize the trusted-host DNS recheck, a trusted hostname resolving to an unspecified address 0.0.0.0 o...