Vulnerabilities

TI-2026-25356 CVE-2026-32897 · GHSA-v6x2-2qvm-6gv8

OpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallback

LOW 28

OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset, creating dual-us…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00273 Published 2026-03-21 Fixed in 2026.2.22 CWE-320

TI-2026-24596 CVE-2026-32056 · GHSA-xgf2-vxv2-rrmg

OpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run

LOW 36

OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00594 Published 2026-03-21 Fixed in 2026.2.22 CWE-78

TI-2026-24589 CVE-2026-32049 · GHSA-rxxp-482v-7mrh

OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass

MEDIUM 44

OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00565 Published 2026-03-21 Fixed in 2026.2.22 CWE-770

Vulnerabilities

Filters

OpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallback

OpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run

OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass