SB2026050124 - Multiple vulnerabilities in OpenClaw

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026050124

SB2026050124 - Multiple vulnerabilities in OpenClaw

Published: May 1, 2026

Security Bulletin ID SB2026050124
CSH Severity
High
Patch available
YES
Number of vulnerabilities 31
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 3% Medium 32% Low 65%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 31 secuirty vulnerabilities.


1) External Control of System or Configuration Setting (CVE-ID: CVE-2026-22169)

The vulnerability allows a local privileged user to bypass intended allowlist approval constraints.

The vulnerability exists due to external control of system or configuration setting in tools.exec.safeBins when using the non-default configuration that explicitly adds sort and invoking the --compress-program option. A local privileged user can invoke an external helper to bypass intended allowlist approval constraints.

Only non-default configurations that explicitly add sort to tools.exec.safeBins in allowlist mode are vulnerable.


2) Untrusted search path (CVE-ID: N/A)

The vulnerability allows a remote user to execute commands.

The vulnerability exists due to an untrusted search path in tools.exec.safeBins when resolving safe-bin executables from PATH-derived directories in allowlist mode. A remote user can place a same-name binary in a trusted PATH directory to execute commands.

Exploitation requires that allowlist mode relies on safe bins and that the attacker can influence trusted binary locations.


3) Link following (CVE-ID: CVE-2026-32024)

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper link resolution before file access in avatar handling when resolving local avatar paths. A local user can create a symlink path that resolves outside the configured workspace boundary to disclose sensitive information.

Only files readable by the OpenClaw process can be exposed via gateway avatar surfaces.


4) Incorrect authorization (CVE-ID: CVE-2026-29607)

The vulnerability allows a remote user to execute arbitrary commands.

The vulnerability exists due to incorrect authorization in execution approval persistence flows when approving wrapped system.run commands with allow-always in security=allowlist mode. A remote privileged user can approve a benign wrapped invocation and later execute different inner payloads to execute arbitrary commands.

User interaction is required, and the issue affects gateway and node-host execution approval persistence flows.


5) OS Command Injection (CVE-ID: CVE-2026-28460)

The vulnerability allows a remote attacker to execute unintended commands.

The vulnerability exists due to command injection in the system.run shell-wrapper analysis in allowlist mode when processing shell commands containing line-continuation command substitution inside double quotes. A remote attacker can supply a specially crafted command string to execute unintended commands.

Only deployments that enable tools.exec.security=allowlist with ask=on-miss or off are vulnerable.


6) Authorization bypass through user-controlled key (CVE-ID: N/A)

The vulnerability allows a remote user to bypass sender-scoped authorization.

The vulnerability exists due to improper access control in tools.elevated.allowFrom matching logic when evaluating elevated sender authorization. A remote user can supply broader-than-intended identity signals to bypass sender-scoped authorization.

Only certain elevated-mode configurations are vulnerable.


7) Improper access control (CVE-ID: CVE-2026-32039)

The vulnerability allows a remote attacker to bypass sender authorization policy.

The vulnerability exists due to improper access control in channels.*.groups.*.toolsBySender when matching sender policies with untyped keys. A remote attacker can force an identifier collision to bypass sender authorization policy.

Only deployments that use toolsBySender with untyped keys are vulnerable.


8) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-32021)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to authorization bypass through a user-controlled key in Feishu allowlist authorization checks when matching sender identities against the allowlist. A remote attacker can set a display name equal to an allowlisted ID string to bypass authorization checks.

Only deployments using Feishu allowlist-based authorization are affected.


9) Input validation error (CVE-ID: CVE-2026-32019)

The vulnerability allows a remote attacker to bypass SSRF restrictions.

The vulnerability exists due to improper input validation in isPrivateIpv4() SSRF guard code used by web_fetch when validating fetched URLs against IPv4 special-use ranges. A remote attacker can supply a URL targeting omitted special-use addresses to bypass SSRF restrictions.

Exploitation requires network reachability to the relevant special-use ranges and a request path that reaches web_fetch URL fetching.


10) External Control of System or Configuration Setting (CVE-ID: N/A)

The vulnerability allows a local user to execute unintended commands.

The vulnerability exists due to external control of system or configuration settings in the shell-env fallback path when executing a login shell with inherited environment values. A local user can supply attacker-influenced environment or config values to execute unintended commands.

Exploitation depends on attacker-controlled environment or configuration input reaching the shell-env fallback on the host process context.


11) OS Command Injection (CVE-ID: N/A)

The vulnerability allows a remote user to execute inline payloads.

The vulnerability exists due to improper neutralization of special elements used in an OS command in tools.exec.safeBins allowlist evaluation when processing configured interpreter-style binaries without an explicit safe-bin profile. A remote user can supply inline code through flags such as -c to execute inline payloads.

Only non-default deployments that explicitly add such binaries to safeBins in allowlist mode are vulnerable.


12) OS Command Injection (CVE-ID: CVE-2026-32003)

The vulnerability allows a remote user to execute arbitrary shell commands.

The vulnerability exists due to improper neutralization of special elements used in an os command in the system.run shell wrapper when invoking bash -lc with request-scoped environment variables. A remote privileged user can supply crafted SHELLOPTS and PS4 environment values to execute arbitrary shell commands.

Exploitation requires the ability to invoke system.run with request-scoped env values, and the issue affects allowlist mode for shell wrappers.


13) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to bypass rate limiting for hook authentication brute-force attempts.

The vulnerability exists due to improper input validation in hook authentication rate limiting in src/gateway/server-http.ts and src/gateway/auth-rate-limit.ts when processing client IP addresses for failed authentication attempts. A remote attacker can alternate between IPv4 and IPv4-mapped IPv6 address forms to bypass rate limiting for hook authentication brute-force attempts.

The same client can be assigned separate rate-limit buckets when represented as an IPv4 address and as an IPv4-mapped IPv6 address.


14) Path traversal (CVE-ID: N/A)

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to path traversal in resolveIdentityAvatarUrl in src/gateway/session-utils.ts when processing a crafted local avatar path that follows a symlink outside the agent workspace. A local user can supply a crafted avatar path to disclose sensitive information.

The resulting file contents can be returned in gateway responses as a base64 data URL via agents.list.


15) Key management errors (CVE-ID: CVE-2026-32897)

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper cryptographic key management in owner-ID prompt obfuscation in src/agents/cli-runner/helpers.ts, src/agents/pi-embedded-runner/run/attempt.ts, and src/agents/pi-embedded-runner/compact.ts when hashing owner identifiers with commands.ownerDisplay=hash and commands.ownerDisplaySecret unset. A remote user can observe hash outputs exposed to third-party model providers to disclose sensitive information.

No direct plaintext token disclosure is described, and practical risk is highest when weak gateway tokens are used.


16) Code Injection (CVE-ID: N/A)

The vulnerability allows a remote user to execute unintended JavaScript.

The vulnerability exists due to improper control of code generation in webhook transform module import handling when resolving a transform module path through a symlinked entry outside the trusted transform directory. A remote user can cause the gateway to dynamically import attacker-controlled code to execute unintended JavaScript.

Exploitation requires hook transforms to be enabled and reachable, influence over transform path resolution, and a symlink escape to attacker-controlled code.


17) External Control of System or Configuration Setting (CVE-ID: CVE-2026-32056)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to external control of system configuration settings in the system.run shell execution path when processing attacker-supplied environment variables for shell startup. A remote attacker can supply crafted HOME or ZDOTDIR values to execute arbitrary code.

Exploitation relies on shell startup files being processed before the allowlist-evaluated command body.


18) Incorrect authorization (CVE-ID: CVE-2026-27566)

The vulnerability allows a remote user to bypass intended allowlist restrictions and execute non-allowlisted commands.

The vulnerability exists due to incorrect authorization in system.run exec allowlist analysis when processing requests that route execution through env or shell-dispatch wrapper binaries. A remote user can submit a specially crafted system.run request to bypass intended allowlist restrictions and execute non-allowlisted commands.

Exploitation requires the ability to trigger system.run requests under an allowlist policy.


19) Incorrect authorization (CVE-ID: CVE-2026-32016)

The vulnerability allows a local user to bypass path-based execution policy.

The vulnerability exists due to incorrect authorization in exec-approval allowlist matching on macOS node-host when processing basename-only allowlist entries under security=allowlist with ask=on-miss. A local user can place or invoke a same-name local binary to bypass path-based execution policy.

Only the macOS node-host path is affected, and exploitation requires the optional exec approvals feature to be enabled with basename-only allowlist entries configured.


20) OS Command Injection (CVE-ID: CVE-2026-22179)

The vulnerability allows a remote user to execute unintended commands on the node host.

The vulnerability exists due to improper neutralization of special elements used in an os command in the system.run allowlist parsing on the macOS node-host path when processing double-quoted shell text containing command substitution in security=allowlist mode. A remote privileged user can send a specially crafted shell-wrapper command to execute unintended commands on the node host.

Exploitation requires the macOS node-host or companion-app execution path, security=allowlist, and ask mode set to on-miss or off.


21) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-32049)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in several channel ingestion paths when buffering remote media. A remote attacker can send oversized media payloads to cause a denial of service.


22) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-32037)

The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to insufficient destination validation in MSTeams media download flows when processing attachment URLs that trigger redirect chains. A remote attacker can supply or influence an attachment URL to perform server-side request forgery.

The issue affects specific attachment paths where redirects were not consistently constrained to allowlisted targets before fetched content was accepted.


23) Link following (CVE-ID: CVE-2026-32020)

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper link resolution before file access in the Control UI static file handler when serving Control UI assets and SPA fallback files. A local user can place a symlink under the Control UI root to disclose sensitive information.

Exploitation requires symlinks to exist inside the Control UI root.


24) Untrusted search path (CVE-ID: CVE-2026-32032)

The vulnerability allows a local user to execute an attacker-controlled shell.

The vulnerability exists due to untrusted search path in shell environment fallback loading when invoking the shell from an inherited untrusted host environment. A local user can set the SHELL environment variable to an attacker-controlled executable to execute an attacker-controlled shell.

Exploitation requires prior local environment compromise or injection of an untrusted startup environment.


25) Incorrect authorization (CVE-ID: CVE-2026-32001)

The vulnerability allows a remote user to inject unauthorized node events.

The vulnerability exists due to incorrect authorization in the WebSocket connect path when handling role=node connections authenticated with a shared gateway token without device identity or pairing. A remote user can connect as role=node and call node.event to inject unauthorized node events.

This can trigger agent.request and voice.transcript flows without node device pairing.


26) Incorrect authorization (CVE-ID: CVE-2026-22170)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to incorrect authorization in isAllowedParsedChatSender() and BlueBubbles DM/reaction authorization logic when processing direct messages or reactions with dmPolicy set to pairing or allowlist and allowFrom empty or unset. A remote attacker can send messages or reactions from an untrusted sender to bypass authorization checks.

This issue affects the optional BlueBubbles channel plugin rather than core messaging surfaces.


27) Improper Authentication (CVE-ID: N/A)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to improper authentication in Discord allowlist name/tag matching when processing slug-normalized Discord names and tags. A remote attacker can use a colliding user tag to bypass authorization checks.

Name-based allowlist entries can unintentionally match different Discord users after slug normalization.


28) Link following (CVE-ID: N/A)

The vulnerability allows a remote attacker to write arbitrary files outside the intended extraction destination.

The vulnerability exists due to improper link resolution before file access in ZIP extraction logic in src/infra/archive.ts when extracting an attacker-controlled archive with a pre-existing symlink in the destination path. A remote attacker can supply a specially crafted archive to write arbitrary files outside the intended extraction destination.

Exploitation requires a pre-existing symlink under the extraction root in a destination path segment.


29) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-32010)

The vulnerability allows a remote user to run an external program without expected approval.

The vulnerability exists due to incomplete list of disallowed inputs in the sort safe-bin policy when processing sort --compress-program in safe-bin usage. A remote user can supply a crafted sort invocation with --compress-program to run an external program without expected approval.

Only deployments that explicitly add sort to tools.exec.safeBins and use security=allowlist with ask=on-miss are vulnerable.


30) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-22174)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to authentication bypass by spoofing in loopback CDP probe handling when sending CDP reachability probes to a loopback listener. A remote attacker can bind or control the probed loopback port and read the x-openclaw-relay-token header to disclose sensitive information.

Exploitation is relevant in shared-user or shared-host deployments where an untrusted local process can race or bind the loopback relay port.


31) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-31993)

The vulnerability allows a remote user to execute shell-chain commands on the paired macOS host.

The vulnerability exists due to incomplete list-based input validation in system.run exec approvals when processing shell-chain commands under allowlist mode with ask-on-miss enabled. A remote user can submit a shell-chain command that passes allowlist checks to execute shell-chain commands on the paired macOS host.

Exploitation requires operator.write permissions on a paired macOS beta node host, and only systems configured with security=allowlist and ask=on-miss are affected.


Remediation

Install update from vendor's website.

References