Qclawer

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.25 **Description** A scope containment bypass exists in the device re-pairing process. Authenticated operators can restore or retain broader scopes than intended by submitting re-pairing requests with empty scope sets, which allows them to skip containment guards and maintain unauthorized device access. This issue occurs when the affected feature is enabled and reachable, though the practical impact depends on the operator's configuration and the accessibility of the path to lower-trust input. **Recommendations** Update to version 2026.4.25. Revoke unexpected device sessions and require fresh pairing for suspicious devices. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the device re-pairing feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.25 **Description** An issue in internal and webchat command authentication allows senders to inherit wildcard `ownerAllowFrom` state across channel boundaries. This enables attackers to send commands on affected internal or webchat paths to execute owner-style command behavior outside the intended channel scope, potentially bypassing access controls. **Recommendations** Update to version 2026.4.25. Keep owner command allowlists explicit per channel. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** Insufficient scope validation in the Active Memory write scope allows Gateway operators with `operator.write` access to modify global configuration. This privilege escalation enables users to apply unauthorized configuration changes without requiring `operator.admin` privileges. **Recommendations** Update to version 2026.5.6. Limit Active Memory write access to trusted operators. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the Active Memory write feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.29 **Description** A session visibility check bypass exists in the shared memory search of the memory-wiki feature. This allows authenticated callers to skip session visibility guards on the search path, enabling them to retrieve memory entries that should not be visible to their session without proper authorization. **Recommendations** Update to version 2026.4.29. Limit shared memory search to trusted operators. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the shared memory search feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** A hook bypass issue exists where skill commands routed through a specific dispatch path skip the `runBeforeToolCallHook` coverage. This allows attackers to send skill commands through the affected path to bypass hook-based auditing and policy enforcement mechanisms. The impact depends on the operator's configuration and whether lower-trust input can reach the vulnerable path. **Recommendations** Update to version 2026.5.6. Avoid relying on hook-only enforcement for skill commands. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.25 **Description** A control scope enforcement bypass exists in the focus command. This allows authenticated callers to execute the command without proper authorization checks, enabling them to change the focus state outside of the intended caller authority. The practical impact depends on the gateway configuration and whether lower-trust input can reach the affected path. **Recommendations** Update to version 2026.4.25. Restrict focus command access to trusted operators. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the focus command feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.25 **Description** An input validation issue exists in tool group policy callers that accept unvalidated group IDs. An attacker capable of supplying a group ID to the policy resolver could trigger incorrect group-policy decisions for tool invocations, which may lead to the bypass of intended access controls. The practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path. **Recommendations** Update to version 2026.4.25. Avoid exposing group-policy controlled tools to untrusted senders. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** The macOS Swift exec feature contains an allowlist bypass. The issue occurs because the system fails to account for combined POSIX inline-command flags, which are shorthand ways of grouping multiple command-line options together. This allows attackers to execute shell content that bypasses the intended allowlist checks, potentially leading to unauthorized command execution depending on the operator configuration. **Recommendations** Update to version 2026.5.6. Require approval for combined shell flag forms on macOS. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the macOS Swift exec feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** Improper access control in Mattermost event handlers occurs due to a failure to validate channel type metadata. This allows attackers to bypass intended Direct Message (DM) policy decisions by sending crafted Mattermost events that lack channel type information to process restricted content. **Recommendations** Update to version 2026.5.6.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** An authorization bypass exists in native command handling. This allows authenticated senders to execute owner-only commands by bypassing configured owner-command access controls, enabling the execution of privileged commands by unauthorized users. **Recommendations** Update to version 2026.5.6.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.27 **Description** An authorization bypass exists in QQBot pre-dispatch slash commands. This issue allows authenticated senders to skip `allowFrom` policy checks, enabling them to invoke slash commands before configured access control policies are applied. Depending on the operator configuration, this may trigger command handling from senders who should be blocked. **Recommendations** Update to version 2026.4.27.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** A configuration enforcement bypass exists in Feishu dynamic-agent bindings. This issue allows authenticated senders to create or update bindings without adhering to the configured config-write controls. By leveraging the dynamic-agent binding feature, an attacker can modify the sender-agent binding state beyond the intended policy, which may lead to unauthorized binding modifications. **Recommendations** Update to version 2026.5.6.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** An authorization bypass exists in Telegram interactive callbacks. Authenticated users can bypass the `commands.allowFrom` validation by invoking affected callbacks to mark themselves as authorized senders before allowlist checks are applied. This allows the execution of command behavior that ignores configured Telegram sender restrictions. **Recommendations** Update to version 2026.5.6.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.24 **Description** An authorization bypass exists in the MCP loopback feature. This allows non-owner callers to circumvent owner-only tool policies and before-tool-call hooks. When the feature is enabled and reachable, attackers can use the affected loopback path to invoke owner-only behavior and execute restricted tools. **Recommendations** Update to version 2026.4.24. As a temporary workaround, disable the MCP loopback feature to prevent unauthorized execution of restricted tools.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** An approval policy bypass exists in the Skill Workshop apply flow. This issue allows agent tool calls to set the `apply` variable to `true` even when the `approvalPolicy` is configured as `pending`. An attacker can reach the affected apply path to implement workshop changes before the required approval step, which may lead to unauthorized configuration modifications. **Recommendations** Update to version 2026.5.6.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.25 **Description** A policy bypass exists in the embedded runner policy. This issue allows requests using provider aliases to be compared against aliases rather than canonical provider identities. When the affected feature is enabled, this confusion can be exploited to obtain bundled tool access that exceeds the intended provider policy restrictions. **Recommendations** Update to version 2026.4.25.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.15 **Description** An authorization bypass exists in Matrix room control-command authorization due to improper trust in DM pairing-store entries. Attackers possessing DM-paired sender IDs can execute room control commands by posting in bot rooms, bypassing configured allowlists and potentially triggering privileged behavior. **Recommendations** Update to version 2026.4.15.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.20 **Description** A message classification issue exists in Feishu card-action callbacks where direct messages are incorrectly identified as group conversations. This allows attackers to bypass `dmPolicy` enforcement by triggering card-action flows within direct message conversations that should have been blocked by restrictive policies. **Recommendations** Update to version 2026.4.20.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.20 **Description** OpenClaw fails to properly preserve untrusted labels for isolated cron awareness events. This allows output from cron agents triggered by webhooks to be recorded as trusted system events. This trust-labeling issue can be exploited to enhance prompt-injection attacks by making untrusted events appear as trusted System events. **Recommendations** Update to version 2026.4.20.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.20 **Description** A guard bypass exists in the agent-facing gateway endpoints "config.patch" and "config.apply". This issue fails to protect operator-trusted settings, including sandbox policy, plugin enablement, gateway auth/TLS, hook routing, MCP server configuration, SSRF policy, and filesystem hardening. A prompt-injected model with access to the owner-only gateway tool can persist unauthorized changes to these protected operator settings. **Recommendations** Update to version 2026.4.20 or later.