Qc9C

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.4.25 through 2026.8.0 **Description** The workspace environment-variable filter fails to block variables ending in ` ENDPOINT`. This allows an untrusted workspace `.env` file to set the `AZURE SPEECH ENDPOINT` variable. Because Azure Speech prioritizes this value over the configured region, requests for synthesis or voice-lists send the operator's Azure Speech key in the request header to an attacker-selected endpoint. This enables the attacker to reuse the key against the operator's Azure Speech resource. Exploitation occurs when an operator starts the application in attacker-controlled workspace content while Azure Speech is configured with a key and region, and no trusted endpoint override is set. **Recommendations** Update OpenClaw to version 2026.8.1.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.3.28 through 2026.8.0 **Description** An issue exists where an untrusted workspace .env file can set the `CLOUDSDK PYTHON ARGS` environment variable. If an operator starts the software within attacker-controlled workspace content and initiates the Gmail setup flow, this value is inherited by the gcloud launcher and passed as arguments to the trusted Python interpreter. A specially crafted `CLOUDSDK PYTHON ARGS` value can lead to the execution of arbitrary code with the permissions of the host user, potentially allowing the reading of credentials, modification of files, or initiation of other processes. **Recommendations** Update to version 2026.8.1. Run Gmail setup only from trusted workspaces. Clear inherited `CLOUDSDK *` variables before starting the setup flow.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.8.1 **Description** A sandbox policy bypass exists in the MCP loopback component. This issue allows sandboxed coding-agent sessions to invoke tools that are explicitly restricted by the `sandbox.tools.deny` policy. An attacker can list and execute these denied tools to access data or perform actions that the operator intended to exclude from the sandbox environment. **Recommendations** Update to version 2026.8.1.

**Name of the Vulnerable Software and Affected Versions** openclaw versions prior to 2026.8.1 **Description** A server-side request forgery (SSRF) issue exists in the trusted-host DNS checks. When fetches utilize the trusted-host DNS recheck, a trusted hostname resolving to an unspecified address (0.0.0.0 or ::) can bypass destination validation. This allows an attacker capable of influencing DNS for an allowed hostname to direct a guarded fetch to a service bound only to the loopback interface, potentially disclosing the service response. **Recommendations** Update openclaw to version 2026.8.1.

**Name of the Vulnerable Software and Affected Versions** @openclaw/msteams versions prior to 2026.8.1 @openclaw/feishu versions prior to 2026.8.1 @openclaw/matrix versions prior to 2026.8.1 @openclaw/googlechat versions prior to 2026.8.1 **Description** Channel plugins fail to enforce the configured channel read allowlist when processing caller-supplied explicit read targets. This occurs during read actions for messages, reactions, pins, members, and related metadata. Consequently, a lower-trust sender or a steered agent with access to a channel read action can retrieve content or metadata from channels or rooms that the operator's read policy intended to exclude. The actual impact is determined by the permissions assigned to the connected bot account. **Recommendations** Update @openclaw/msteams to version 2026.8.1 or later. Update @openclaw/feishu to version 2026.8.1 or later. Update @openclaw/matrix to version 2026.8.1 or later. Update @openclaw/googlechat to version 2026.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenClaw Discord versions prior to 2026.7.1 **Description** An authorization bypass exists in guild metadata read actions. This flaw allows lower-trust senders to bypass the configured Discord read-target policy, enabling the retrieval of guild metadata from servers or channels that are excluded by channel allowlists. **Recommendations** Update OpenClaw Discord to version 2026.7.1 or later.