Dongyoon

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.6.1 through 2026.6.8 **Description** Isolated cron jobs contain a privilege escalation issue that allows lower-trust callers to regain access to denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths within the cron feature. **Recommendations** Update OpenClaw to version 2026.6.9.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.4.12-beta.1 through 2026.6.5 **Description** The MS Teams message actions feature contains a missing-authorization flaw. This allows a lower-trust caller or a configured input path to execute actions that normally require stronger authorization or policy checks. The actual impact is determined by the operator's configuration and the accessibility of the input path to lower-trust sources. **Recommendations** Update OpenClaw to version 2026.6.6.