Nathan

The `loadIndex()` function fails to verify if the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can provide a crafted index file where the element count exceeds the stored capacity, leading to a heap buffer overflow. This occurs because the loader writes data beyond the allocated buffer, which can result in an application crash.

An authorization bypass exists in Matrix room control-command authorization due to improper trust in DM pairing-store entries. Attackers possessing DM-paired sender IDs can execute room control commands by posting in bot rooms, bypassing configured allowlists and potentially triggering privileged behavior.

An environment variable injection allows the workspace dotenv to override the `MINIMAX API HOST` variable. This enables attackers to redirect credentialed MiniMax API requests to origins under their control, which exposes the MiniMax API key contained in the Authorization headers.

An improper cache isolation issue exists in the Zalo webhook replay-dedupe mechanism, which is shared across authenticated webhook targets. In multi-account deployments, an attacker controlling one authenticated Zalo webhook path can suppress legitimate events on other accounts by matching the `event name` and `message id` parameters.

An improper access control issue exists in the iOS A2UI bridge, which incorrectly treats generic local-network pages as trusted origins. This allows attackers to inject unauthorized `agent.request` runs by loading attacker-controlled pages from tailnet hosts or the local network, leading to session state pollution and budget consumption.

An authorization bypass exists in Discord slash command and autocomplete paths that fail to enforce group DM channel allowlist restrictions. This allows authorized Discord users to bypass channel restrictions by invoking slash commands, granting access to restricted group DM channels.

Workspace .env files can override the `OPENCLAW BUNDLED PLUGINS DIR` environment variable, which compromises the verification of plugin trust. This allows attackers who have control over the workspace configuration to inject malicious plugins by overriding the bundled plugin trust root directory.

A wide-area discovery issue allows arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-tailnet position and CA-trusted endpoint access can exfiltrate operator credentials by manipulating DNS steering.

A logic error exists in the Discord component interaction routing within the file extensions/discord/src/monitor/agent-components-helpers.ts. This issue causes group direct messages to be misclassified as direct messages, which allows attackers to bypass group DM policy enforcement or trigger incorrect session handling.

Workspace .env files can override the `OPENCLAW BUNDLED HOOKS DIR` environment variable, which allows the loading of attacker-controlled hook code. This enables attackers to replace trusted default-on bundled hooks from untrusted workspaces to execute arbitrary code.

The public LINE webhook path lacks a shared pre-authentication concurrency budget. This allows remote attackers to flood the webhook endpoint with concurrent requests before signature verification occurs, leading to resource exhaustion and transient loss of service availability.

Insufficient sanitization of the `PIP INDEX URL` and `UV INDEX URL` environment variables in host execution contexts allows attackers to redirect Python package-index traffic. This can lead to the interception or manipulation of package management operations by injecting malicious index URLs.

An execution approval issue exists in `exec-approvals-allowlist.ts` where allow-always persistence trusts wrapper carrier executables instead of the actual invoked targets. This allows attackers to use positional carrier executable routing through dispatch wrappers to create broader allowlist entries than intended, which weakens execution approval boundaries.

An authentication bypass exists in the remote onboarding component. The system persists unauthenticated discovery endpoints without requiring explicit trust confirmation. This allows attackers to spoof discovery endpoints to redirect onboarding processes toward malicious gateways, potentially capturing gateway credentials or traffic.

OpenClaw fails to consistently apply guild and channel policy gates to Discord button and component interactions. This allows attackers to bypass channel policy enforcement and trigger privileged component actions from blocked contexts.

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.13 through 2026.3.24 Description OpenClaw contains an ANSI escape sequence injection vulnerability in approval prompts. Attackers can spoof terminal output through malicious tool titles, as untrusted tool metadata can carry ANSI control sequences into approval prompts and permission logs. This allows manipulation of displayed information. Recommendations Update to version 2026.3.25 or later.

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.3.11 through 2026.3.24 Description OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass. The `session status` function resolves `sessionId` to canonical session keys before enforcing visibility checks. This allows sandboxed child sessions to access parent or sibling sessions that should be blocked by explicit sessionKey restrictions. Recommendations Update to a version later than 2026.3.24.

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22 Description OpenClaw contains a webhook reply delivery issue that allows attackers to redirect chat replies to unintended users. This is possible because the system uses mutable username matching instead of stable numeric user identifiers. By manipulating username changes, attackers can redirect webhook-triggered replies, bypassing the intended recipient binding recorded in webhook events. Recommendations Update to version 2026.3.22 or later.

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22 Description The software contains a service discovery issue where TXT metadata from Bonjour and DNS-SD could influence command-line interface (CLI) routing even when service resolution failed. Attackers can exploit unresolved hints to redirect routing decisions to unintended targets by providing malicious discovery metadata. Recommendations Update to version 2026.3.22 or later.

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22 Description OpenClaw contains a privilege escalation issue in the Control UI. Unauthenticated sessions can retain self-declared privileged scopes without device identity verification. Attackers can exploit the trusted-proxy mechanism's device-less allow path to maintain elevated permissions by declaring arbitrary scopes, bypassing device identity requirements. Recommendations Update to version 2026.3.22 or later.