CVE-2026-100568

OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secret...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the admin.extensions.php process. An attacker can cause unauthorized installation, update, pause, or unpause of extensions by tricking an authenticated administrator into visiting a crafted malicious...

CVE-2026-100599

OpenClaw versions 2026.5.1 through 2026.7.0 are vulnerable to Remote Code Execution because the googlemeet.chrome command fails to apply the configured exec approval path. The command accepts caller-supplied audio command arrays and executes them on a paired node, bypassing the standard system.ru...

CVE-2026-100594 OpenClaw before 2026.7.1 Authorization Bypass via trajectory export

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadat...

CVE-2026-100586

Versions of OpenClaw Codex prior to 2026.7.1 are vulnerable to an authorization bypass when creating native conversation bindings. The root cause is a failure to properly enforce owner authorization, allowing non-owner channel senders with command access to create bindings to the native Codex run...

CVE-2026-100582

OpenClaw channel plugins (@openclaw/msteams , @openclaw/feishu , @openclaw/matrix , and @openclaw/googlechat ) versions prior to 2026.8.1 fail to enforce configured channel read allowlists for caller-supplied explicit read targets. This flaw affects actions involving messages, reactions, pins, me...

CVE-2026-100582 OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass

OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...

CVE-2026-100575

OpenClaw Slack versions before 2026.8.1 contain a vulnerability where multi-person direct messages fail to properly enforce sender allowlists . This flaw allows disallowed participants to bypass configured sender policies, enabling them to trigger Slack agents and gain unauthorized access to the ...

CVE-2026-100568 OpenClaw before 2026.8.1 Unauthorized Command Job Access

OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secret...

CVE-2026-100568

OpenClaw versions prior to 2026.8.1 are vulnerable to unauthorized access to operator command cron jobs. The root cause is a failure to properly restrict access, which allows model-visible agent callers to read and execute ownerless command jobs. This flaw enables attackers to inspect stored envi...

CVE-2026-100568 OpenClaw before 2026.8.1 Unauthorized Command Job Access

OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secret...

CVE-2026-100566

OpenClaw LINE versions prior to 2026.8.1 are susceptible to an access control vulnerability . The issue arises because the group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. This allows attackers with group participation to trigger the age...

CVE-2026-100566 OpenClaw LINE before 2026.8.1 Access Control Inheritance

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restriction...

CVE-2026-100559

Versions of OpenClaw prior to 2026.8.1 are vulnerable to a command parser vulnerability . The root cause is that escaped newlines confuse the exec allowlist parsing logic. An attacker can craft malicious input using these escaped newlines to bypass allowlist validation, leading to the execution o...

PT-2026-99349

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.5 Description Insufficient enforcement of account-level attempt limits during MFA login challenges allows attackers with a valid password to guess TOTP Time-based One-Time Password codes. Because rate limiting ...

PT-2026-99211

Name of the Vulnerable Software and Affected Versions OpenClaw Slack versions prior to 2026.8.1 Description Multi-person direct messages fail to properly enforce sender allowlists. This allows unauthorized participants to bypass configured sender policies, enabling them to trigger Slack agents an...

PT-2026-99288

Name of the Vulnerable Software and Affected Versions capgo.app affected versions not specified Description The application fails to validate that principals within channel permission overrides are members of the organization. This allows authenticated app or organization administrators to grant...

PT-2026-99215

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description The software incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments, which are authentication modes that honor caller identity and narrower operator...

PT-2026-99218

Name of the Vulnerable Software and Affected Versions @openclaw/msteams versions prior to 2026.8.1 @openclaw/feishu versions prior to 2026.8.1 @openclaw/matrix versions prior to 2026.8.1 @openclaw/googlechat versions prior to 2026.8.1 Description Channel plugins fail to enforce the configured...

CVE-2026-100568: Exposure of Sensitive Information to an Unauthorized Actor

OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secret...