openclaw 2026.2.22 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the openclaw package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Symlink Attack openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Symlink Attack via the `agents.files.get` and `agents.files.set` methods. An attacker can access or modify files outside the intended workspace by exploiting symlink traversal, potentially leading to unauthorized file read or write operations within the permissions of the gateway process. This may result in further compromise, including the possibility of executing arbitrary code, depending on which files are targeted. How to fix Symlink Attack? Upgrade `openclaw` to version 2026.2.25 or higher.	<2026.2.25
M Incorrect Authorization openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the `exec.approval` requests. An attacker can gain unauthorized access to execute actions on unintended nodes by replaying approval requests across different nodes within the same operator-controlled gateway fleet. How to fix Incorrect Authorization? Upgrade `openclaw` to version 2026.2.23 or higher.	<2026.2.23
M Symlink Attack openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Symlink Attack in the handling of browser trace and download output paths, specifically when processing temporary output. An attacker can overwrite arbitrary files by exploiting symlink traversal in the output path configuration. How to fix Symlink Attack? Upgrade `openclaw` to version 2026.2.25 or higher.	<2026.2.25
M Protection Mechanism Failure openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Protection Mechanism Failure through improper validation of the `docker.network` configuration parameter. An attacker can gain unauthorized access to internal network resources by specifying `network=container:<id>` and joining another container's network namespace. How to fix Protection Mechanism Failure? Upgrade `openclaw` to version 2026.2.24 or higher.	<2026.2.24
H Time-of-check Time-of-use (TOCTOU) Race Condition openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the `host=node` executions. An attacker can execute commands from an unintended filesystem location by rebinding a writable parent symlink in `cwd` between approval and execution, thereby bypassing intended approval context. How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? Upgrade `openclaw` to version 2026.2.26 or higher.	<2026.2.26
H Incorrect Authorization openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the `system.run` approvals. An attacker can cause execution of an unintended binary by crafting a command with a trailing-space in the executable token and obtaining or reusing a matching approval context, leading to execution of a different binary than what was displayed to the approver. How to fix Incorrect Authorization? Upgrade `openclaw` to version 2026.2.25 or higher.	<2026.2.25
H Directory Traversal openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via the `sendAttachment` and `setGroupIcon` message actions when `sandboxRoot` is unset. An attacker can read arbitrary files accessible to the runtime user by triggering authorized message-action paths that hydrate media from local absolute paths, bypassing intended local media root checks. How to fix Directory Traversal? Upgrade `openclaw` to version 2026.2.24 or higher.	<2026.2.24
M Off-by-one Error openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Off-by-one Error in the `allowlist` mode. An attacker can execute unintended commands by bypassing operator safety controls using specially crafted input to `env -S` when `/usr/bin/env` is allowlisted. This can result in a mismatch between policy analysis and runtime execution, potentially enabling shell-wrapper payloads to be executed. How to fix Off-by-one Error? Upgrade `openclaw` to version 2026.2.23 or higher.	<2026.2.23
H Incorrect Authorization openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the paired node device reconnect. An attacker can gain unauthorized access to restricted commands by spoofing the `platform` or `deviceFamily` metadata during a reconnect attempt. This is only exploitable if the attacker already possesses a paired node identity on the trusted network and the node command policy differs by platform. How to fix Incorrect Authorization? Upgrade `openclaw` to version 2026.2.26 or higher.	<2026.2.26
M Insertion of Sensitive Information Into Sent Data openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the OAuth onboarding process in the macOS beta application, where the PKCE `code_verifier` was exposed as the OAuth `state` in the URL. An attacker can obtain sensitive authentication information by intercepting the front-channel URL during the onboarding flow. How to fix Insertion of Sensitive Information Into Sent Data? Upgrade `openclaw` to version 2026.2.25 or higher.	<2026.2.25
M Access Control Bypass openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Access Control Bypass in the `sessions_spawn` sandboxed session. An attacker can bypass intended sandbox restrictions by spawning a child process under an agent with sandboxing disabled, resulting in reduced runtime confinement. How to fix Access Control Bypass? Upgrade `openclaw` to version 2026.3.1 or higher.	<2026.3.1
M Incorrect Authorization openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the stop triggers and `/models` command. An attacker can disrupt active sessions and access sensitive model or authentication metadata by sending unauthorized requests to these command paths. How to fix Incorrect Authorization? Upgrade `openclaw` to version 2026.3.1 or higher.	<2026.3.1
M Allocation of Resources Without Limits or Throttling openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Zalo webhook. An attacker can exhaust system memory and cause process instability or termination by sending unauthenticated requests with varying query-string keys to the webhook endpoint. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `openclaw` to version 2026.3.1 or higher.	<2026.3.1
H Missing Authorization openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization through an authorization mismatch in the agent. An attacker can perform privileged control-plane actions beyond their intended write scope by invoking owner-only tool surfaces such as `gateway` and `cron` with write-scope agent runs. How to fix Missing Authorization? Upgrade `openclaw` to version 2026.3.1 or higher.	<2026.3.1
L Incorrect Authorization openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the group allowlist authorization. An attacker can gain unauthorized access to group communications by leveraging DM pairing-store approvals to bypass explicit group allowlist checks. How to fix Incorrect Authorization? Upgrade `openclaw` to version 2026.2.26 or higher.	<2026.2.26
M Incorrect Authorization openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the approval-enabled `host=node` workflows. An attacker can bypass intended approval integrity by reusing a previously approved request with altered environment input, potentially leading to unauthorized command execution or manipulation. How to fix Incorrect Authorization? Upgrade `openclaw` to version 2026.2.26 or higher.	<2026.2.26
H Time-of-check Time-of-use (TOCTOU) Race Condition openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the media attachment handling. An attacker can access files outside the intended sandbox boundary by exploiting a race condition between path validation and file read operations, such as by retargeting a symlink between the check and use steps. How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? Upgrade `openclaw` to version 2026.3.1 or higher.	<2026.3.1
M Interpretation Conflict openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Interpretation Conflict via the `platform` or `deviceFamily` metadata fields. An attacker can expand node command availability beyond intended defaults by supplying Unicode-confusable values that pass metadata pinning but are classified differently during policy resolution. How to fix Interpretation Conflict? Upgrade `openclaw` to version 2026.3.1 or higher.	<2026.3.1
H Time-of-check Time-of-use (TOCTOU) Race Condition openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the `writeFileWithinRoot` function. An attacker can create or truncate files outside the intended root directory by exploiting a race condition between symlink resolution and file write operations. How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? Upgrade `openclaw` to version 2026.3.1 or higher.	<2026.3.1
M Incorrect Authorization openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the `resolvePermissionRequest`, `resolveToolNameForPermission`, and `shouldAutoApproveToolCall` functions. An attacker can gain unauthorized access to resources by crafting tool calls with spoofed metadata or non-core read-like names that bypass interactive approval prompts. How to fix Incorrect Authorization? Upgrade `openclaw` to version 2026.2.23-beta.1 or higher.	<2026.2.23-beta.1
H Incomplete List of Disallowed Inputs openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the `tools.exec.safeBins` validation when validating options for `sort`. An attacker can execute unauthorized commands by supplying GNU long-option abbreviations (such as `--compress-prog`) that bypass the intended approval mechanism. Note: This is exploitable only if all of these conditions are present: `tools.exec.security=allowlist`, `tools.exec.ask=on-miss`. How to fix Incomplete List of Disallowed Inputs? Upgrade `openclaw` to version 2026.2.23 or higher.	<2026.2.23

Vulnerability

Vulnerable Version

Symlink Attack