🚨 CVE-2026-100553
OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted (authenticated) sender can remove a pin from another Feishu group that the sender and the configured account are otherwise permitted to access, bypassing the intended cross-context message mutation policy. Feishu membership and group authorization still apply, and the demonstrated impact is limited to message mutation (pin removal). The issue is fixed in 2026.8.1.
🎖@cveNotify
OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted (authenticated) sender can remove a pin from another Feishu group that the sender and the configured account are otherwise permitted to access, bypassing the intended cross-context message mutation policy. Feishu membership and group authorization still apply, and the demonstrated impact is limited to message mutation (pin removal). The issue is fixed in 2026.8.1.
🎖@cveNotify
GitHub
Feishu unpin could miss cross-context policy
### Summary
Feishu unpin could miss cross-context policy. In affected versions, the native `chatId` parameter was not declared as a delivery target, so `unpin` could avoid the shared same-provider...
Feishu unpin could miss cross-context policy. In affected versions, the native `chatId` parameter was not declared as a delivery target, so `unpin` could avoid the shared same-provider...
🚨 CVE-2026-100554
OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability until WebSocket close cleanup completes. As a result, a revoked paired node can continue exercising its Canvas capability against the capability's configured routes during the close grace period. The issue is fixed in 2026.8.1; as a workaround, restart the Gateway after revoking a node that has Canvas access.
🎖@cveNotify
OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability until WebSocket close cleanup completes. As a result, a revoked paired node can continue exercising its Canvas capability against the capability's configured routes during the close grace period. The issue is fixed in 2026.8.1; as a workaround, restart the Gateway after revoking a node that has Canvas access.
🎖@cveNotify
GitHub
Revoked Canvas capability could remain active during disconnect
### Summary
Revoked Canvas capability could remain active during disconnect. In affected versions, node revocation invalidated the WebSocket client but Canvas HTTP authorization continued acceptin...
Revoked Canvas capability could remain active during disconnect. In affected versions, node revocation invalidated the WebSocket client but Canvas HTTP authorization continued acceptin...
🚨 CVE-2026-100555
OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to a different destination. When attachment delivery accepted a remotely influenced hostname, an attacker could use DNS rebinding to make the NAS fetch a private or otherwise policy-denied resource and return its contents to the addressed conversation (server-side request forgery). Practical impact depends on NAS routing, resolver behavior, and the response available at the private destination. The issue is fixed in 2026.8.1; as a workaround, disable remote URL attachment forwarding in Synology Chat.
🎖@cveNotify
OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to a different destination. When attachment delivery accepted a remotely influenced hostname, an attacker could use DNS rebinding to make the NAS fetch a private or otherwise policy-denied resource and return its contents to the addressed conversation (server-side request forgery). Practical impact depends on NAS routing, resolver behavior, and the response available at the private destination. The issue is fixed in 2026.8.1; as a workaround, disable remote URL attachment forwarding in Synology Chat.
🎖@cveNotify
GitHub
Synology file delivery could lose DNS pinning
### Summary
Synology file delivery could lose DNS pinning. In affected versions, the Gateway validated one DNS result for a file URL but passed the original hostname to the NAS, where it could res...
Synology file delivery could lose DNS pinning. In affected versions, the Gateway validated one DNS result for a file URL but passed the original hostname to the NAS, where it could res...
🚨 CVE-2026-100556
OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or owner command authorization can issue the /new <model> command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session, potentially changing provider routing, cost, data flow, or availability. It does not allow adding a new provider or host command execution. The issue is fixed in version 2026.8.1.
🎖@cveNotify
OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handling. A group sender who is admitted for ordinary messages but denied by commands.allowFrom or owner command authorization can issue the /new <model> command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session, potentially changing provider routing, cost, data flow, or availability. It does not allow adding a new provider or host command execution. The issue is fixed in version 2026.8.1.
🎖@cveNotify
GitHub
WhatsApp session resets could bypass command authorization
### Summary
WhatsApp session resets could bypass command authorization. In affected versions, a group sender admitted for ordinary messages could use `/new <model>` to reset the shared group...
WhatsApp session resets could bypass command authorization. In affected versions, a group sender admitted for ordinary messages could use `/new <model>` to reset the shared group...
🚨 CVE-2026-100557
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials reserved for owners.
🎖@cveNotify
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials reserved for owners.
🎖@cveNotify
GitHub
Skill tool dispatch could skip owner-only policy
### Summary
Skill tool dispatch could skip owner-only policy. In affected versions, an allowlisted non-owner invoking a skill-backed command could reach owner-only tools because the dispatch path ...
Skill tool dispatch could skip owner-only policy. In affected versions, an allowlisted non-owner invoking a skill-backed command could reach owner-only tools because the dispatch path ...
🚨 CVE-2026-100558
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade requests to exhaust listener resources and cause denial of service without consuming the WebSocket pre-auth connection budget.
🎖@cveNotify
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade requests to exhaust listener resources and cause denial of service without consuming the WebSocket pre-auth connection budget.
🎖@cveNotify
GitHub
Gateway upgrade-like requests could retain unauthenticated sockets
### Summary
Gateway upgrade-like requests could retain unauthenticated sockets. In affected versions, an HTTP request carrying a WebSocket upgrade header without the matching connection semantics ...
Gateway upgrade-like requests could retain unauthenticated sockets. In affected versions, an HTTP request carrying a WebSocket upgrade header without the matching connection semantics ...
🚨 CVE-2026-100559
OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected authorization prompts.
🎖@cveNotify
OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected authorization prompts.
🎖@cveNotify
GitHub
Escaped newlines could confuse exec allowlist parsing
### Summary
Escaped newlines could confuse exec allowlist parsing. In affected versions, the command parser could describe and authorize one visible shell word sequence while execution included an...
Escaped newlines could confuse exec allowlist parsing. In affected versions, the command parser could describe and authorize one visible shell word sequence while execution included an...
🚨 CVE-2026-100560
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval prompts, potentially accessing files or internal services.
🎖@cveNotify
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval prompts, potentially accessing files or internal services.
🎖@cveNotify
GitHub
Reusable exec approvals could authorize changed arguments
### Summary
Reusable exec approvals could authorize changed arguments. In affected versions on macOS and Linux, selecting Allow Always for one exact command persisted a path-only grant. Later uses...
Reusable exec approvals could authorize changed arguments. In affected versions on macOS and Linux, selecting Allow Always for one exact command persisted a path-only grant. Later uses...
🚨 CVE-2026-100561
OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign wrapper invocation, a later agent turn could substitute an arbitrary inner command and execute it with the OpenClaw process's host privileges without a further approval prompt. Exploitation requires the relevant wrapper to resolve on the host and a prior operator decision allowing that wrapper. Transparent shell carriers and opaque utilities such as process monitors, tracers, namespace tools, and proxy wrappers were affected through related trust-resolution gaps. Fixed in 2026.8.1.
🎖@cveNotify
OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign wrapper invocation, a later agent turn could substitute an arbitrary inner command and execute it with the OpenClaw process's host privileges without a further approval prompt. Exploitation requires the relevant wrapper to resolve on the host and a prior operator decision allowing that wrapper. Transparent shell carriers and opaque utilities such as process monitors, tracers, namespace tools, and proxy wrappers were affected through related trust-resolution gaps. Fixed in 2026.8.1.
🎖@cveNotify
GitHub
Exec wrapper allowlists could trust arbitrary inner commands
### Summary
Exec approval policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign wrapp...
Exec approval policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign wrapp...
🚨 CVE-2026-100562
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provider, thinking level, and auth-profile settings to redirect traffic and bypass administrative access controls.
🎖@cveNotify
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provider, thinking level, and auth-profile settings to redirect traffic and bypass administrative access controls.
🎖@cveNotify
GitHub
sessions.create could miss admin scope for keyed reconfiguration
### Summary
`sessions.create` could miss admin scope for keyed reconfiguration. In affected versions, an `operator.write` caller could target an existing session key while supplying model or think...
`sessions.create` could miss admin scope for keyed reconfiguration. In affected versions, an `operator.write` caller could target an existing session key while supplying model or think...
🚨 CVE-2026-100563
OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or the first user message can place a formula-like cell in the Usage export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may be evaluated with the permissions of the spreadsheet user. OpenClaw itself does not evaluate the formula, and practical impact depends on the spreadsheet application's security settings. The issue is fixed in 2026.8.1.
🎖@cveNotify
OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or the first user message can place a formula-like cell in the Usage export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may be evaluated with the permissions of the spreadsheet user. OpenClaw itself does not evaluate the formula, and practical impact depends on the spreadsheet application's security settings. The issue is fixed in 2026.8.1.
🎖@cveNotify
GitHub
Usage CSV export could interpret session labels as formulas
### Summary
Usage CSV export could interpret session labels as formulas. In affected versions, the Control UI quoted session labels as CSV text but did not neutralize leading characters that sprea...
Usage CSV export could interpret session labels as formulas. In affected versions, the Control UI quoted session labels as CSV text but did not neutralize leading characters that sprea...
🚨 CVE-2026-100564
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications.
🎖@cveNotify
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications.
🎖@cveNotify
GitHub
Google Meet attendance CSV could interpret names as formulas
### Summary
Google Meet attendance CSV could interpret names as formulas. In affected versions, participant display names were quoted for CSV output but leading spreadsheet formula characters were...
Google Meet attendance CSV could interpret names as formulas. In affected versions, participant display names were quoted for CSV output but leading spreadsheet formula characters were...
🚨 CVE-2026-100566
OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restrictions when DM access is broader than intended group access.
🎖@cveNotify
OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restrictions when DM access is broader than intended group access.
🎖@cveNotify
GitHub
LINE group allowlist could inherit DM access
### Summary
LINE group allowlist could inherit DM access. In affected versions, an account using `groupPolicy: "allowlist"` without `groupAllowFrom` silently reused the account's DM ...
LINE group allowlist could inherit DM access. In affected versions, an account using `groupPolicy: "allowlist"` without `groupAllowFrom` silently reused the account's DM ...
🚨 CVE-2026-100568
OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secrets and execute operator-authored commands.
🎖@cveNotify
OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secrets and execute operator-authored commands.
🎖@cveNotify
GitHub
Agent cron tool could reach operator command jobs
### Summary
Agent cron tool could reach operator command jobs. In affected versions, a model-visible agent caller could read and force-run ownerless command cron jobs routed to the same agent even...
Agent cron tool could reach operator command jobs. In affected versions, a model-visible agent caller could read and force-run ownerless command cron jobs routed to the same agent even...
🚨 CVE-2026-100569
OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in `_ENDPOINT`, so an untrusted workspace `.env` file could set AZURE_SPEECH_ENDPOINT. Azure Speech preferred that value over the configured region, so when a synthesis or voice-list request was made, the attacker-selected endpoint received the operator's Azure Speech key in the request header, allowing the key to be reused against the operator's Azure Speech resource. Exploitation requires an operator to start OpenClaw in attacker-controlled workspace content with Azure Speech configured with a key and region and no trusted endpoint override set. The issue is fixed in 2026.8.1.
🎖@cveNotify
OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending in `_ENDPOINT`, so an untrusted workspace `.env` file could set AZURE_SPEECH_ENDPOINT. Azure Speech preferred that value over the configured region, so when a synthesis or voice-list request was made, the attacker-selected endpoint received the operator's Azure Speech key in the request header, allowing the key to be reused against the operator's Azure Speech resource. Exploitation requires an operator to start OpenClaw in attacker-controlled workspace content with Azure Speech configured with a key and region and no trusted endpoint override set. The issue is fixed in 2026.8.1.
🎖@cveNotify
GitHub
Workspace endpoint override could expose Azure Speech credentials
### Summary
A workspace endpoint override could expose Azure Speech credentials. In affected versions, an untrusted workspace `.env` could set `AZURE_SPEECH_ENDPOINT` because the workspace filter ...
A workspace endpoint override could expose Azure Speech credentials. In affected versions, an untrusted workspace `.env` could set `AZURE_SPEECH_ENDPOINT` because the workspace filter ...
🚨 CVE-2026-100570
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when gcloud is launched, and the gcloud launcher passes it as arguments to the trusted Python interpreter. A crafted CLOUDSDK_PYTHON_ARGS value can therefore cause Python to execute attacker-supplied code with the OpenClaw host user's permissions, allowing credentials to be read, files to be modified, or other processes to be started. This issue is fixed in version 2026.8.1; as a workaround, run Gmail setup only from trusted workspaces and clear inherited CLOUDSDK_* variables beforehand.
🎖@cveNotify
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when gcloud is launched, and the gcloud launcher passes it as arguments to the trusted Python interpreter. A crafted CLOUDSDK_PYTHON_ARGS value can therefore cause Python to execute attacker-supplied code with the OpenClaw host user's permissions, allowing credentials to be read, files to be modified, or other processes to be started. This issue is fixed in version 2026.8.1; as a workaround, run Gmail setup only from trusted workspaces and clear inherited CLOUDSDK_* variables beforehand.
🎖@cveNotify
GitHub
Workspace Cloud SDK arguments could execute code during Gmail setup
### Summary
Workspace Cloud SDK arguments could execute code during Gmail setup. In affected versions, an untrusted workspace `.env` could set `CLOUDSDK_PYTHON_ARGS`. Gmail setup inherited that va...
Workspace Cloud SDK arguments could execute code during Gmail setup. In affected versions, an untrusted workspace `.env` could set `CLOUDSDK_PYTHON_ARGS`. Gmail setup inherited that va...
🚨 CVE-2026-100571
OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel so that multiple external clients share one socket address, an unauthenticated remote sender can exhaust the shared pre-authentication rate-limit budget with invalid requests, causing subsequent correctly signed Twilio callbacks to receive HTTP 429 responses. The result is temporary inbound SMS loss while the shared window remains exhausted; the attacker cannot forge a callback or access message data. Fixed in 2026.8.1.
🎖@cveNotify
OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel so that multiple external clients share one socket address, an unauthenticated remote sender can exhaust the shared pre-authentication rate-limit budget with invalid requests, causing subsequent correctly signed Twilio callbacks to receive HTTP 429 responses. The result is temporary inbound SMS loss while the shared window remains exhausted; the attacker cannot forge a callback or access message data. Fixed in 2026.8.1.
🎖@cveNotify
GitHub
Twilio pre-auth limits could lock out valid webhooks
### Summary
Twilio pre-auth limits could lock out valid webhooks. In affected versions, the SMS webhook applied its invalid-request rate limit before signature verification and identified clients ...
Twilio pre-auth limits could lock out valid webhooks. In affected versions, the SMS webhook applied its invalid-request rate limit before signature verification and identified clients ...
🚨 CVE-2026-100572
OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single socket address, an unauthenticated sender can exhaust the shared invalid-token budget, causing subsequent legitimate Synology Chat webhook callbacks to be rejected until the rate-limit window expires. The attacker cannot obtain a valid token or read message data; the impact is temporary loss of channel availability. Fixed in 2026.8.1.
🎖@cveNotify
OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single socket address, an unauthenticated sender can exhaust the shared invalid-token budget, causing subsequent legitimate Synology Chat webhook callbacks to be rejected until the rate-limit window expires. The attacker cannot obtain a valid token or read message data; the impact is temporary loss of channel availability. Fixed in 2026.8.1.
🎖@cveNotify
GitHub
Synology pre-auth limits could lock out valid webhooks
### Summary
Synology pre-auth limits could lock out valid webhooks. In affected versions, invalid-token throttling ran before authentication and identified requests by the raw proxy socket address...
Synology pre-auth limits could lock out valid webhooks. In affected versions, invalid-token throttling ran before authentication and identified requests by the raw proxy socket address...
🚨 CVE-2026-100573
OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions the operator intended to exclude from the sandbox.
🎖@cveNotify
OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions the operator intended to exclude from the sandbox.
🎖@cveNotify
GitHub
MCP loopback could omit sandbox tool deny policy
### Summary
MCP loopback could omit sandbox tool deny policy. In affected versions, a sandboxed coding-agent session could list and invoke tools explicitly denied by `sandbox.tools.deny`.
This ad...
MCP loopback could omit sandbox tool deny policy. In affected versions, a sandboxed coding-agent session could list and invoke tools explicitly denied by `sandbox.tools.deny`.
This ad...
🚨 CVE-2026-100574
OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address (0.0.0.0 or ::) bypasses the SSRF destination validation. An attacker who can influence DNS for an allowed hostname can therefore cause a guarded fetch to reach a service bound only to loopback and disclose its response; the practical impact depends on the reachable service and the data it returns. Fixed in 2026.8.1.
🎖@cveNotify
OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address (0.0.0.0 or ::) bypasses the SSRF destination validation. An attacker who can influence DNS for an allowed hostname can therefore cause a guarded fetch to reach a service bound only to loopback and disclose its response; the practical impact depends on the reachable service and the data it returns. Fixed in 2026.8.1.
🎖@cveNotify
GitHub
Trusted-host DNS checks could admit unspecified addresses
### Summary
Trusted-host DNS checks could admit unspecified addresses. In affected versions, a trusted hostname that resolved to `0.0.0.0` or `::` could connect to a loopback service despite OpenC...
Trusted-host DNS checks could admit unspecified addresses. In affected versions, a trusted hostname that resolved to `0.0.0.0` or `::` could connect to a loopback service despite OpenC...
🚨 CVE-2026-100575
OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.
🎖@cveNotify
OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.
🎖@cveNotify
GitHub
Slack group DMs could skip sender allowlists
### Summary
Slack group DMs could skip sender allowlists. In affected versions, a sender in a multi-person direct message could trigger an OpenClaw agent even when the configured Slack group sende...
Slack group DMs could skip sender allowlists. In affected versions, a sender in a multi-person direct message could trigger an OpenClaw agent even when the configured Slack group sende...