Qclawer

A scope containment bypass exists in the device re-pairing process. Authenticated operators can restore or retain broader scopes than intended by submitting re-pairing requests with empty scope sets, which allows them to skip containment guards and maintain unauthorized device access. This issue occurs when the affected feature is enabled and reachable, though the practical impact depends on the operator's configuration and the accessibility of the path to lower-trust input.

An issue in internal and webchat command authentication allows senders to inherit wildcard `ownerAllowFrom` state across channel boundaries. This enables attackers to send commands on affected internal or webchat paths to execute owner-style command behavior outside the intended channel scope, potentially bypassing access controls.

Insufficient scope validation in the Active Memory write scope allows Gateway operators with `operator.write` access to modify global configuration. This privilege escalation enables users to apply unauthorized configuration changes without requiring `operator.admin` privileges.

A session visibility check bypass exists in the shared memory search of the memory-wiki feature. This allows authenticated callers to skip session visibility guards on the search path, enabling them to retrieve memory entries that should not be visible to their session without proper authorization.

A hook bypass issue exists where skill commands routed through a specific dispatch path skip the `runBeforeToolCallHook` coverage. This allows attackers to send skill commands through the affected path to bypass hook-based auditing and policy enforcement mechanisms. The impact depends on the operator's configuration and whether lower-trust input can reach the vulnerable path.

A control scope enforcement bypass exists in the focus command. This allows authenticated callers to execute the command without proper authorization checks, enabling them to change the focus state outside of the intended caller authority. The practical impact depends on the gateway configuration and whether lower-trust input can reach the affected path.

An input validation issue exists in tool group policy callers that accept unvalidated group IDs. An attacker capable of supplying a group ID to the policy resolver could trigger incorrect group-policy decisions for tool invocations, which may lead to the bypass of intended access controls. The practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

The macOS Swift exec feature contains an allowlist bypass. The issue occurs because the system fails to account for combined POSIX inline-command flags, which are shorthand ways of grouping multiple command-line options together. This allows attackers to execute shell content that bypasses the intended allowlist checks, potentially leading to unauthorized command execution depending on the operator configuration.

Improper access control in Mattermost event handlers occurs due to a failure to validate channel type metadata. This allows attackers to bypass intended Direct Message (DM) policy decisions by sending crafted Mattermost events that lack channel type information to process restricted content.

An authorization bypass exists in native command handling. This allows authenticated senders to execute owner-only commands by bypassing configured owner-command access controls, enabling the execution of privileged commands by unauthorized users.

An authorization bypass exists in QQBot pre-dispatch slash commands. This issue allows authenticated senders to skip `allowFrom` policy checks, enabling them to invoke slash commands before configured access control policies are applied. Depending on the operator configuration, this may trigger command handling from senders who should be blocked.

A configuration enforcement bypass exists in Feishu dynamic-agent bindings. This issue allows authenticated senders to create or update bindings without adhering to the configured config-write controls. By leveraging the dynamic-agent binding feature, an attacker can modify the sender-agent binding state beyond the intended policy, which may lead to unauthorized binding modifications.

An authorization bypass exists in Telegram interactive callbacks. Authenticated users can bypass the `commands.allowFrom` validation by invoking affected callbacks to mark themselves as authorized senders before allowlist checks are applied. This allows the execution of command behavior that ignores configured Telegram sender restrictions.

An authorization bypass exists in the MCP loopback feature. This allows non-owner callers to circumvent owner-only tool policies and before-tool-call hooks. When the feature is enabled and reachable, attackers can use the affected loopback path to invoke owner-only behavior and execute restricted tools.

An approval policy bypass exists in the Skill Workshop apply flow. This issue allows agent tool calls to set the `apply` variable to `true` even when the `approvalPolicy` is configured as `pending`. An attacker can reach the affected apply path to implement workshop changes before the required approval step, which may lead to unauthorized configuration modifications.

A policy bypass exists in the embedded runner policy. This issue allows requests using provider aliases to be compared against aliases rather than canonical provider identities. When the affected feature is enabled, this confusion can be exploited to obtain bundled tool access that exceeds the intended provider policy restrictions.

An authorization bypass exists in Matrix room control-command authorization due to improper trust in DM pairing-store entries. Attackers possessing DM-paired sender IDs can execute room control commands by posting in bot rooms, bypassing configured allowlists and potentially triggering privileged behavior.

A message classification issue exists in Feishu card-action callbacks where direct messages are incorrectly identified as group conversations. This allows attackers to bypass `dmPolicy` enforcement by triggering card-action flows within direct message conversations that should have been blocked by restrictive policies.

OpenClaw fails to properly preserve untrusted labels for isolated cron awareness events. This allows output from cron agents triggered by webhooks to be recorded as trusted system events. This trust-labeling issue can be exploited to enhance prompt-injection attacks by making untrusted events appear as trusted System events.

A guard bypass exists in the agent-facing gateway endpoints "config.patch" and "config.apply". This issue fails to protect operator-trusted settings, including sandbox policy, plugin enablement, gateway auth/TLS, hook routing, MCP server configuration, SSRF policy, and filesystem hardening. A prompt-injected model with access to the owner-only gateway tool can persist unauthorized changes to these protected operator settings.