Security desk
Three merges on OpenClaw main rework how reusable exec approvals, recurring cron automations, and MCP App grants hold authority — with one breaking change that deactivates older generated approvals until you re-approve in the intended directory.
Two P0 fixes landed on OpenClaw main within hours of each other: public plugin ingress could claim owner privileges, and agents could spin up Gateway terminals that ignored session permissions. Here is what changed and what operators should do.
Main-branch fixes stop Ollama cloud credentials being forwarded to loopback aliases, redact reflected API keys from provider errors, and keep ngrok auth tokens out of process arguments.
Merged main-branch fix forces rollback journaling on Docker Desktop, OrbStack and Podman bind mounts, ending silent WAL-over-cross-filesystem corruption risk for containerized OpenClaw state.
A merged fix stops ambient environment variables from silently satisfying Feishu provider authorization when the configured SecretRef policy disallows them — closing a gap that let denied credentials reach document comments and directory lookups.
Merged PR #127699 makes Gateway runtime snapshots the sole owner of memory SecretRef materialization and stops embedding credentials, Authorization headers, and tenant headers from following requests to different endpoints — including query-distinct tenants on the same host.
A bare suffix match treated look-alike hosts such as evil1drv.ms as OneDrive and SharePoint share links, routing them into Graph authentication. Merged fixes require a dot boundary, HTTPS, and keep look-alike downloads out of the Graph auth path.
openclaw skills update passed force:true unconditionally, replacing locally modified skill directories and deleting their backups. A merged fix verifies digests first and preserves local changes.
Broad diagnostic redaction rewrote source code inside tool results, corrupting later reads and edits. A merged fix confines redaction to diagnostics while preserving the security boundary.
Merged main fixes stop approvals --json from printing the exec-approvals socket token in cleartext and stop removed Claw agents from leaving their approval policies behind for the next agent with the same id.
Merged main change stops external plugin tools from reaching the raw outbound adapter, adds an optional current-turn-only delivery.send capability, and revokes send authority at turn closure.
Three merged OpenClaw fixes close plaintext gateway credential writes, silent ref-mode token leaks, and secret exposure in onboarding failure output. Here is what operators should audit on installs made before the fixes.
Shared bots can isolate MCP credentials by trusted sender, but operators must explicitly choose the new identity mode, configure a public callback origin and accept a shared-channel sign-in-link tradeoff.
A recurring no-payload Telegram failure is still unresolved; separately, main now prevents provider-confirmed exact sends from remaining ambiguous and replaying after restart.
A security-boundary fix stops stored MCP refresh tokens being replayed to a different authorization server; older token-only rows may require one clean reauthorization.
The extension is now browser-automation infrastructure with a local native-messaging bootstrap; Linux and macOS operators still load it once, while Windows keeps manual pairing.
The team-scoped store now has Control UI management and stricter value validation; write-only secrets remain separate from env values exposed to agent subprocesses.
Gateway scopes, internal turns, channel approvals and delegated retries now carry canonical owner context instead of reconstructing authority from transport-shaped or client-visible data.
A P1 fix keeps context-excluded shell output out of replay and compaction, while Telegram now respects disabled tool progress even when verbose mode is on.
Managed updates could finalise against the caller's profile, chat history could expose raw audio or local paths, and Telegram DM tool policy could be skipped on queued or native runs.
Browser relay auth, subagent tool denial, gateway URL redaction, credential-safe prompts and retirement of inline hook handlers tighten different trust boundaries. One requires a manual migration before Doctor cleanup.
The extended-stable selector moved to 2026.6.34 with security, delivery, provider and local-runtime hardening. Here is the operator decision, the migration warning and what to verify.
Merged fixes close policy-matching, cross-context mutation, quote-attribution, callback-ownership and revoked-node capability gaps.
Registered Git worktrees placed directly under OpenClaw's worktrees root could be recursively cleaned as orphans; a landed fix now preserves registered checkout roots.
A merged fix removes post-approval model inference: the verified, hash-bound persistent operation now executes directly and only once.
A merged P1 privacy fix keeps workspace-root MEMORY.md out of group and channel bootstrap context, including supported alias and hook paths.
Merged Telegram repairs route reactions through their real forum topic, persist polling progress safely and correlate outbound delivery to the explicit topic.
Two merged TUI security fixes preserve whitespace-prefixed bang messages as chat and neutralize control sequences in system-message rendering.
Merged channel fixes enforce exact signed webhook targets, fail unhealthy Google Chat setup visibly, unblock durable lanes and normalize sender and owner identity.
Merged fixes preserve hostile-data provenance, keep deferred MCP failures honest, isolate oversized stdio frames and adopt canonical untrusted-filename handling.
The workspace override moved from vulnerable 5.0.8 to 5.0.9 after GitHub advisory GHSA-rgw5-rvv9-x895; source-build operators should verify the resolved dependency.
Merged fixes enforce owner-only management and reset commands, deny unauthorized conversation bindings, preserve private Discord replies and block plaintext Matrix media.
Merged agent fixes keep hostile browser and dynamic-tool content inside external-content boundaries and record downstream memory writes as untrusted.
Merged fixes isolate OpenRouter, memory, Ollama, LanceDB, Bedrock and Google credentials while preventing referenced secrets and provider keys from reaching plaintext logs.
Merged Memory Wiki fixes enforce conversation visibility in search, preserve handwritten notes during damaged rebuilds and keep QMD available when filesystem watches fail.
Control UI actions now follow Gateway scopes and parameters, while host-issued dashboard handoffs deliberately bootstrap a durable owner credential with administrator access.
Two merged Telegram fixes move account, topic and command authorization ahead of media ingestion so rejected group commands cannot trigger attachment downloads.
Merged fixes preserve host-owned file safeguards through Matrix, Telegram, Slack, iMessage, Discord, Feishu and Teams, while preventing SharePoint filename replacement.
Merged fixes protect skill mounts, redact signed URLs, make config and mixed chat updates atomic, reject stale backups and block unsafe reset.
Merged main fixes preserve cancellation and rewrites across restart while waking persisted channel retries after their backoff without duplicate delivery.
A merged P1 edit-tool fix preserves original bytes outside the replacement span instead of rebuilding a matched line from normalized text.
A new main-branch inference contract gives plugins a fresh, text-only model call with zero tools, explicit model authorization and fail-closed runtime support.
A new operator digest covers an apply_patch overwrite bug, missed rollover memories, three startup failures and stricter cron webhook authentication.
A merged scanner fix reports every distinct process-execution match in a plugin file, closing a review gap where only the first executable call was shown.
A merged OpenClaw security fix makes scheduled runs fail closed when their recorded channel account has been removed instead of falling through to unrestricted tools.
Two merged fixes tighten the external-hook boundary: untrusted job names stay inside fenced content, while Codex relay work now follows explicit tool matchers.
A breaking main-branch change removes /phone arm leases and makes node-local enablement plus pairing the durable gate for interactive control.
A merged main-branch fix stops Matrix rooms or Signal groups whose opaque IDs differ only by case from sharing transcripts and control state in the web UI.
A merged main-branch P1 fix stops automatic execution review from approving Windows cmd launches that can run hidden AutoRun or persistent-shell commands.
A merged main-branch security fix stops exec allowlist analysis from approving a shell word whose escaped newline can create a different POSIX command boundary.
Two merged main-branch changes retire legacy auth and exec-approval JSON runtime stores, add fail-closed migration gates and make Doctor the supported importer.
A merged Control UI change makes the admin-scoped host terminal default-on. Operators who do not want browser PTY access should set the explicit opt-out before upgrading.
A security fix on OpenClaw main makes Vault and 1Password secret-plan writes exclusive and owner-only. Operators should protect old plans and verify the containing release.
A merged main-branch fix makes normal routed agent replies pass through plugin rewrite and cancellation hooks before channel delivery.
Four merged main-branch changes tighten read-only diagnostics, verifier quarantine, schema upgrades and filesystem durability around OpenClaw state.
Claude CLI sessions under restrictive policy can now request human approval for native and extension tools instead of silently denying them, with Bash and timeout paths kept fail-closed.
Main-branch fixes address Matrix key migration, Control UI pairing, concurrent MCP config loss, large-inode startup failures and macOS certificate trust.
A merged OpenClaw fix preserves creator-authorized Cron tool caps across scheduled, CLI and cloud-worker execution without letting the cap override current safety policy.
OpenClaw has tightened reusable command approvals and Discord sender-scoped history on main. Current npm packages predate both fixes.
OpenClaw can be safe for one trusted operator, but not as a hostile shared tenant. Understand the real risks, controls and launch checklist.
From late January through February, OpenClaw moved browser control behind the Gateway and tightened bridge, relay, network and token boundaries.
OpenClaw versions before 2026.5.28 could let workspace dotenv files override provider credentials. Here is the real exposure and operator response.
Prompt injection is not solved. Learn five attack patterns and how OpenClaw reduces blast radius with pairing, sandboxing, agent isolation and strict tool policy.
A current, source-verified OpenClaw security checklist covering trust boundaries, DM pairing, gateway exposure, sandboxing, tool policy, secrets and audits.
OpenClaw is a self-hosted AI gateway that connects models, messaging channels and tools. Learn how it works, what stays local and who it suits.