@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-44997 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44997 Source advisory: OSV:GHSA-Q3JJ-46PQ-826R...

GHSA-Q3JJ-46PQ-826R OpenClaw's ACP child sessions inherit subagent security envelope constraints

Summary ACP child sessions inherit subagent security envelope constraints. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.4.21 - Fixed version: 2026.4.22 Impact A restricted subagent spawning an ACP child session could fail to carry forward subagent-only...

Insecure Inherited Permissions

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insecure Inherited Permissions due to improper enforcement of security envelope constraints in ACP child session creation. An attacker can bypass intended subagent-only restrictions, such...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-44997 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44997 Source advisory: SNYK:JS-OPENCLAW-16417713...

OpenClaw's ACP child sessions inherit subagent security envelope constraints

Summary ACP child sessions inherit subagent security envelope constraints. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.4.21 - Fixed version: 2026.4.22 Impact A restricted subagent spawning an ACP child session could fail to carry forward subagent-only...

OpenClaw validates Zalo outbound photo URLs through the SSRF guard

Summary Zalo outbound photo URLs are validated through the SSRF guard. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.4.21 - Fixed version: 2026.4.22 Impact The Zalo plugin could forward an attacker-controlled outbound photo URL to the Zalo Bot API without first...

Server-side Request Forgery (SSRF)

Overview @openclaw/zalo is an OpenClaw Zalo channel plugin Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the sendPhoto process. An attacker can cause unauthorized requests to internal or external resources by supplying a crafted outbound photo URL th...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-44116 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44116 Source advisory: SNYK:JS-OPENCLAW-16417714...

GHSA-2HH7-C75G-QJ2R OpenClaw validates Zalo outbound photo URLs through the SSRF guard

Summary Zalo outbound photo URLs are validated through the SSRF guard. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.4.21 - Fixed version: 2026.4.22 Impact The Zalo plugin could forward an attacker-controlled outbound photo URL to the Zalo Bot API without first...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the sendPhoto process. An attacker can cause unauthorized requests to internal or external resources by supplying a crafted outbound photo URL tha...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-44116 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44116 Source advisory: OSV:GHSA-2HH7-C75G-QJ2R...

GHSA-QM77-8QJP-4VCM OpenClaw: Slack thread context could include messages from non-allowlisted senders

Summary Before OpenClaw 2026.4.2, Slack thread starter and thread-history context fetched through the API was not filtered by the effective sender allowlist. Messages from non-allowlisted senders could still enter the agent context when an allowlisted user replied in the same thread. Impact A Sla...

OpenClaw: Slack thread context could include messages from non-allowlisted senders

Summary Before OpenClaw 2026.4.2, Slack thread starter and thread-history context fetched through the API was not filtered by the effective sender allowlist. Messages from non-allowlisted senders could still enter the agent context when an allowlisted user replied in the same thread. Impact A Sla...

NPM: OpenClaw: Slack thread context could include messages from non-allowlisted senders

NPM: OpenClaw: Slack thread context could include messages from non-allowlisted senders vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.1...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41358 via openclaw (>=2026.3.22, <=2026.4.1)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41358 Source advisory: OSV:GHSA-QM77-8QJP-4VCM...

The vulnerability of the Webhook component of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) allows a violator to trigger a service failure.

The vulnerability of the Webhook component of the AI agent OpenClaw formerly known as ClawdBot or MoltBot relates to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the Nextcloud Talk plugin with the AI agent OpenClaw (previously known as ClawdBot or MoltBot) allows a hacker to bypass existing security mechanisms.

The vulnerability of the Nextcloud Talk plugin and the AI agent OpenClaw previously known as ClawdBot or MoltBot is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...

The vulnerability of the WebSocket-server of the Gateway AI-agent OpenClaw (formerly known as ClawdBot or MoltBot) allows a perpetrator to execute arbitrary code.

The vulnerability of the WebSocket-server of the OpenClaw AI agent formerly known as ClawdBot or MoltBot is related to an uncontrolled element in the search path. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) arises from an incorrect restriction on the path name to the catalog, allowing attackers to write arbitrary files.

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to an incorrect restriction on the path name to the catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

The vulnerability of the Telegram channel for the AI agent OpenClaw (formerly ClawdBot or MoltBot) allows a hacker to bypass existing security mechanisms.

The vulnerability of the Telegram channel of the AI agent OpenClaw formerly ClawdBot or MoltBot is related to an incorrect authorization process based on a list of permitted senders. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...