Keensecuritylab

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.18 **Description** An authorization bypass exists in the exec allowlist glob matching mechanism. This issue allows lower-trust callers to execute actions beyond their intended authorization by crafting input paths that traverse the allowlist glob patterns, enabling the execution or persistence of unauthorized actions when the affected feature is enabled. **Recommendations** Update to version 2026.5.18.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.3.28 through 2026.5.18 **Description** An authorization bypass exists in the browser act route due to improper validation of current-tab URL checks. This allows attackers with lower-trust access or configured input paths to execute actions that require stronger authorization or policy checks. **Recommendations** Update OpenClaw to version 2026.5.19.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.18 **Description** An authorization bypass exists in the skill command dispatch mechanism. This issue allows lower-trust callers to execute or persist actions that exceed their intended authorization levels. When the affected feature is enabled and reachable, attackers can bypass tool policy restrictions via configured input paths to perform unauthorized actions. **Recommendations** Update to version 2026.5.18.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.4.14 through 2026.5.25 **Description** An issue exists in the browser snapshot routes where post-navigation destinations are not properly validated. This allows attackers with lower-trust access to perform Server-Side Request Forgery (SSRF)—a technique where the server is coerced into making unauthorized requests—to bypass policy checks and access restricted network destinations. **Recommendations** Update OpenClaw to version 2026.5.26.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.25 **Description** An issue in internal and webchat command authentication allows senders to inherit wildcard `ownerAllowFrom` state across channel boundaries. This enables attackers to send commands on affected internal or webchat paths to execute owner-style command behavior outside the intended channel scope, potentially bypassing access controls. **Recommendations** Update to version 2026.4.25. Keep owner command allowlists explicit per channel. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.25 **Description** A control scope enforcement bypass exists in the focus command. This allows authenticated callers to execute the command without proper authorization checks, enabling them to change the focus state outside of the intended caller authority. The practical impact depends on the gateway configuration and whether lower-trust input can reach the affected path. **Recommendations** Update to version 2026.4.25. Restrict focus command access to trusted operators. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the focus command feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** Insufficient scope validation in the Active Memory write scope allows Gateway operators with `operator.write` access to modify global configuration. This privilege escalation enables users to apply unauthorized configuration changes without requiring `operator.admin` privileges. **Recommendations** Update to version 2026.5.6. Limit Active Memory write access to trusted operators. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the Active Memory write feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.25 **Description** A scope containment bypass exists in the device re-pairing process. Authenticated operators can restore or retain broader scopes than intended by submitting re-pairing requests with empty scope sets, which allows them to skip containment guards and maintain unauthorized device access. This issue occurs when the affected feature is enabled and reachable, though the practical impact depends on the operator's configuration and the accessibility of the path to lower-trust input. **Recommendations** Update to version 2026.4.25. Revoke unexpected device sessions and require fresh pairing for suspicious devices. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the device re-pairing feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.29 **Description** A session visibility check bypass exists in the shared memory search of the memory-wiki feature. This allows authenticated callers to skip session visibility guards on the search path, enabling them to retrieve memory entries that should not be visible to their session without proper authorization. **Recommendations** Update to version 2026.4.29. Limit shared memory search to trusted operators. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the shared memory search feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** A hook bypass issue exists where skill commands routed through a specific dispatch path skip the `runBeforeToolCallHook` coverage. This allows attackers to send skill commands through the affected path to bypass hook-based auditing and policy enforcement mechanisms. The impact depends on the operator's configuration and whether lower-trust input can reach the vulnerable path. **Recommendations** Update to version 2026.5.6. Avoid relying on hook-only enforcement for skill commands. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** The macOS Swift exec feature contains an allowlist bypass. The issue occurs because the system fails to account for combined POSIX inline-command flags, which are shorthand ways of grouping multiple command-line options together. This allows attackers to execute shell content that bypasses the intended allowlist checks, potentially leading to unauthorized command execution depending on the operator configuration. **Recommendations** Update to version 2026.5.6. Require approval for combined shell flag forms on macOS. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the macOS Swift exec feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.25 **Description** An input validation issue exists in tool group policy callers that accept unvalidated group IDs. An attacker capable of supplying a group ID to the policy resolver could trigger incorrect group-policy decisions for tool invocations, which may lead to the bypass of intended access controls. The practical impact depends on the operator's configuration and whether lower-trust input can reach the affected path. **Recommendations** Update to version 2026.4.25. Avoid exposing group-policy controlled tools to untrusted senders. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the affected feature when it is not needed.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** An authorization bypass exists in native command handling. This allows authenticated senders to execute owner-only commands by bypassing configured owner-command access controls, enabling the execution of privileged commands by unauthorized users. **Recommendations** Update to version 2026.5.6.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.27 **Description** An authorization bypass exists in QQBot pre-dispatch slash commands. This issue allows authenticated senders to skip `allowFrom` policy checks, enabling them to invoke slash commands before configured access control policies are applied. Depending on the operator configuration, this may trigger command handling from senders who should be blocked. **Recommendations** Update to version 2026.4.27.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** A configuration enforcement bypass exists in Feishu dynamic-agent bindings. This issue allows authenticated senders to create or update bindings without adhering to the configured config-write controls. By leveraging the dynamic-agent binding feature, an attacker can modify the sender-agent binding state beyond the intended policy, which may lead to unauthorized binding modifications. **Recommendations** Update to version 2026.5.6.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** Improper access control in Mattermost event handlers occurs due to a failure to validate channel type metadata. This allows attackers to bypass intended Direct Message (DM) policy decisions by sending crafted Mattermost events that lack channel type information to process restricted content. **Recommendations** Update to version 2026.5.6.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.24 **Description** An authorization bypass exists in the MCP loopback feature. This allows non-owner callers to circumvent owner-only tool policies and before-tool-call hooks. When the feature is enabled and reachable, attackers can use the affected loopback path to invoke owner-only behavior and execute restricted tools. **Recommendations** Update to version 2026.4.24. As a temporary workaround, disable the MCP loopback feature to prevent unauthorized execution of restricted tools.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** An approval policy bypass exists in the Skill Workshop apply flow. This issue allows agent tool calls to set the `apply` variable to `true` even when the `approvalPolicy` is configured as `pending`. An attacker can reach the affected apply path to implement workshop changes before the required approval step, which may lead to unauthorized configuration modifications. **Recommendations** Update to version 2026.5.6.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.25 **Description** A policy bypass exists in the embedded runner policy. This issue allows requests using provider aliases to be compared against aliases rather than canonical provider identities. When the affected feature is enabled, this confusion can be exploited to obtain bundled tool access that exceeds the intended provider policy restrictions. **Recommendations** Update to version 2026.4.25.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.6 **Description** An authorization bypass exists in Telegram interactive callbacks. Authenticated users can bypass the `commands.allowFrom` validation by invoking affected callbacks to mark themselves as authorized senders before allowlist checks are applied. This allows the execution of command behavior that ignores configured Telegram sender restrictions. **Recommendations** Update to version 2026.5.6.