openclaw@2026.6.35

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the download-file handler, which fails open when a file lacks the share metadata used to prove it belongs to the requested conversation. An authenticated caller restricted to a single conversation can download file contents from outside that conversation's scope by supplying a known file identifier, disclosing data across configured conversation boundaries. The issue does not allow listing arbitrary Slack files and does not bypass Slack authentication itself.

Upgrade openclaw to version 2026.8.1 or higher.

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Incorrect Authorization via glob metacharacter interpretation and node display name reuse in file-transfer allow-always approvals. When an operator approves a file-transfer request, a later agent request can reuse that standing grant to access sibling paths or different nodes that were never shown in the original approval. Literal path characters in the approved path can subsequently be interpreted as glob syntax, and node-specific grants can be reused by any other node sharing the same display name, broadening durable read or write access beyond the operator's intended scope.

Note: Exploitation requires a prior operator allow-always approval and a matching widened target (a sibling path reachable via glob expansion, or a different node with the same display name).

Upgrade openclaw to version 2026.8.1 or higher.

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the OpenAI-compatible transport layer, when a pinned third-party provider session whose resolved model metadata lacks a concrete base URL continues after a model configuration hot reload. Under this condition, the session retains the third-party provider's credential while the OpenAI SDK falls back to its own default endpoint, causing a request to be sent to an unrelated provider endpoint carrying that credential. The disclosure results in a failed request with a misleading authentication error, and the exposed credential should be rotated.

Note: This is only exploitable when a third-party provider uses an OpenAI-compatible API, the resolved model metadata lacks an explicit provider base URL, and an existing pinned session continues after model configuration is reloaded.

Upgrade openclaw to version 2026.8.1 or higher.

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Browser extension relay, which reserves entries in a single global pending-authentication pool before a client proves possession of the relay key. An unauthenticated network source can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions from completing Browser Relay Authentication v2. The issue does not disclose the relay key, browser data, or authenticated relay capability.

Upgrade openclaw to version 2026.8.2 or higher.

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the handleAgentDeepLink function in NodeAppModel.swift, where the full deep-link URL (including any sensitive parameters or tokens embedded in the URL) is written to the application log via deepLinkLogger.info with privacy: .public, making it readable to any process or user with access to the device logs. An attacker with local log-read access can recover deep-link URLs processed by the application.

Upgrade openclaw to version 2026.9.1 or higher.

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via incorrect classification of alternate file: URL spellings in the Agent Client Protocol (ACP) handler. Alternate but valid file: URL forms are treated as relative paths and incorrectly scoped to the session working directory, allowing an untrusted or compromised ACP peer to request a read of files outside that directory without triggering the approval prompt normally required for such paths. The result is disclosure of local file contents to the peer.

Note: This is only exploitable when an operator connects openclaw acp client to an untrusted or compromised ACP peer.

Upgrade openclaw to version 2026.8.1 or higher.

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the memory embedding failover logic, where the primary embedding provider's configured API key is reused when a request is redirected to a fallback provider. When remote embedding fallback is configured and the primary provider fails, the credential is transmitted as a bearer token to an unintended vendor. The practical impact depends on the configured providers, whether failover occurs, and the privileges attached to the primary provider key.

Note: This is only exploitable when remote embedding fallback is configured and the primary embedding provider fails, causing a cross-provider failover.

Upgrade openclaw to version 2026.8.1 or higher.

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Directory Traversal via double-decoding of QQBot voice attachment filenames, where encoded traversal segments reappear after sanitization. An attacker who can supply a voice attachment through a remote QQ sender can cause the agent to write attacker-controlled bytes outside the intended voice staging directory to any other process-writable location.

Upgrade openclaw to version 2026.8.1 or higher.

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Missing Authorization via the /mcp set and /mcp unset chat commands, which fail to enforce owner-level authorization checks on non-owner external-channel senders. An authenticated non-owner user can persist arbitrary stdio MCP server configuration entries that execute with the OpenClaw process user's privileges when MCP configuration loads. This allows an attacker to compromise host confidentiality, integrity, and availability.

Upgrade openclaw to version 2026.7.1 or higher.

openclaw is a 🦞 OpenClaw — Personal AI Assistant

Affected versions of this package are vulnerable to Incorrect Authorization via reusable exec approvals that fail to bind the working directory context to the approval record. When an operator grants an allow-always approval for a command, the approval is matched solely on command arguments without recording the working directory, allowing an agent to reuse that approval to execute the same command in a different directory against files or repositories the operator never reviewed. The approved command can therefore produce materially different read or write effects than those the operator originally authorized.

Upgrade openclaw to version 2026.8.1 or higher.