Chinmohan Nayak

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.28 **Description** A race condition exists in the MS Teams safeFetch DNS rebinding check. When this feature is enabled and reachable, a lower-trust caller or configured input path can exploit a timing window between the DNS validation check and its subsequent use. This allows the execution of actions that should have required a stronger authorization or policy check. DNS rebinding is a technique used to bypass the Same-Origin Policy (SOP) by manipulating DNS responses to trick a browser into thinking a malicious site is a trusted one. **Recommendations** Update to version 2026.5.28 or later.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.6.6 **Description** A flaw exists in the host exec environment filtering that fails to account for interpreter startup variables. If the affected feature is enabled and accessible, a lower-trust caller or a configured input path can provide crafted environment variables to execute or maintain actions that exceed the caller's intended authorization. **Recommendations** Update OpenClaw to version 2026.6.6 or later.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.6.6 **Description** A flaw in host exec environment filtering allows the Git ext transport to be abused. If the affected feature is enabled and reachable, a lower-trust caller or a configured input path can execute or persist actions that exceed the caller's intended authorization. **Recommendations** Update to version 2026.6.6 or later.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.26 **Description** An exec allowlist bypass exists where authenticated operators can execute wrapper-level side effects outside the intended allowlisted command. This occurs because a command request reaching the exec allowlist path may be evaluated against the inner command while the wrapper invocation is still executed. This allows attackers to craft requests that leverage transparent command wrappers to perform unintended operations. **Recommendations** Update to version 2026.5.26. Review wrapper commands carefully and require approval for shell-like wrapper usage. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.26 **Description** An issue exists in hostname validation where trailing-dot notation in model or workspace-derived URLs can be used to bypass blocklist comparisons. This occurs because hostname checks treat hosts with a trailing dot inconsistently, allowing requests to reach destinations that operators intended to block through hostname policies. **Recommendations** Update to version 2026.5.26. Keep private-network and metadata destinations blocked at the proxy or network layer. Maintain narrow channel and tool allowlists. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.26 **Description** Insufficient sanitization in the host environment sanitizer allows Node.js control variables to bypass validation. Attackers with access to workspace `.env` files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables to influence child processes or coverage output paths when a process is launched under the accepted environment. **Recommendations** Update to version 2026.5.26. Avoid inheriting workspace or tool-supplied environment values from untrusted repositories. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the host environment sanitizer feature when it is not needed.