Edward-X

A flaw in the webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the `WEBHOOK AUTH ENABLE` configuration is set to False, which is the default setting. A remote attacker who knows a flow's UUID can execute it as the owner, potentially leading to Remote Code Execution (RCE), a state where an attacker can execute arbitrary commands on the host machine.

An authorization bypass exists in the MCP loopback feature. This issue allows lower-trust callers to execute tools reserved for the owner by utilizing configured input paths, enabling the execution or persistence of actions that exceed the caller's intended permissions.

An authorization bypass exists where WhatsApp group IDs can satisfy elevated sender allowlists. This allows attackers with lower-trust access to perform actions requiring stronger authorization by leveraging group ID validation.

The incremental HTML parser `html.parser.HTMLParser` contains an issue that allows for CPU denial-of-service when processing uncontrolled data. The root cause is improper input handling that leads to pathological parsing behavior, specifically algorithmic complexity and resource exhaustion, when markup declarations are repeatedly left unterminated. An attacker can exploit this by providing crafted HTML to any service or pipeline using `HTMLParser`, which can result in CPU core exhaustion and the degradation or complete failure of affected applications.

A sender policy bypass exists in BlueBubbles where participants can match allowlist entries using conversation metadata instead of a stable sender identity. Attackers capable of influencing conversation-level identifiers can receive agent responses intended for configured senders, which may lead to the bypass of access controls.

A notification bypass allows Slack reaction events to enter the agent pipeline even when reaction notifications are disabled. This can trigger unintended agent processing for reaction events, potentially leading to the unauthorized processing of lower-trust input. This issue occurs when the affected feature is enabled and reachable.

An allowlist bypass exists in shell inline-command parsing. A command request using shell inline-command forms can route through a parser case that misses the expected allowlist decision, allowing authenticated operators to execute unapproved shell content without the intended approval prompts.

An information disclosure issue exists in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers, such as API keys or tenant-routing credentials, to attacker-controlled origins. This occurs in deployments where an MCP server is configured with `transportType: "streamable-http"` and sensitive custom headers under `mcp.servers.*.headers`. The issue is limited to configured MCP Streamable HTTP servers using custom headers and does not expose unrelated credentials.

Exported session HTML preserves unsafe `javascript:` and `data:` links in generated content. This allows for the execution of browser-side scripts if a trusted operator opens the exported file and activates a malicious link. The impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

A bootstrap token replay issue allows callers with access to a pending bootstrap token to reuse it before approval with a broader requested scope. This can lead to the escalation of pairing authority beyond the intended scope limits. The impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

A state mutation issue exists in the node pairing reconnection process. This allows paired nodes to confuse approval scope decisions, enabling attackers to exploit reconnection logic to restore or present broader node authority than intended, which can lead to the bypass of approval restrictions.

An allowlist bypass exists in the handling of PowerShell encoded commands. Remote authenticated operators can evade security controls by using abbreviated flag aliases that are not recognized by the allowlist parser, enabling the execution of arbitrary PowerShell content.

A shell option parsing issue allows combined POSIX shell flags to bypass exec revalidation checks. This enables attackers to execute inline shell content without the intended allowlist validation, potentially leading to unauthorized command execution when the affected feature is enabled.

An environment variable injection issue exists in the CLI backend runner. Attackers can use malicious workspace configurations to inject arbitrary environment variables into the backend process spawning, which may lead to code execution or the exposure of sensitive data.

An agentic consent bypass allows LLM agents to silently disable execution approval. Remote attackers can exploit this by using the `config.patch` parameter to bypass security controls and execute unauthorized operations without user consent.

Name of the Vulnerable Software and Affected Versions: OpenClaw versions prior to 2026.3.24 Description: OpenClaw versions before 2026.3.24 contain an incomplete fix for CVE-2026-27486. The `!stop` chat command uses an unpatched `killProcessTree` function from `shell-utils.ts` that sends `SIGKILL` immediately without a graceful `SIGTERM` shutdown. This can lead to data corruption, resource leaks, and skipped security-sensitive cleanup operations. The vulnerable function is located in `src/agents/shell-utils.ts` (lines 170–192) and is called by the `!stop` command handler in `src/auto-reply/reply/bash-command.ts` (lines 300-304). The issue arises because the `!stop` command imports the unpatched function instead of the corrected version in `src/process/kill-tree.ts`. A proof-of-concept demonstrates that the vulnerable function bypasses the graceful shutdown sequence, sending `SIGKILL` directly. This can affect processes writing to files, databases, or performing security-sensitive operations. Recommendations: Update to OpenClaw version 2026.3.24 or later.

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.24 Description OpenClaw versions before 2026.3.24 contain a path traversal vulnerability in its sandbox enforcement mechanism. This allows sandboxed agents to read arbitrary files from other agents' workspaces by exploiting unnormalized `mediaUrl` or `fileUrl` parameter keys. The vulnerability arises from incomplete parameter validation in the `normalizeSandboxMediaParams` function and the omission of `mediaLocalRoots` from the dispatch context in `handlePluginAction`. An attacker can leverage this to access sensitive files, including API keys and configuration data, outside of the designated sandbox roots. The vulnerability allows a sandboxed agent to read files from other agents' workspaces by using the `mediaUrl` or `fileUrl` parameter key in message tool calls. The `normalizeSandboxMediaParams` function only checks `media`, `path`, and `filePath` keys, while `mediaUrl` and `fileUrl` bypass validation. Combined with `handlePluginAction` dropping `mediaLocalRoots` from the dispatch context, this enables a full sandbox escape where any agent can read files outside its designated sandbox root. Recommendations Update to OpenClaw version 2026.3.24 or later.

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22 Description OpenClaw is susceptible to an unbounded memory allocation issue in its remote media HTTP error handling. Attackers can exploit this by sending specially crafted HTTP error responses with large content to remote media endpoints. This causes the application to allocate an excessive amount of memory before error handling can take place, potentially leading to application failure. Recommendations Update to version 2026.3.22 or later.

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22 Description A flaw exists in OpenClaw that allows attackers to bypass restrictions on executable bindings. This is achieved by misusing time wrappers within the system.run approvals functionality. Specifically, the vulnerability lies in the failure to properly unwrap `/usr/bin/time` wrappers, enabling an allowlist bypass. Attackers can reuse approval state for inner commands by utilizing an unregistered time wrapper. Recommendations Update to version 2026.3.22 or later.

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.2 Description The `image` tool did not fully enforce the `tools.fs.workspaceOnly` filesystem boundary. This allowed traversal of sandbox bridge mounts outside the workspace, enabling reading of files that other filesystem tools would reject. Recommendations Update to version 2026.3.2 or later.