https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for openclaw/openclaw en-us Tue, 01 Sep 2026 14:23:07 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/673 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/673 Thu, 27 Aug 2026 01:00:12 GMT The Buzz bus checked sender membership before queuing/deduplication but did not re-verify membership after asynchronous admission. A sender removed from a room could still have a queued or in-flight message processed, allowing unauthorized command execution. The patch adds revalidation after queued/dedupe work and after async ingress, rejecting revoked senders. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/674 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/674 Thu, 27 Aug 2026 01:01:39 GMT Before the patch, harness-injected user-role messages from Claude Code (e.g., skill instruction bodies, compaction summaries) were rendered in webchat as right-aligned operator bubbles, making attacker-controlled content appear as if typed by the operator. This allowed an attacker who could influence a skill's content or the transcript to spoof operator messages, potentially tricking the operator into taking unintended actions. The patch records provenance for these messages and renders them as collapsed 'Injected context' notices instead of operator turns. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/675 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/675 Thu, 27 Aug 2026 01:08:05 GMT Before this patch, OpenAI-compatible providers with missing or empty baseUrl would fall back to the OpenAI SDK default endpoint (api.openai.com). This could cause API keys and sensitive request data intended for a third-party provider (e.g., OpenRouter) to be sent to OpenAI's servers, leading to credential leakage and potential unauthorized usage. The patch enforces that non-OpenAI providers must supply an explicit base URL, failing closed otherwise. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/672 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/672 Wed, 26 Aug 2026 21:26:42 GMT Before the patch, compaction prompts for sessions with a finite toolsAllow policy still included the full set of effective tools and private skill guidance. An attacker with a restricted session could trigger manual, recovery, or after-turn compaction and use prompt injection to make the model reveal this hidden information. The patch filters the prompt tools to the allowed list and suppresses private skills when the tool policy is restricted. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/669 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/669 Wed, 26 Aug 2026 18:55:11 GMT Role-required sandboxes were scoped per agent instead of per authenticated principal. Multiple guests sharing the same agent received the same sandbox container and workspace, allowing one guest to read or modify another guest's files. The patch qualifies sandbox identity with the session creator's principal and caps workspaceAccess from 'rw' to 'ro' for role-required sessions, preventing cross-guest data access. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/670 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/670 Wed, 26 Aug 2026 18:57:50 GMT The read tool appended base64 image data to the tool result even when the model did not support vision, contradicting the omission note and causing massive unnecessary context consumption. An attacker who can influence the agent to read a large image file could exhaust the context window and kill the session. The patch drops the image payload when the model lacks vision capability. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/671 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/671 Wed, 26 Aug 2026 18:59:32 GMT The ACP live reply projector did not apply the verified conversation context sanitizer to streamed text deltas. If an agent echoed marked private inbound context (e.g., current message or history markers) across multiple streaming deltas, that private content was delivered directly or routed to another channel, leaking internal prompt scaffolding and private conversation data. The patch introduces a stream filter that accumulates deltas and only releases newly confirmed-safe text, preventing such leaks. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/667 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/667 Wed, 26 Aug 2026 16:59:20 GMT The file-transfer plugin previously remembered approvals based only on the requested path, without binding them to the resolved canonical path. An attacker who could alter a symlink at an approved path could redirect subsequent transfers to arbitrary files, bypassing the operator's approval and leading to unauthorized file read/write. The patch introduces exact grants that store both requested and canonical paths and requires migration of legacy rules. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/663 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/663 Wed, 26 Aug 2026 16:13:53 GMT Before this patch, when a subagent completed while its requester session was idle, the wake message could be dispatched through the most recently activated Gateway context instead of the original owning Gateway. An attacker with a different Gateway could activate it and cause the victim's subagent completion to be routed into the attacker's session, leaking the victim's data or allowing the attacker to continue the victim's workflow. The patch fixes this by carrying the exact Gateway lifecycle resolver with each run and failing closed if that resolver is missing or retired. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/661 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/661 Wed, 26 Aug 2026 15:01:33 GMT Before the patch, gateway-owned code ran git commands against untrusted user checkouts without pinning core.hooksPath and core.fsmonitor. A malicious repository could set core.fsmonitor (or core.hooksPath) to an arbitrary executable, causing the Gateway process to execute that command during session-diff baseline capture or worker workspace operations. The patch exports gitEnvironment() and applies -c core.fsmonitor=false / core.hooksPath=/dev/null to all remaining direct git invocations. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/662 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/662 Wed, 26 Aug 2026 15:02:55 GMT Spawned child agents (visible and hidden) did not inherit the parent session's permission policy (read-only, guarded, workspace, or Full Access), causing them to run with default permissions and potentially escalate beyond the parent's allowed scope. The patch propagates sessionPermissionPolicy through spawn paths and sets permissionMode/sessionRoot on child sessions. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/660 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/660 Wed, 26 Aug 2026 14:13:17 GMT The pre-patch ChatGPT Responses stream error handling logged provider-controlled error messages, which could contain user prompt data or system prompts, to transport logs. Attackers could craft prompts that cause the provider to echo sensitive input in error responses, resulting in data leakage through logs. The patch sanitizes logging to only include fixed local fields (timing, stop reason, failure category) and never provider text. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/658 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/658 Wed, 26 Aug 2026 13:36:23 GMT The vulnerable code resolved the authoritative agent owner of a session only at broadcast time, after any debounce/queue delay. If the session's compatibility owner changed in the interim, an unqualified session key could be resolved to the new owner, causing a queued session-change event from the previous owner to be broadcast to the new owner's subscribers, leaking session metadata/content across agent boundaries. The patch captures the owner scope when the event is emitted and uses that scope for row lookup, subscription keys, and the final broadcast. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/656 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/656 Wed, 26 Aug 2026 12:23:01 GMT Before the patch, after a browser action or navigation invalidated the selected raw target, route code inferred a replacement tab from URL matches, newly listed tabs, or the sole surviving tab. This allowed an attacker-controlled page to become the replacement target, causing subsequent Playwright actions to execute on the attacker's page instead of the intended tab, potentially leaking sensitive data or performing unauthorized actions. The patch adds ownership checks (captureOperationTarget, assertPageCurrent) to ensure the exact tab and extension connection remain valid before each action. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/654 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/654 Wed, 26 Aug 2026 10:03:33 GMT Before the patch, Gmail hook pushes were processed with a fixed 256 KiB body cap and only the first message in a batched Pub/Sub push was handled. An attacker could send multiple large emails to the victim's inbox, causing a single batched push exceeding 256 KiB. The gateway would respond with 413, which gog treats as delivery failure, rewinding the history cursor and redelivering the same batch indefinitely. This created a permanent poison-message wedge that blocked all inbound mail processing (availability impact). The patch adds per-message fan-out and derives a larger, bounded body limit for Gmail paths (capped at 32 MiB), preventing the endless retry loop. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/649 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/649 Wed, 26 Aug 2026 08:38:34 GMT The bot activation check used a case-insensitive substring match for '@botname', causing the bot to respond to messages addressed to other users whose usernames contain the bot's name as a prefix (e.g., '@botname2'). This bypasses the requireMention authorization and can lead to unintended information disclosure or command execution in group chats. The patch anchors the match to username boundaries, preventing false positives. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/650 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/650 Wed, 26 Aug 2026 08:40:33 GMT The cron job failure alert fallback could deliver sensitive failure messages to an attacker-controlled conversation by inheriting a previously active delivery context from the agent's recent interactions. The patch prevents untargeted alerts from using the origin delivery context, ensuring they are delivered only to the owning session or default owner. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/651 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/651 Wed, 26 Aug 2026 08:41:27 GMT Before the patch, Git commands executed during worktree operations (create, remove, restore, GC) in user repositories could run repository-configured hooks (e.g., post-checkout, reference-transaction) and filesystem monitors. An attacker who controls a repository processed by the service could inject malicious scripts that execute with the service's privileges, leading to arbitrary code execution. The patch prevents this by forcing core.hooksPath=/dev/null and core.fsmonitor=false via environment variables for all Git commands in the worktrees service. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/652 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/652 Wed, 26 Aug 2026 08:45:32 GMT Before the patch, the Windows Startup fallback passed the script path as a direct argument to cmd.exe via Node's spawn. If the path contained shell metacharacters but no spaces, Node did not quote it, allowing cmd to interpret the metacharacters as command separators. An attacker who could influence the scriptPath could inject arbitrary commands executed with the daemon's privileges. The patch fixes this by using an environment variable expansion inside a quoted cmd argument with windowsVerbatimArguments, preventing the path from being parsed as a command. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/653 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/653 Wed, 26 Aug 2026 08:50:19 GMT The onboarding flow initialized the location capability as enabled if the Android OS location permission was granted, ignoring the user's previously saved in-app 'Off' setting. This allowed a malicious gateway to receive location data even when the user had explicitly disabled location sharing in the app. The patch combines the saved location mode with the current Android permission, preserving the user's opt-out until explicitly re-enabled. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/647 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/647 Wed, 26 Aug 2026 07:59:37 GMT Before the patch, sandbox exec paths passed environment values as command-line arguments (Docker `--env`, SSH remote commands prefixed with `env`), exposing secrets like API keys and tokens in local process listings. The patch routes environment values through private env files or staged scripts, keeping them out of argv. This prevents local users from reading credentials via tools such as `ps` or `/proc` inspection. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/648 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/648 Wed, 26 Aug 2026 08:03:34 GMT Before the patch, NodeInvokeStreamController.sendInput did not check if the pending node invocation had passed its absolute deadline before forwarding input to the remote node. An attacker who can delay the hard-timeout callback (e.g., by blocking the event loop) could continue sending privileged input after the deadline, causing the remote command to execute actions beyond its authorized time window. The patch adds a settleIfExpired check before sending input, immediately rejecting expired invokes. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/646 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/646 Wed, 26 Aug 2026 07:18:52 GMT The user-facing reply sanitizer did not remove copies of the private prompt context (conversation history and system scaffolding) from final or streamed replies. An attacker could induce the model to echo its prompt context, leaking private user messages and internal metadata to external channels like Telegram. The patch adds exact-match redaction of conversationContext before delivery. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/645 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/645 Wed, 26 Aug 2026 06:26:27 GMT Before the patch, the webhooks plugin's cancel_flow action accepted arbitrary childSessionKey and runId values and passed them to the ACP session manager without verifying that the child session was owned by the route's configured session. An attacker with a valid webhook route secret could cancel active turns in unrelated sessions, causing denial of service and unauthorized control over other users' tasks. The patch adds ownership and run-instance validation (expectedOwnerKey, expectedRunId, expectedInstanceId) so only owner-matched canonical tasks can cancel the exact active run. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/642 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/642 Wed, 26 Aug 2026 05:58:27 GMT Prior to this patch, skill dependency installers using kind: 'download' fetched archives over the network and extracted them without verifying any cryptographic hash. An attacker capable of modifying the archive in transit (e.g., man-in-the-middle on HTTP or compromise of the hosting server) could inject malicious executables or scripts into the skill's tools directory. These files would later be executed by the agent when it uses the skill, leading to arbitrary code execution. The patch adds an optional sha256 field to the download spec and verifies the downloaded archive's digest before extraction, rejecting mismatches. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/643 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/643 Wed, 26 Aug 2026 05:59:19 GMT Before the patch, already-created session tools retained the Gateway permission configuration they were constructed with. When runtime permissions were revoked (e.g., session visibility changed to 'self' or agent-to-agent messaging disabled), those tools continued using the stale configuration, allowing unauthorized session listing, history access, and message sending across agents. The patch marks config provenance as 'runtime' vs 'pinned'; runtime tools now pass undefined config so they perform execution-time policy lookups, while pinned overrides remain fixed. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/640 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/640 Wed, 26 Aug 2026 05:22:37 GMT Before the patch, media reference loading in image, music, and video generation tools did not consistently enforce byte limits. Music and video tools bypassed maxBytes for inline data URLs and fetched media, and image tool allowed non-finite configured limits, enabling an attacker to trigger decoding of arbitrarily large media payloads, causing memory exhaustion and denial of service. The patch makes a mandatory resolved per-kind byte cap applied to all reference loading paths. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/641 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/641 Wed, 26 Aug 2026 05:24:25 GMT Before the patch, runtime plugin installation error messages could include the full npm registry URL with embedded credentials (user:token) and ANSI escape sequences. These unredacted errors were returned to callers and displayed/logged, potentially exposing registry tokens to anyone who can view terminal output or shared logs. The patch sanitizes the failure messages to redact credentials and strip control characters. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/639 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/639 Wed, 26 Aug 2026 04:54:19 GMT Before the patch, several Gateway session projection paths could expose a session's persisted goal to unscoped subscribers. For a global session owned by an agent, a transcript or session event without an agentId would still include session.goal from the persisted owner, allowing any connection subscribed to the global session to read the owner's private objective. The patch centralizes snapshot construction in buildGatewaySessionSnapshot and explicitly omits scoped fields like goal unless the caller provides the owner agentId. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/636 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/636 Wed, 26 Aug 2026 04:08:38 GMT Before the patch, delayed TUI command handlers for local goals, usage cost, and new session creation were not bound to the session incarnation that initiated them. If a user switched agents or sessions before an asynchronous operation resolved, stale results (such as a private continuation prompt from a previous agent) could be sent or displayed in the newly selected session, leaking private model, runtime, goal, usage, and conversation history across session boundaries. The patch captures a session incarnation and checks `isCurrent()` before applying any delayed side effects. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/637 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/637 Wed, 26 Aug 2026 04:10:21 GMT The public `agentCommandFromIngress` SDK helper accepted a caller-supplied `senderIsOwner` flag, allowing untrusted workspace plugins to impersonate the owner and access owner-only agent tools/commands. The patch forces `senderIsOwner: false` in `sanitizePublicAgentCommandIngressOpts` and binds owner authority to a trusted host-injected runtime channel capability, preventing forged owner claims from public ingress. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/638 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/638 Wed, 26 Aug 2026 04:14:28 GMT Before the patch, when a queued WebChat reply completed after its original chat request had terminalized, the follow-up delivery logic would fall back to the latest same-session dispatcher (defaults.opts?.onBlockReply), which could originate from a different source/channel. This could deliver the WebChat reply to an unintended destination, leaking conversation content across channels. The fix binds each queued reply batch to its originating Gateway admission and authoritative channel via queuedFollowupReplyDisposition, preventing cross-source delivery. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/630 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/630 Wed, 26 Aug 2026 02:13:18 GMT Android onboarding incorrectly treated notification listener access as consent to forward notifications, overriding the user's explicit opt-out. This could silently re-enable forwarding and send notification titles and message content to the gateway without user consent. The patch preserves the existing forwarding preference by requiring both listener access and prior user consent. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/631 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/631 Wed, 26 Aug 2026 02:15:38 GMT The reusable exec approval mechanism previously bound approvals to the command and arguments only, omitting the working directory. An attacker could cause a command previously approved in a safe directory to execute with the same arguments from a different directory, resulting in unauthorized file access or deletion. The patch includes the canonical working directory in the approval hash and revalidates directory identity before execution. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/632 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/632 Wed, 26 Aug 2026 02:18:33 GMT Before the patch, the trusted-proxy reconnect fast path used a stale paired-device snapshot to determine the session's scopes. If an administrator revoked the device, replaced its key, or reduced its scopes concurrently with a reconnect, the Gateway could still issue a session with the old authority, allowing a revoked or restricted device to retain access. The patch rereads the authoritative paired row as the last await before returning, causing such reconnects to fail closed into the pairing lane. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/633 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/633 Wed, 26 Aug 2026 02:20:51 GMT The snapshot completion handler only validated the request UUID and not the originating WebView, document resource, or load generation. An asynchronous snapshot taken for one document could complete after the WebView navigated to a replacement document (e.g., after a Gateway route/TLS change or reset), causing the stale completion to copy or save an image of the replacement document. The patch binds each snapshot to its exact request, generation, resource, and WebView instance, invalidating ownership on any change. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/634 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/634 Wed, 26 Aug 2026 02:21:33 GMT The Crabbox worker provider previously passed setup environment secrets directly in the child process environment, which when using an SSH-backed execution transport resulted in the secrets appearing in the command line arguments of the spawned process. A local attacker could observe these credentials via process listing. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/635 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/635 Wed, 26 Aug 2026 02:24:50 GMT Before the patch, provider catalog discovery did not restrict execution to the provider identities selected for an agent. Any globally configured provider hook would run, resolving its credentials and fetching its models, even when the agent was not authorized to use that provider. This allowed an attacker with limited provider permissions to trigger discovery for out-of-scope providers and then use those models, bypassing access controls and potentially consuming shared credentials. The patch adds guards that return null when ctx.providerIds does not include the provider's own ID, and the runtime filters results to the selected identities. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/626 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/626 Wed, 26 Aug 2026 00:38:39 GMT Before the patch, the read-only session catalog facade exposed providers without enforcing the active profile's process-HOME isolation. A named/relocated profile that disabled process-HOME session scanning would still allow internal consumers (e.g., the Beam mirror) to list and read sessions from the main user HOME, enabling unauthorized exfiltration of private conversation transcripts outside the isolation boundary. The patch propagates allowProcessHomeFallback into all list/read calls and reports the policy to consumers. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/627 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/627 Wed, 26 Aug 2026 00:40:22 GMT Before the patch, agent-created cron jobs could be attributed to an arbitrary actor via a trusted hint in the agent runtime's spawn context. Because the creator actor is used to establish the identity and permissions of subsequent automation runs, a malicious or prompt-injected agent could forge the creator to impersonate another user and execute automations with that user's privileges. The patch replaces this trusted hint with the immutable creator stored on the exact session, preventing spoofing. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/628 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/628 Wed, 26 Aug 2026 00:41:50 GMT The skill installer download path piped HTTP response bodies directly to disk without any size limit. A malicious skill author could provide a download URL that returns an endless or extremely large response, causing the victim's disk to fill up and potentially making the system unusable. The patch adds a 256 MiB cap and aborts transfers when exceeded. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/629 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/629 Wed, 26 Aug 2026 00:46:05 GMT Before this patch, certain Git operations used during GitHub publication (e.g., push via githubPublicationPushArgs, recovery write-tree) did not explicitly disable Git hooks. An attacker who could influence a repository's core.hooksPath configuration could inject malicious hooks that would execute arbitrary code on the machine running the publication automation. The patch adds `-c core.hooksPath=os.devNull` to all such hook-capable Git commands, ensuring hooks are suppressed regardless of repository configuration. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/624 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/624 Wed, 26 Aug 2026 00:00:42 GMT Before the patch, the embedding cache key for Mistral and DeepInfra providers only included the provider name and model. When different tenants or deployments used the same model but different custom endpoints or semantic headers (e.g., X-Tenant, X-Deployment), their memory embedding indexes silently collided, allowing one tenant's stored embeddings to be retrieved by another. The patch partitions the cache by adding the sanitized destination baseUrl and headers (excluding rotating credentials) for non-default configurations. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/625 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/625 Wed, 26 Aug 2026 00:02:46 GMT Before the patch, the Buzz relay information fetch used `response.json()` without any size limit, allowing a malicious or compromised Nostr relay to return an arbitrarily large or never-ending JSON response. This could exhaust Gateway memory and crash the process. The patch replaces it with `readProviderJsonObjectResponse`, which enforces a 16 MiB limit and cancels the stream when exceeded. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/622 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/622 Tue, 25 Aug 2026 23:37:07 GMT The Buzz setup contract had a resolveAccountId function that always returned 'default', causing any named account request (e.g. --account attacker) to be treated as the default account, bypassing the single-account validation. An attacker who convinces an admin to run a setup command with attacker-controlled private key and relay URL could overwrite the existing default bot identity, enabling account takeover. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/619 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/619 Tue, 25 Aug 2026 23:14:01 GMT The WhatsApp login tool was registered through a channel-tool surface that did not pass the sender-owner fact, allowing any write-scoped non-owner to invoke the tool and force a QR relink. This could clear saved WhatsApp credentials and permit the attacker to link the bot to their own device, taking over the WhatsApp channel. The patch moves registration to an owner-aware factory and adds abort checks before credential persistence. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/620 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/620 Tue, 25 Aug 2026 23:15:08 GMT The portal proxy used a cookie prefix derived from the target port (`oc_portal_<targetPort>_`). Because browser cookies are hostname-scoped, cookies set by a previous portal for the same target port were retained and later forwarded to a new portal instance on that port, leaking application session cookies to an unintended target. The patch replaces the port-based prefix with a random per-portal-instance namespace, ensuring cookies from closed portals are rejected. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/621 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/621 Tue, 25 Aug 2026 23:16:51 GMT Before the patch, the agent-facing terminal tool could create its own Gateway-hosted PTY and send input directly, ignoring the session's execution permission policy (read-only, guarded, workspace, deny). This allowed a compromised or prompt-injected agent to execute arbitrary shell commands on the host even when the operator had explicitly forbidden command execution. The patch enforces the effective exec session policy and adds a final authority fence before any terminal input is written to the PTY. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/612 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/612 Tue, 25 Aug 2026 22:04:43 GMT MCP App views could continue to list and read resources from their owning MCP server after the view's App-interaction authority was revoked or never granted (e.g., reconstructed read-only views). The patch enforces a current App-interaction authority check before and after each resource operation, preventing unauthorized data disclosure. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/604 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/604 Tue, 25 Aug 2026 21:18:48 GMT The patch adds a missing authorization check for MCP App resource operations. Prior to this fix, `resources/list`, `resources/templates/list`, and `resources/read` were performed without verifying the current App-interaction authority, allowing a view whose grant was revoked (or a read-only reconstructed view) to still list and read same-server resources. The fix wraps these operations with `withMcpAppResourceAuthority`, which calls `requireMcpAppInteraction` before and after the upstream work, and stops advertising the resource capability without valid authority. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/602 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/602 Tue, 25 Aug 2026 19:44:59 GMT The legacy IPv4 loopback parser only recognized dotted-decimal IPv4 addresses and missed IPv4-mapped IPv6 loopback forms like \[::ffff:127.0.0.1\]. This caused such local endpoints to be classified as remote, leading the Ollama plugin to attach ambient cloud credentials (e.g., OLLAMA_API_KEY) to discovery requests sent to the local loopback address. An attacker controlling a service on that localhost port could capture the credentials. The patch replaces the duplicate parser with the canonical SDK loopback helper to correctly classify mapped loopback addresses as local and prevent credential forwarding. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/597 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/597 Tue, 25 Aug 2026 15:30:27 GMT Before the patch, autonomous skill updates in `auto` mode could target any workspace skill, including user-authored skills, because the apply path did not recheck ownership at the write boundary and used name-based heuristics. This allowed an attacker who could influence the agent (e.g., via prompt injection from a malicious document or webpage) to have their update proposal automatically applied to a user's handwritten skill, leading to unauthorized file modification and potential arbitrary command execution when the skill is later invoked. The patch enforces path-based ownership rechecks under a commit lock and restricts automatic application to Workshop-authored skills, keeping user-authored updates pending operator approval. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/596 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/596 Tue, 25 Aug 2026 14:01:54 GMT The ngrok authentication token was passed as a command-line argument to `ngrok config add-authtoken`, making it visible in the child process argv. Any local user or process could read `/proc/<pid>/cmdline` or `ps` output to steal the token. The patch removes the subprocess call and instead sets the `NGROK_AUTHTOKEN` environment variable for the ngrok tunnel process, preventing exposure via process arguments. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/592 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/592 Tue, 25 Aug 2026 11:02:07 GMT Before the patch, when a placement dispatch or move was already in-flight for a session, a second caller with an identical request joined the existing operation without invoking their own authorize callback. An operator whose session access was revoked during that window could still receive a successful placement result, bypassing per-request placement authority. The patch adds a joinOperation wrapper that revalidates each joining caller's authority before and after the shared work, and replaces partial request comparison with full deep equality to prevent mismatched paired-device placements. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/591 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/591 Tue, 25 Aug 2026 10:21:21 GMT Before the patch, the Reef extension exposed setActiveReef and getActiveReef through its public API, and the returned runtime object contained outbound, pairing, friendship, and review capabilities that did not check whether the underlying account was still active. A malicious extension could obtain a reference to the active Reef runtime, wait for the account to be stopped or replaced, and then continue to send messages, approve pairings, or read data as the retired account without authorization. The patch introduces a generation-specific authority that is revoked when the account aborts or is replaced, ensuring all borrowed capabilities fail closed. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/590 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/590 Tue, 25 Aug 2026 09:57:46 GMT Before the patch, isLocalOllamaBaseUrl only recognized 127.0.0.1 as IPv4 loopback, so other 127/8 addresses like 127.0.0.2 or 127.1.2.3 were classified as remote. This caused the Ollama plugin to send the ambient OLLAMA_API_KEY (cloud credential) to a server on those addresses instead of the synthetic local authentication. The patch reuses the full IPv4 loopback detector so all 127/8 addresses are treated as local, preventing the cloud credential from being sent to local loopback aliases. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/587 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/587 Tue, 25 Aug 2026 08:30:12 GMT Before the patch, `resolveMemoryWikiConfig` computed default vault paths from `os.homedir()` and ignored the `OPENCLAW_STATE_DIR` environment variable. An isolated agent run or Doctor migration could therefore read, delete, or archive the operator's real Memory Wiki data under `~/.openclaw/wiki`. The patch uses `resolveStateDir` to honor the configured state directory, keeping isolated runs within their intended filesystem boundary. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/584 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/584 Tue, 25 Aug 2026 07:57:39 GMT The TUI plugin approval and task suggestion controllers matched prompts solely by session key string, ignoring the explicit agentId for non-global sessions. An attacker who can publish events with a victim's session key but their own agentId could cause an approval prompt to appear in the victim's terminal, tricking the operator into approving actions for the attacker's agent. The patch introduces `matchesOwnedTuiSession` to ensure the prompt's owner matches the selected agent. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/585 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/585 Tue, 25 Aug 2026 08:00:32 GMT The plugin inspection command resolved plugins by checking either the exact ID or the display name without prioritizing exact ID. An attacker could install a plugin with a display name equal to another plugin's ID, causing a request to inspect the legitimate plugin to load and execute the attacker's plugin instead, leading to arbitrary code execution. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/586 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/586 Tue, 25 Aug 2026 08:02:10 GMT The gateway history projection failed to filter phased assistant text blocks of type 'output_text' or 'input_text', causing internal assistant commentary (non-final_answer phases) to be exposed in session history. The patch reuses the assistant text classifier to correctly identify all phased text block types, ensuring only final_answer content is shown. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/583 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/583 Tue, 25 Aug 2026 07:07:43 GMT Anthropic native tools (Bash, Read, Write, Edit, WebFetch, WebSearch) bypassed OpenClaw's before_tool_call policy hooks and canonical tool policies because the native permission handler did not map native tool names/arguments (e.g., Bash→exec, file_path→path) to OpenClaw canonical equivalents. This allowed users to execute shell commands or read/write files that were explicitly blocked by configured security policies, leading to remote code execution or sensitive data exfiltration. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/582 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/582 Tue, 25 Aug 2026 04:29:11 GMT The downloadSlackFile function did not require positive proof that a file was shared in the requested Slack channel. Files with absent channel/share metadata or share-map keys with empty/invalid entries were treated as authorized, and blank channel IDs bypassed scope checks entirely. An attacker who knows a file ID from a private channel could cause the bot to fetch and return the file outside the authorized conversation. The patch requires nonblank channel and valid timestamped share entries, failing closed. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/581 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/581 Tue, 25 Aug 2026 00:32:15 GMT Before this patch, the update.run protocol did not accept an exact Git commit target, so a caller who froze a commit via update.status could not ensure that update.run would install that same commit. If the upstream branch advanced between the status and run calls, the updater could install a different, potentially malicious commit. The patch adds an optional target parameter that binds the update to a specific commit SHA and upstream reference. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/580 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/580 Mon, 24 Aug 2026 22:12:19 GMT Before the patch, getReadPathVariants normalized Unicode spacing, quotes, and Unicode NFC/NFD forms across the entire file path, including parent directories. In workspace-only read mode, after the initial exact path was authorized, fallback variants could alter the Unicode normalization of a parent directory and point to a sibling directory outside the allowed workspace, allowing reads of arbitrary files outside the workspace. The patch restricts fallback transformations to the basename only, preserving the already-authorized parent directory byte-for-byte. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/579 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/579 Mon, 24 Aug 2026 21:50:51 GMT Before this patch, the cron scheduler used the raw `job.agentId` when enqueueing notifications and wakeups for scheduled scripts, and it omitted the session's delivery context for main-session jobs. If a script job did not have an explicit `agentId` (inheriting it from its session or the default), the notification could be delivered to the wrong agent or even a shared default agent, leaking potentially sensitive script output to other users. The patch resolves the correct owning agent with `resolveCronJobEffectiveAgentId` and includes the session's `deliveryContext` to ensure messages reach the intended Telegram thread and account. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/577 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/577 Mon, 24 Aug 2026 16:53:03 GMT Before the patch, native command continuations (Discord button clicks, argument selections, model picker interactions) did not forward the dispatcher tied to the admitted Gateway instance. This allowed an attacker to trigger a continuation that would fall back to an ambient dispatcher from a different Gateway, potentially executing commands or sending replies using the victim's credentials and terminal context. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/576 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/576 Mon, 24 Aug 2026 16:04:37 GMT Before the patch, cloud-managed nodes (worker records with a nodeDeviceId) were excluded from the managed set only when their state was not failed or orphaned. A failed/orphaned worker that still retained its node binding would cause its cloud node to be listed as an ordinary paired-device environment, allowing unauthorized users to treat infrastructure-owned nodes as regular devices. Additionally, worker inventory read errors silently returned an empty list, causing all cloud nodes to be exposed. The patch fixes this by treating failed/orphaned workers as retaining ownership unless destroyed and by failing closed on inventory read failures. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/573 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/573 Mon, 24 Aug 2026 13:31:43 GMT The UI's real-time session reconciliation logic allowed broadcast session events to add new rows to filtered session lists, bypassing the 'Involving me' or configured-agent filters. This leaked the existence and metadata (label, key, owner, status) of unrelated sessions to users who should not see them. The patch enforces that only the canonical sessions.list result may admit new rows, preventing filtered lists from being expanded by events. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/572 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/572 Mon, 24 Aug 2026 12:22:58 GMT Before the patch, `resolvePlacementIdentity` ignored the supplied `agentId` and `sessionKey` when a placement existed, using the placement's persisted identity instead. An attacker who knew only a victim's session ID could submit a worker turn with arbitrary or blank identity fields and the gateway would execute the turn under the victim's placement identity, granting unauthorized access to the victim's workspace. The patch enforces that any supplied identity field is non-empty and matches the persisted placement before workspace resolution, claim acquisition, or redispatch. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/571 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/571 Mon, 24 Aug 2026 09:49:04 GMT Before the patch, restart recovery could archive a source session and create its successor while the source still owned an active cloud worker. This allowed the worker's remote execution and final workspace changes to be attributed to a retired session identity, bypassing the session lifetime security boundary. The patch forces reclaim of the cloud worker and adds a lifecycle revision check before the archive commit. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/570 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/570 Mon, 24 Aug 2026 09:04:39 GMT Before the patch, dynamic tool building for Codex used the raw `params.permissionMode`, `params.sessionRoot`, and `execOverrides` from the conversation source, ignoring server-side Codex requirements and app-server clamps. This allowed a stale or malicious conversation with `permissionMode: 'full'` and `execOverrides.mode: 'full'` to bypass an administrator's tightened workspace/guarded approval policy and execute arbitrary shell commands with automatic approval. The patch resolves a single effective permission policy from the final app-server configuration and overwrites the raw params so all execution paths (dynamic tools, Gateway alias, compaction) use the clamped policy. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/565 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/565 Mon, 24 Aug 2026 08:10:40 GMT Before the patch, the telemetry payload included raw channel and provider identifiers from the user's configuration. A private plugin name such as 'acme-internal-crm' or 'acme-llm' would be sent to the telemetry endpoint despite the documented promise that no identifying information is sent, potentially revealing the user's organization or internal projects. The patch filters these values to only publicly known identities and reports private plugins anonymously via counts. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/566 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/566 Mon, 24 Aug 2026 08:13:01 GMT Subagent logs and completion announcements used a content-only extractor that ignored the assistant message phase, causing private 'commentary' (intermediate reasoning) to be exposed to operators. The patch routes extraction through the canonical sanitized history extractor, which filters commentary and only returns final_answer content. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/567 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/567 Mon, 24 Aug 2026 08:18:37 GMT Before the patch, error responses from Ollama embedding/streaming/web-search requests were read and thrown as Error messages without redacting request credentials. If a malicious or misbehaving endpoint/intermediary reflected an Authorization or custom secret header in the error body, the credential would be exposed to logs and operators/agents. The patch adds a helper that removes secret values in raw, JSON, URI-encoded, form-encoded, and truncation-boundary forms before the error is surfaced. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/568 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/568 Mon, 24 Aug 2026 08:21:55 GMT Before the patch, ensureLmstudioModelLoaded included raw response bodies from the model-load endpoint in thrown Error messages without redacting sensitive credentials. A malicious or compromised server could reflect the API key or custom authentication headers back in the error body, causing those secrets to be logged or displayed to operators. The patch builds the outbound headers first, redacts exact credential values and bare Authorization payloads from error bodies and unexpected statuses, and suppresses truncated bodies where redaction cannot safely identify credentials. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/563 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/563 Mon, 24 Aug 2026 07:18:38 GMT The node.invoke command allowlist was evaluated before an asynchronous pairing revalidation. If an administrator revoked a command during that await, the command still dispatched because the final isDispatchAuthorized gate did not recheck the command policy. The patch re-resolves the allowlist inside the closure to fail closed on revocation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/564 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/564 Mon, 24 Aug 2026 07:23:49 GMT The embedded TUI model picker fell back to the full unrestricted provider catalog when an agent's restrictive model policy returned an empty allowed list, effectively ignoring the policy. This fail-open behavior allowed users to select and run models prohibited by the selected agent's model policy. The patch removes the fallback and honors the authoritative empty allowed catalog. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/562 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/562 Mon, 24 Aug 2026 04:05:02 GMT Before the patch, memory search embedding providers (e.g., Gemini) would send provider-owned API keys and headers to any custom remote.baseUrl configured in memory.search.remote, even if that endpoint was not the provider's canonical destination. This allowed an attacker or misconfigured operator to exfiltrate provider credentials to an arbitrary URL. The patch enforces that provider credentials and headers are only used when the remote destination matches the provider's configured base URL (including query parameters), and requires explicit remote.apiKey for other destinations. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/561 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/561 Mon, 24 Aug 2026 03:14:43 GMT Before the patch, delivery authority was checked only once before initiating a Discord send. If the send failed transiently and was retried, or if later separate physical sends occurred (e.g., media caption overflow), the authority was not revalidated, allowing a canceled, suppressed, or retired pending reply to still be delivered. The patch moves the authority callback into the request/retry function so it is enforced immediately before each actual provider I/O attempt. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/560 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/560 Sun, 23 Aug 2026 21:56:13 GMT Before the patch, Feishu credential resolution in inspect mode would read environment variables referenced by SecretRef objects without validating the secret provider policy, allowing disallowed environment variables to be used as authentication credentials. This could lead to unintended credential use and potential authentication bypass. The patch enforces the policy by checking canResolveEnvSecretRefInReadOnlyPath before reading the environment variable. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/558 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/558 Sun, 23 Aug 2026 21:34:14 GMT The code highlighter tokenizer classifies Unicode numerals as numeric tokens, but the consuming loop only advances over hexadecimal digits and ASCII punctuation. When a Unicode numeral (e.g., '①') is encountered, the token becomes empty and the cursor is not advanced, causing an infinite loop and unbounded memory growth. This freezes the application when rendering source code blocks containing such characters, allowing a remote attacker to send a malicious code snippet to crash or hang the app. The patch aligns the consuming condition with the token classification by adding `chars\[end\].isNumber`. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/559 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/559 Sun, 23 Aug 2026 21:36:53 GMT Before the patch, administrative session events such as sharing visibility and membership changes were appended to the conversation transcript as messages with excludeFromContext set to true. However, the session projection logic only filtered bashExecution messages with that flag, so these administrative messages were still projected into the model context as user messages. Since these messages could include user-controlled display names, an attacker could inject malicious instructions into the model's context by setting their display name to a prompt injection payload and triggering an admin action. The patch generalizes the excludeFromContext filter to all message types, preventing such untrusted administrative notes from reaching the model. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/557 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/557 Sun, 23 Aug 2026 16:43:24 GMT Before the patch, archiving or unarchiving a session appended a system note to the conversation transcript containing the actor's display name, which is user-controlled. This note was later treated as part of the model's context, allowing a malicious user to inject arbitrary instructions into the conversation history of any other user who loads that session, leading to prompt injection attacks. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/556 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/556 Sun, 23 Aug 2026 15:56:21 GMT Before the patch, widget iframes granted `allow-popups` and `allow-popups-to-escape-sandbox` to every rendered widget, including those with `grantState: "none"` and `connect-src 'none'`. An untrusted widget could use a `target="_blank"` anchor or popup navigation to open an arbitrary external URL in a new, fully unsandboxed tab, bypassing network isolation and CSP restrictions. The patch removes those sandbox flags and routes user-clicked links through a validated host bridge with `noopener,noreferrer`. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/555 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/555 Sun, 23 Aug 2026 13:31:06 GMT The Matrix poll summary pagination loop would continue indefinitely if a homeserver returned a repeated or cyclic opaque cursor in the `nextBatch` field of `getRelations` responses. A malicious or compromised homeserver could cause the bot to hang on poll processing, leading to denial of service. The patch tracks previously seen cursors and throws an error when a repeat is detected, breaking the cycle. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/554 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/554 Sun, 23 Aug 2026 11:10:35 GMT Before the patch, fetchLinkContent threw an error on non-OK HTTP responses without cancelling or consuming the response body. Under Undici 8.9, fetch() resolves after headers, so an attacker-controlled URL returning a non-success status with a stalled body could leave the underlying socket occupied indefinitely. Repeated fetches would exhaust the connection pool, causing denial of service. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/553 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/553 Sun, 23 Aug 2026 08:15:09 GMT A queued agent turn that was admitted before a credential hot reload could re-publish its retired runtime configuration (including old credentials) as the current owner. This defeated credential rotation and allowed revoked credentials to remain in use. The patch fences old generations and only permits borrowing the exact snapshot through an active outer lease, otherwise rejecting with 'superseded'. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/552 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/552 Sun, 23 Aug 2026 02:09:35 GMT The old `isGraphSharedLinkUrl` used `host.endsWith(suffix)` without a label boundary, allowing look-alike domains like `evil1drv.ms`, `notonedrive.com`, or `fakeonedrive.live.com` to be treated as OneDrive/SharePoint shared links. This caused the bot to obtain an access token and, via the auth fallback, send it to the attacker-controlled host. The patch requires a dot-prefixed suffix and HTTPS, preventing token leakage. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/551 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/551 Sat, 22 Aug 2026 11:10:45 GMT Before the patch, node command identifiers were printed directly to the terminal without sanitization. A malicious or compromised node could supply an identifier containing terminal escape sequences and newlines to clear the screen or forge output lines, misleading the user. The patch sanitizes the identifier with sanitizeTerminalText for human-readable output while preserving raw values in JSON. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/550 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/550 Sat, 22 Aug 2026 09:16:11 GMT Before the patch, Discord voice transcripts were stored in RawBody, CommandBody, and CommandTurn.body as if typed by the user, without untrusted framing. A malicious user could send a voice message whose transcript contains a slash command or prompt injection, causing the bot to classify and execute it as a user-typed command, bypassing the intended separation between machine-generated untrusted input and typed commands. The patch routes transcripts through formatAudioTranscriptForAgent and removes them from command-bearing fields. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/547 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/547 Sat, 22 Aug 2026 02:05:59 GMT The code before the patch automatically injected memory content from MEMORY.md and USER.md (or any entry with originClass owner/agent) into the agent's context without verifying provenance. An attacker who could cause untrusted content to be stored in these curated memory files (classified as originClass 'untrusted') would have that content automatically included in the prompt via bootstrap or Active Memory trigger recall, enabling prompt injection and potential agent hijacking. The patch replaces the path-based and originClass-based checks with a provenance-aware isAutomaticMemoryEntryEligible function and fails closed when provenance is missing or unsupported. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/548 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/548 Sat, 22 Aug 2026 02:09:59 GMT When an explicitly configured SecretRef was unavailable, the system would silently discard the reference and fall back to ambient credentials (e.g., environment variables), leading to authentication and actions as an unintended account. The patch adds assertions that cause operations to fail closed when a configured credential is unavailable, preventing identity confusion and potential privilege escalation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/545 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/545 Fri, 21 Aug 2026 22:59:40 GMT Before the patch, session creation accepted unconfigured agent IDs, leading to sessions that later dispatch, reclaim, and delete APIs refused to manage. Attackers could create managed worktrees for these orphaned sessions, causing unbounded resource consumption on the host and eventual denial of service. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/544 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/544 Fri, 21 Aug 2026 22:40:50 GMT The gateway cached HTTP auth-bypass paths in a WeakMap keyed only by config object identity. When a channel plugin's metadata/lifecycle changed while the config object stayed identical, the old bypass paths remained cached, allowing unauthenticated access to routes that should now be protected. The patch invalidates the cache on plugin metadata lifecycle resets. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/543 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/543 Fri, 21 Aug 2026 21:58:23 GMT The CLI 'approvals --json' commands printed the exec-approvals socket token in clear text in the file.socket.token and raw fields. This token is the HMAC key used to derive the local operator approval runtime token, which authorizes local operator-approval clients. An attacker who can read the JSON output (e.g., from logs or a shared terminal) can recover the token, derive the operator approval token, and connect to the local exec-approvals socket to approve or deny command execution, bypassing the operator approval mechanism. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/542 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/542 Fri, 21 Aug 2026 19:35:38 GMT Before the patch, the gateway's conversation tools admitted and consumed conversation references without verifying that the current channel route belonged to the active agent. This allowed a multi-agent operator's agent to discover or deliver to conversations owned by other agents or external routes, leading to unauthorized message delivery and potential data exfiltration. The patch introduces per-channel owner resolvers and enforces ownership checks across all conversation operations. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/537 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/537 Fri, 21 Aug 2026 19:04:10 GMT Before the patch, `claws remove` deleted an agent from the active config but left its exec-approvals policy in the shared state DB keyed by the raw agent ID. A later agent reusing that ID silently inherited the old allowlist, bypassing the intended default-deny policy and allowing execution of commands that were only approved for the removed agent. The patch wraps the removal in `withAgentExecApprovalsRemoved` so the approvals are cleaned up atomically with the config change. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/536 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/536 Fri, 21 Aug 2026 17:53:27 GMT Before the patch, when the request-scoped plugin registry was missing, the code fell back to the process registry, exposing the raw outbound adapter to plugin tool code. This allowed a malicious plugin to choose arbitrary destination, account, thread, and media roots, bypassing host authorization and enabling arbitrary message injection and potential file exfiltration. The patch removes the fallback and binds delivery to the host-selected route and current turn, revoking authority at turn closure. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/529 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/529 Fri, 21 Aug 2026 08:24:16 GMT The gateway authorized agent-scoped cron mutations against a job before entering the cron service's mutation lock. If the job was replaced with a different owner while the request waited, the old commit guard did not re-check the caller's live job scope, allowing `cron.scratch.set`, `cron.remove`, or `cron.run` to operate on the replacement job. The patch adds a commit guard that re-reads the caller scope and live job at commit time, rejecting operations when ownership or config revision changes. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/528 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/528 Fri, 21 Aug 2026 07:56:39 GMT Before the patch, non-interactive onboarding failure output directly emitted raw diagnostic fields (message, detail, diagnostics) without applying secret redaction. If a registered secret (e.g., gateway auth token) appeared in a probe error or daemon diagnostic, it would be exposed in JSON or human-readable output. The fix routes all output through redactSecrets to strip registered secrets while preserving diagnostic classification. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/527 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/527 Fri, 21 Aug 2026 06:24:30 GMT Scheduler-owned runs (cron, hooks, heartbeat) could inherit the ambient request context of an unrelated user request when they executed. This allowed a scheduled task to access another user's terminal sessions, dashboard, or client identity, leading to cross-user privilege escalation. The patch introduces a dedicated lifecycle-fenced Gateway context for scheduler-owned runs and explicitly prevents inheritance of any active request scope. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/524 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/524 Fri, 21 Aug 2026 05:47:53 GMT The offline `agents delete` path failed to remove exec approval policies, leaving stale allowlist entries that are reactivated if an agent with the same ID is recreated, granting unauthorized command execution. Additionally, the approval-removal helper used permissive normalization that treated the wildcard `"*"` as `"main"`, causing deletion of the main agent to also remove the global wildcard policy. The patch wraps offline deletion with the same approval-cleanup helper and uses strict normalization to preserve wildcard and unrelated policies. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/525 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/525 Fri, 21 Aug 2026 05:52:08 GMT The Telegram target writeback logic used a custom normalization that omitted the direct-message topic ID, causing direct-topic targets (e.g., @channel:direct-topic:77) to be matched with unthreaded targets for the same channel. This allowed an attacker who triggered a target resolution to overwrite unrelated configuration entries (such as the default broadcast target), redirecting future bot messages to a topic under the attacker's control. The patch correctly differentiates direct-topic targets and preserves the suffix in the resolved target. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/526 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/526 Fri, 21 Aug 2026 05:55:20 GMT The session replacement projection only compared the raw entry_json column during commit validation, but owner and participant data are stored outside that JSON blob. A concurrent ownership change could occur after the snapshot was read but before the write transaction, allowing a stale replacement from the previous owner to overwrite the new owner's session metadata and revert ownership. The patch captures the full resolved session row and compares both raw JSON bytes and logical session entry (including owner/participants) within the transaction. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/523 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/523 Fri, 21 Aug 2026 04:35:55 GMT Before the patch, an explicitly empty --agent value in 'openclaw approvals allowlist add' was silently treated as the wildcard agent '*', causing a dangerous command pattern to be approved for all agents. An operator using an unset environment variable (e.g., --agent "$AGENT") could unintentionally grant broad exec approval, bypassing per-agent security controls. The patch rejects blank agent values with an error before persisting any approval. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/519 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/519 Fri, 21 Aug 2026 02:13:08 GMT When onboarding with `--secret-input-mode ref`, gateway credentials passed via `--gateway-password`, `--remote-token`, or `--remote-password` were written as literal plaintext strings into the OpenClaw configuration file instead of as environment SecretRefs. This violated the explicit guarantee of ref mode and left credentials exposed on disk. The patch replaces the plaintext password assignment with `createGatewayEnvSecretRef`, enforcing env-backed references for these credentials. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/520 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/520 Fri, 21 Aug 2026 02:15:22 GMT Before the patch, untrusted or restricted session content could be recorded in daily memory artifacts with an 'agent' (trusted) origin class due to incorrect provenance capture. When a memory provider was enabled later, background dreaming processes (narrative and consolidation) ran with tool access enabled, allowing attacker-controlled content to be interpreted as trusted and trigger tool calls, bypassing the tool ceiling applied to the original untrusted source. The patch preserves provenance and disables tools in dreaming phases. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/521 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/521 Fri, 21 Aug 2026 02:16:31 GMT Before the patch, running 'openclaw onboard --secret-input-mode ref' still generated a gateway token and wrote it as a plaintext string in openclaw.json, ignoring the operator's explicit choice to use secret references. Anyone with read access to the config file could obtain the gateway token and authenticate to the gateway. The patch fixes this by storing the token in the secret store or as an environment reference, keeping plaintext secrets out of the configuration. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/518 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/518 Fri, 21 Aug 2026 00:41:08 GMT Before the patch, identified non-admin Gateway users could access incognito sessions (which are documented as admin-only) through various entry points such as aliases, OpenAI-compatible HTTP routes, task or artifact identifiers, and task events. The session authorization check was missing or inconsistently applied before canonical session resolution, allowing unauthorized users to retrieve sensitive incognito session content. The patch adds a centralized authorization check after session resolution, requiring the admin scope for incognito sessions unless the requester is the owner. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/514 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/514 Thu, 20 Aug 2026 16:19:35 GMT The code before the patch failed to register several caches holding plugin callbacks, module exports, and native require entries with the plugin metadata lifecycle clear. As a result, a plugin that was uninstalled or replaced could leave its executable code cached and still be invoked later, allowing a removed malicious plugin to continue running and exfiltrating data. The patch registers these caches with the lifecycle clear seam so that old code is evicted when plugin metadata changes. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/510 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/510 Thu, 20 Aug 2026 15:22:16 GMT The code-mode alias reconciler ignored non-string or blank invalidations of one alias, allowing a hook or trusted policy to be bypassed by supplying both `code` and `command` fields. An attacker could get the policy to clear only one alias while the other retains the malicious script, causing Code Mode to execute the surviving alias despite the policy's attempt to block execution. The patch makes any explicit non-string/blank mutation dominate and mirror to both aliases, causing execution to fail closed. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/506 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/506 Thu, 20 Aug 2026 10:58:56 GMT Before the patch, the gateway used the effective runtime configuration (params.nextConfig) as the activation source config and metadata snapshot config during plugin reload. This allowed synthesized runtime configuration from environment overrides or dynamic generation to be treated as authored trust policy, potentially causing untrusted plugins to be loaded with privileged gateway capabilities (trusted diagnostics, health, trace bridges). The patch separates the authored sourceConfig from the effective nextConfig and uses sourceConfig for trust decisions. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/502 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/502 Thu, 20 Aug 2026 02:49:19 GMT The active-memory plugin's `before_prompt_build` hook executed in the pre-policy phase, recalling and injecting memory context into the prompt even when the finalized tool policy for the turn disallowed memory access (`memory_search`). This bypasses the tool authorization boundary and can disclose private memory contents to the model and user. The patch moves the recall hook to a new post-policy phase with `requiresToolAuthority: true` and checks `toolAuthority.allows('memory_search')` before recalling. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/501 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/501 Thu, 20 Aug 2026 00:29:14 GMT The custom ViewerFailureLimiter used an anchored 60-second window and reset the failure count whenever the current time exceeded windowStartMs + 60s. An attacker could send 39 invalid viewer requests, wait 61 seconds, and repeat indefinitely without ever reaching the 40-failure threshold, effectively disabling brute-force protection. Additionally, when the limiter map reached 2048 entries, prune() cleared all state including active lockouts. The patch replaces it with a rolling-window canonical rate limiter that preserves lockouts. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/499 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/499 Wed, 19 Aug 2026 23:16:51 GMT Before the patch, the Gateway config.get response included a raw deterministic hash of the full config (configRevisionHash) and raw appliedConfigHash. Any client that can retrieve the redacted config could use these hashes as an oracle to brute-force redacted secret values. The patch replaces the raw hashes with installation-local HMAC tokens, preventing external parties from reproducing config digests. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/500 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/500 Wed, 19 Aug 2026 23:18:07 GMT Before the patch, the provisioning of the signed Computer Use service app did not verify that the target codex home and computer-use directory were within the agent's ownership root and not symbolic links. An attacker with control over one agent's directory could create a symlink pointing to another agent's directory or another sensitive location, causing the provisioning logic to write the native client bundle outside the intended isolation boundary, thereby breaking agent isolation and potentially overwriting files. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/497 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/497 Wed, 19 Aug 2026 20:50:31 GMT Before the patch, resolveFeishuToolAccount returned the configured defaultAccount without verifying that the account was enabled. An operator could disable a Feishu account to revoke its access, but model tools would still use its credentials and permissions. The patch checks the enabled status before returning the default account, skipping disabled accounts and selecting an enabled fallback or throwing an error. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/498 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/498 Wed, 19 Aug 2026 20:51:47 GMT MCP App operations performed an authorization check before awaiting catalog work, but did not revalidate the grant after the await. An attacker with a valid MCP App ticket could start a tool call or list operation, then have the granting widget revoked while the catalog request was pending, and the operation would still execute after revocation. The patch adds a revalidation step after the awaited catalog/list work and immediately before tool dispatch or capability return, blocking unauthorized actions. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/495 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/495 Wed, 19 Aug 2026 20:23:17 GMT Before the patch, caller-controlled voice call transcripts were included in the system prompt, giving untrusted speech system-level priority. This allowed a malicious caller to inject instructions that could override system safeguards, potentially causing the assistant to reveal sensitive information, ignore policies, or perform unauthorized actions. The patch moves raw transcripts to the user prompt with proper provenance, ensuring they are treated as untrusted user input. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/493 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/493 Wed, 19 Aug 2026 17:14:51 GMT Before the patch, canonicalizeBase64 appended each base64 character to a string, causing V8 to allocate one cons-string node per character. A remote attacker could send a large base64 attachment (e.g., 20 MiB) to POST /v1/responses, causing the gateway process to exhaust heap memory and crash, denying service. The patch replaces per-character concatenation with a single bounded output buffer, eliminating the unbounded transient heap allocation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/490 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/490 Wed, 19 Aug 2026 14:03:11 GMT Before the patch, the private-network guard (isPrivateOrLoopbackIpAddress) did not classify RFC 8215 local-use NAT64 IPv6 literals (64:ff9b:1::/48) as private, and did not extract embedded IPv4 addresses to check for private ranges. This allowed an attacker to craft an IPv6 literal in that prefix embedding an internal IPv4 address (e.g., 10.0.0.1 or 169.254.169.254) that bypassed SSRF filters. The patch adds explicit detection of local-use NAT64 as blocked special-use and falls back to extracting embedded IPv4 to classify private IPv4-based IPv6 addresses. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/489 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/489 Wed, 19 Aug 2026 13:18:27 GMT The Mattermost ingress debouncer combined messages from different senders into a single inbound turn, allowing a denied user's message to be processed under an allowed user's identity. Additionally, authorless posts fell back to using broadcast metadata as sender ID. The patch separates debounce lanes per sender and requires an explicit post author. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/488 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/488 Wed, 19 Aug 2026 11:59:05 GMT Before the patch, the browser node proxy separately persisted files and applied path mappings. If a browser node returned a result referencing a file not included in the file envelope, the result path was left unvalidated and could contain arbitrary filesystem paths. A malicious or compromised node could return a path like '../../../../etc/passwd', which the Gateway might later serve, leading to arbitrary file read. The patch consolidates validation, persistence, and path rewriting into a single fail-closed operation that rejects missing, duplicate, or unreferenced file payloads. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/487 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/487 Wed, 19 Aug 2026 11:37:14 GMT The vulnerable code consumed the pending Discord speaker context after awaiting an asynchronous active-run control. Concurrent final transcripts could update the pending context during that await, causing a non-owner's transcript to be attributed the owner's senderIsOwner=true context. This allowed a non-owner user's voice command to execute with owner-level permissions. The patch captures the fallback talkback speaker context before the await, preventing the race. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/486 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/486 Wed, 19 Aug 2026 10:44:22 GMT Before the patch, the webhook authentication rate limiter keyed on req.socket.remoteAddress, which is the proxy IP when behind a reverse proxy. An attacker could send invalid signed requests through the proxy to exhaust the shared rate limit, causing legitimate clients behind the same proxy to be rejected with 429 errors before signature verification. The patch uses trusted-proxy client attribution to isolate rate limits per forwarded client IP. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/481 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/481 Wed, 19 Aug 2026 09:00:42 GMT Before the patch, Skill Workshop apply/reject requests did not include the reviewed revision hash. This allowed a race condition where an attacker could modify a proposal after an operator reviewed it but before the operator's decision was submitted, causing the decision to apply to a different, unreviewed revision. The patch binds every decision to the exact reviewed revision through an expectedRevisionHash and rejects stale decisions with SKILL_PROPOSAL_REVISION_CHANGED. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/482 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/482 Wed, 19 Aug 2026 09:03:16 GMT The tool factory used the sandbox/policy key (agentSessionKey) instead of the caller's durable run session key when resolving the caller agent and constructing session lookup tools. In multi-agent deployments, this could cause session list/search/history requests to be issued under an ownerless 'global' policy identity, potentially bypassing per-agent authorization and leaking other agents' session data. The patch switches to runSessionKey (with fallback to agentSessionKey) to ensure the originating agent's identity is used for scoping. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/483 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/483 Wed, 19 Aug 2026 09:04:19 GMT Before the patch, any authenticated Gateway user could call users.setGitHubIdentity to claim any GitHub username without proving ownership of the GitHub account. This allowed an attacker to set their profile's GitHub identity to a victim's username, causing commits created from their sessions to include a forged Co-authored-by trailer for the victim. The patch removes the mutating methods and derives GitHub identity only from authenticated sign-in, binding it to the verified numeric GitHub account id. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/484 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/484 Wed, 19 Aug 2026 09:05:45 GMT The node_process tool was mislabeled as controlling remote-node background sessions, but it actually operated on the Gateway-local process registry. This allowed an attacker with permission to use node_process (but not gateway_process) to enumerate or kill Gateway background processes, bypassing the intended policy separation between remote node and Gateway execution. The patch removes the node_process tool entirely, eliminating the mislabeled tool that could cause cross-session interference or policy violation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/480 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/480 Wed, 19 Aug 2026 07:13:18 GMT The patch fixes a vulnerability where an explicitly configured but policy-blocked SearXNG base-URL SecretRef was treated as missing, causing fallback to the ambient SEARXNG_BASE_URL environment variable and bypassing the provider/env allowlist. This could allow unauthorized use of a SearXNG instance or enable SSRF to internal resources. The patch introduces tri-state read-only resolution that distinguishes blocked from missing, and only falls back when the SecretRef is genuinely absent. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/479 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/479 Wed, 19 Aug 2026 05:55:16 GMT Before the patch, `authorizeControlUiReadRequest` fell back to device-token authentication when shared-secret auth failed, but after validating the device token it returned true immediately without enforcing the required operator scope (e.g., `assistant.media.get` or `operator.read`). This allowed a paired device token with no relevant scopes to access read-only Control UI endpoints such as assistant media, workspace icons, or channel avatars. The patch replaces this custom logic with `authorizeControlUiReadRequestOrReply`, which carries verified scopes through the authorizer and enforces the required scope for all auth methods. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/478 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/478 Wed, 19 Aug 2026 05:00:09 GMT The force parameter in the worktree removal API was overloaded to bypass not only snapshot-loss protection but also live-run lease and foreign Git lock checks. A user with permission to remove worktrees could set force:true to delete another user's active worktree, causing denial of service and loss of uncommitted changes. The patch separates snapshot-loss consent (allowSnapshotLoss) from lifecycle authority, making lease and lock checks unconditional. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/477 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/477 Wed, 19 Aug 2026 02:52:17 GMT Before the patch, when an agent run completed with an authoritative silent or empty terminal reply, the waiting code would ignore that terminal reply and fall back to reading the latest assistant message from the session transcript. This could resurrect private or sensitive content from earlier assistant turns that the agent intended not to expose as final output, leading to unauthorized disclosure of private transcript text. The patch ensures that any present terminal reply (visible, silent, or empty) is treated as authoritative, preventing transcript fallback and the associated information leak. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/476 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/476 Wed, 19 Aug 2026 02:02:51 GMT Beam mirror upload code followed HTTP redirects when sending session snapshots to a configured endpoint. An attacker who could induce a 307/308 redirect (e.g., via an open redirect on the receiver or a compromised receiver) could cause the POST body containing sensitive coding session content to be replayed to an arbitrary internal or attacker-controlled URL, bypassing SSRF guards. The patch stops redirect following and treats redirect responses as terminal, preventing the replay. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/475 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/475 Wed, 19 Aug 2026 00:27:25 GMT The gateway tool denial list did not normalize tool names, so aliases like 'cron' did not match the canonical tool name 'automations'. This allowed a tool to be invoked even when explicitly denied in the gateway configuration. The patch normalizes both the deny set and tool names, ensuring deny rules are enforced across aliases. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/474 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/474 Tue, 18 Aug 2026 23:39:09 GMT Before the patch, the Codex approval bridge allowed operators to grant persistent ('allow-always') approval for command executions even when the native Codex request only supported one-shot ('accept') approval. This caused the Gateway to store an allow-always decision for actions that should have been one-shot, enabling subsequent executions of the same command without further operator approval. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/473 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/473 Tue, 18 Aug 2026 22:58:16 GMT The commit fixes a policy bypass where sender-scoped file read restrictions (toolsBySender deny rules) were not enforced on outbound file attachments, especially when the message action targeted a different channel. Attackers could prompt the agent to attach local files (e.g., workspace secrets) to messages sent to another channel, causing the policy resolver to use the target channel's provider instead of the original sender's, thereby bypassing denial. The patch ensures the correct sessionKey and requester identity are used to resolve sender policy for outbound media. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/472 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/472 Tue, 18 Aug 2026 22:09:07 GMT The UI used all discovered skills as the base when toggling a skill for an agent with inherited allowlist, leading to an explicit override that enabled all skills, bypassing the inherited restrictions. The patch uses the effective inherited filter as the base, preventing unintended privilege escalation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/470 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/470 Tue, 18 Aug 2026 20:59:25 GMT The 'openclaw channels logs' command read the gateway log file directly and printed raw log lines without applying secret redaction. This allowed sensitive values present in the log file (e.g., credentials, tokens, secrets) to be exposed in CLI output. The patch routes the command through the canonical log-tail reader that applies pattern redaction and the registered-secret registry, preventing credential leakage. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/467 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/467 Tue, 18 Aug 2026 19:15:05 GMT Classic inbound voice callers were not explicitly marked as non-owners before the embedded agent invocation. The agent runtime defaults to owner privileges when senderIsOwner is undefined, allowing external callers to invoke owner-only control-plane tools. The patch passes senderIsOwner: false for inbound calls and undefined for outbound delegated calls. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/463 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/463 Tue, 18 Aug 2026 17:44:33 GMT Before the patch, gateway session create/fork/recover handlers did not correctly enforce session participation boundaries for multi-profile operators with write scope. An operator could apply lifecycle operations (e.g., fork/recover) to a session they were not a participant in, copying its transcript or reusing its data. The patch adds method-specific protocol target extraction and revalidates participation inside the SQLite commit transactions via commitGuard, returning SESSION_PARTICIPATION_REQUIRED. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/458 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/458 Tue, 18 Aug 2026 15:56:00 GMT The `config get` command previously failed to redact plugin-schema-defined secrets and structured SecretRef identifiers, allowing operators to expose sensitive values. The patch ensures redaction uses the exact config snapshot and plugin metadata, and fails closed if metadata is unavailable, preventing secret leakage. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/455 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/455 Tue, 18 Aug 2026 14:51:14 GMT Before this patch, the steering logic could inject a message into any active embedded agent run by looking it up with a raw session ID, without verifying that the caller's tool authority matched the session's tool authority. This allowed an authenticated attacker to steer another user's session and execute arbitrary instructions under the victim agent's identity. The patch removes the raw session-id path and requires tool-authority equality for /steer and gateway injection. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/453 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/453 Tue, 18 Aug 2026 10:54:01 GMT The streaming TTS path passed raw assistant reply text directly to TTS providers without applying speech-text normalization, causing raw Markdown link destinations (including sensitive tokens) to be spoken aloud. This allowed other users in a Discord voice channel to hear secret URLs (e.g., password reset links) that should have been redacted. The patch normalizes the text before streaming synthesis, stripping raw link destinations. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/450 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/450 Tue, 18 Aug 2026 09:58:13 GMT Before the patch, Skill Workshop collection review could rewrite or delete any skill file located in a writable workspace directory, including user-authored or repository-owned skills, because no ownership verification was performed. An attacker who could influence the autonomous review (e.g., via prompt injection in a malicious skill) could cause arbitrary skill files to be overwritten or dropped, leading to data loss and potential code execution when the overwritten skill is later used. The patch restricts mutations to skills with an applied Workshop create proposal, blocking unauthorized changes to external skills. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/448 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/448 Tue, 18 Aug 2026 08:59:44 GMT Before the patch, when an OpenClaw session executed in a folder outside the configured agent workspace, it loaded identity files (AGENTS.md, SOUL.md, IDENTITY.md, USER.md, MEMORY.md) from the execution folder. An attacker-controlled repository could contain malicious versions of these files, allowing prompt injection to override the agent's core identity and instructions. The patch sources agent identity from the configured workspace and only layers execution-directory AGENTS.md as downstream project context. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/446 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/446 Tue, 18 Aug 2026 08:20:26 GMT The ACP approval classifier auto-approves readonly reads only when the resolved path stays within the current working directory. Before the patch, only lowercase `file://` URLs were converted to filesystem paths; alternate valid file URL forms like `file:/outside` or `FILE:///outside` were treated as relative paths and resolved inside cwd, so the permission check passed. A malicious tool call could request `file:/etc/passwd` and receive automatic approval, allowing arbitrary local file reads outside the intended approval boundary. The patch normalizes all file-scheme spellings with `trySafeFileURLToPath` and fails closed when conversion fails. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/445 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/445 Tue, 18 Aug 2026 05:21:49 GMT The patch fixes a security boundary bypass where the `allowedDomains` restriction configured for Codex native hosted search was not enforced on the managed `web_fetch` tool. Before the patch, an attacker controlling the model could use `web_fetch` to request arbitrary URLs, including internal services and cloud metadata endpoints, bypassing the intended domain allowlist. The patch propagates the allowlist into the `web_fetch` tool configuration when native hosted search is active, ensuring it honors the same domain policy. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/444 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/444 Tue, 18 Aug 2026 04:50:37 GMT The MCP diagnostic redaction only partially masked secrets in error messages, leaving a prefix and/or suffix visible. This could leak portions of API keys, bearer tokens, or other sensitive data to anyone with access to logs or diagnostics. The patch replaces this partial masking with full asterisk masking, ensuring no secret characters are exposed. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/443 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/443 Tue, 18 Aug 2026 04:05:14 GMT Before the patch, agent requests with attachments that were later rejected (e.g., due to an invalid channel) left staged files in media/inbound permanently. An attacker could repeatedly send such requests with large attachments to fill the disk and crash the service. The patch adds explicit cleanup of prepared inbound media on rejection and bounds outbound staging retention. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/442 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/442 Tue, 18 Aug 2026 02:47:45 GMT The voice-call CLI operational error formatter directly interpolated connectionDetails.url, which could include credentials in userinfo or query parameters (e.g., ws://user:pass@host). This caused gateway credentials to be printed in terminal error messages when CLI commands failed. The patch applies the canonical net-policy redactor to URLs before composing error messages, preventing credential leakage. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/437 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/437 Tue, 18 Aug 2026 01:58:21 GMT Before the patch, Gateway hot reload did not refresh the hook target-policy snapshot when agent roster, ownership, session store/scope changed. An attacker with a previously valid direct-hook token for a removed agent could continue to invoke that agent's hooks after revocation, because the stale snapshot still considered the agent valid until a full restart. The patch adds these config paths to the reload plan and refreshes the policy snapshot without invalidating transform modules. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/438 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/438 Tue, 18 Aug 2026 02:01:51 GMT The Matrix channel normalized complete user IDs to lowercase for allowlist and authorization checks, causing accounts that differ only by case or Unicode case folding to be treated as identical. An attacker could register a Matrix account with the same localpart but different case (e.g., @alice:example.org vs @Alice:Example.org) and be authorized as the allowed user. The patch removes case folding for complete user IDs, making comparisons exact. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/439 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/439 Tue, 18 Aug 2026 02:03:05 GMT Before the patch, an agent could use the generic Nodes tool `invoke` action to call commands owned by node-published agent tools, bypassing the allow/deny policy enforced by those dedicated tools. For example, a denied command like `remote.secret` could be invoked directly through `node.invoke` without checking if a node-published tool exists for it. The patch centralizes node-invoke calls and rejects commands matching node-published tools or reserved dedicated commands unless invoked through their policy-filtered tool surface. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/441 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/441 Tue, 18 Aug 2026 02:10:49 GMT Before the patch, malformed --provider-env entries caused CLI parse errors to echo the full user-provided string, which could contain secrets (e.g., an API key passed as the value). Additionally, --provider-env was not included in the argv redaction set for config audit logs, so valid KEY=VALUE assignments were persisted with credentials in plaintext. The patch replaces error messages with fixed strings and adds --provider-env to the redaction list. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/435 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/435 Mon, 17 Aug 2026 23:35:03 GMT Classic onboarding printed a reusable Gateway token inside a dashboard URL (e.g., http://127.0.0.1:18789#token=<token>). This token-bearing output could be captured in terminal transcripts, logs, screen recordings, or support bundles, allowing an attacker who obtains such artifacts to authenticate to the Control UI and potentially control the system. The patch removes the authenticated URL builder and related token-specific output, printing only uncredentialed URLs and recovery commands. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/436 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/436 Mon, 17 Aug 2026 23:36:45 GMT Before the patch, when the bot's own username was unknown (pre-identity), any Telegram command targeted at a different bot (e.g., '/queue@OtherBot') was treated as a command for this bot due to permissive parsing in resolveTelegramCommandAliasForControlLane. This allowed an attacker to trigger control commands, potentially causing unauthorized actions. The patch restricts pre-identity command acceptance to only canonical abort commands. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/434 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/434 Mon, 17 Aug 2026 22:57:18 GMT When a structured attachment contained multiple media source fields (e.g., 'media' and 'path'), the normalization function only validated the first source due to a break statement in the collection loop. An attacker could supply a valid primary source inside the sandbox and a malicious secondary source outside the sandbox. The secondary source would bypass sandbox validation and could later be consumed by channel delivery, enabling arbitrary file read outside the sandbox. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/432 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/432 Mon, 17 Aug 2026 21:57:04 GMT In Talk voice-only sessions, the `talk.client.toolCall` entry point dispatched embedded agent consults via `handleChatSend` without limiting the tool set to the caller's scopes. A session with only `operator.talk` (read-only) could therefore invoke state-changing owner tools (e.g., file writes or command execution) available to the embedded agent. The patch resolves authority from authenticated scopes and passes a restricted `toolsAllow` list to chat dispatch. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/428 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/428 Mon, 17 Aug 2026 21:37:11 GMT Before the patch, generateSlugViaLLM called runEmbeddedAgent with user-controlled sessionContent without disabling tools or providing an empty tool allowlist. This allowed prompt injection in the transcript to cause the model to invoke the agent's normal tools, potentially leading to arbitrary command execution or data exfiltration. The fix sets disableTools: true and toolsAllow: \[\] to ensure the slug generation helper cannot access any tools. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/429 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/429 Mon, 17 Aug 2026 21:37:52 GMT Before the patch, memory tools captured configuration at creation time and would fall back to that if the live configuration was unavailable or memory was disabled. This allowed agents to continue accessing memory (read, write, delete) after an operator disabled memory for the agent via a hot configuration update. The patch revalidates the live configuration at execution time and throws an error if memory is disabled, enforcing revocation. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/430 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/430 Mon, 17 Aug 2026 21:38:41 GMT Before the patch, the Parallel web search provider included unredacted error response bodies (or statusText) in thrown errors. If the external endpoint or an intermediate proxy reflected request headers, the operator's x-api-key could be leaked into user-facing error messages, exposing a secret credential to end users. The patch redacts sensitive text in two passes to mask the API key and any configured credential patterns. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/431 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/431 Mon, 17 Aug 2026 21:39:33 GMT The tar archive safety preflight ignored output truncation from 'tar tf'/'tar tvf', allowing an attacker to pad an archive with many entries so that a malicious path-traversal entry is hidden from the safety check while still being extracted. The patch fails closed when listing output is truncated and rejects unknown tar entry types, preventing extraction based on an incomplete manifest. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/421 Fri, 14 Aug 2026 08:35:19 GMT The shared approval-account selection logic's sole-account fallback did not check whether the approval request's originating channel (turnSourceChannel) matched the candidate channel, allowing an exec approval prompt originating from one channel (e.g., WhatsApp/Slack) to be delivered to a completely different, unrelated channel (e.g., Telegram) when that channel happened to be the only eligible account. This could expose sensitive command approval prompts (including command content) to unintended recipients on a foreign channel. The patch adds a check that rejects the fallback when the turnSourceChannel differs from the target channel, while still respecting explicit recorded bindings or forwarding targets. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/420 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/420 Fri, 14 Aug 2026 04:27:26 GMT On multi-identity Gateways, session-catalog visibility filtering compared the caller's profileId against a host row's createdActor.id, but for unauthenticated-profile callers (token/password auth) and unadopted host rows, both values were undefined. The optional-value equality check treated undefined === undefined as a match, causing the filter to fail-open and expose other users' host session metadata and transcripts to a caller with no profile at all. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/415 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/415 Thu, 13 Aug 2026 02:43:54 GMT The compaction safeguard's error log for corrective generation failures included the raw exception message via formatErrorMessage(attemptError), which could contain arbitrary internal data such as user session text, API details, or other sensitive content embedded in the underlying error. The patch redacts this by replacing the full exception text with a generic reason code and attempt number, preventing sensitive data from leaking into logs. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/416 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/416 Thu, 13 Aug 2026 02:44:41 GMT The Reef relay client passed relay-controlled error messages (from HTTP JSON error bodies and WebSocket close reasons) directly to callers/diagnostics without redacting credentials. Since a malicious or misbehaving relay could reflect the request's Authorization bearer token, setup token, request signature, or WebSocket signature back in the error message, these secrets could be surfaced in logs, UI, or telemetry. The patch strips known request secrets (tokens, sessions, signatures) from relay error text and WebSocket close reasons before applying a general redactor. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/413 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/413 Wed, 12 Aug 2026 13:41:20 GMT Before the patch, sending a message or reading history for an explicit session key that did not exist would silently treat the target as an empty/newly-created session rather than rejecting the request. This allowed callers to implicitly create or interact with sessions that should not exist and could be used as an oracle to infer whether a specific (potentially otherwise inaccessible) session key exists, undermining the session visibility/authorization boundary. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/408 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/408 Tue, 11 Aug 2026 18:04:21 GMT Both the chrome-mcp accessibility snapshot builder and the CDP renderRoleTree function recursively walked the accessibility tree without an enforced depth limit. A malicious or pathologically-nested web page (e.g., tens of thousands of nested DOM elements) could cause the recursive traversal to overflow the call stack (RangeError: Maximum call stack size exceeded), crashing the browser automation/gateway process, or generate quadratically growing indentation output (hundreds of MB) before any truncation logic runs, exhausting memory. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/395 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/395 Mon, 10 Aug 2026 10:06:33 GMT The Matrix plugin's 'permissions' action (used for verification-management operations like verification-bootstrap, which can reset cross-signing keys and set recovery keys) was gated only by an 'encryption' and 'verification' config flag, without checking whether the sender was actually the bot owner. Any Matrix user able to send messages/commands to the bot could invoke sensitive verification actions such as forcing a cross-signing reset or listing verification state, potentially compromising encryption trust or account security. The patch adds an explicit senderIsOwner check both when advertising the action in tool discovery and when dispatching it, throwing a ToolAuthorizationError for non-owners. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/392 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/392 Mon, 10 Aug 2026 05:51:53 GMT The memory-host SDK maintained its own stale SECRET_PATTERNS table for redacting sensitive data in error messages, which lacked coverage for payment card numbers, CVV codes, and other payment credentials that the canonical redactor (src/logging/redact.ts) covers. Additionally, ACP's error redaction depended on module load order via a fragile injection hook, and when operator-configured redactPatterns were non-empty they fully replaced (rather than extended) built-in provider-token patterns, causing default secret patterns to go unredacted. This meant sensitive data such as credit card numbers or provider tokens could leak unredacted into error logs/output at these security boundaries. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/393 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/393 Mon, 10 Aug 2026 05:52:35 GMT The MS Teams group message admission logic only fell back to the allowlist re-check when the sender access denial reason was exactly 'group_policy_not_allowlisted'. If the sender access group was missing or referenced an unsupported/unrecognized group type (e.g., a Discord-typed access group), the denial reason code would differ, causing the code to skip the deny path entirely and treat the message as admitted, allowing unauthorized senders' messages to be processed and persisted. The fix makes any '!senderAccess.allowed' result authoritative, ensuring fail-closed behavior regardless of the specific reason code. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/391 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/391 Sun, 09 Aug 2026 17:01:50 GMT The chat display projection only sanitized audio blocks with `entry.source.type === 'base64'` and string `source.data`, failing to strip top-level `data` fields, non-string `source.data`, or filesystem/local path references (e.g. `file://`, `~/`, `C:\\`, UNC paths) embedded in audio block fields like `path`, `file`, `url`, `openUrl`. Authenticated WebSocket and HTTP/SSE history clients could therefore retrieve raw audio bytes or host-local filesystem paths that were persisted in transcript blocks, leaking sensitive local file locations or raw audio payloads that should have been redacted at the shared history boundary. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/390 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/390 Sat, 08 Aug 2026 23:42:00 GMT The debug proxy capture cloned every response body and read it with no bound on inter-chunk wait time. A malicious or stalled remote server could send response headers plus a single chunk and then go silent indefinitely, leaving the clone() tee branch open forever; since a tee branch only settles when both branches cancel or reach EOF, this caused the caller's own cancellation and the subsequent transport release to hang, tying up connection/transport resources. The patch bounds the read with an idle timeout, cancelling the stalled branch and recording the exchange as 'stalled' metadata instead of blocking indefinitely. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/389 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/389 Sat, 08 Aug 2026 19:59:08 GMT normalizeActRequest recursively processed nested 'batch' actions without any depth limit, allowing a specially crafted POST /act request body (up to the 1MB limit) with tens of thousands of nested batch wrappers to cause unbounded recursion and crash the process with a RangeError (stack overflow) before validation checks could run. The patch introduces a depth parameter bound by ACT_MAX_BATCH_DEPTH, rejecting deeply nested payloads early with a clear error instead of overflowing the call stack. medium confirmed CVE-2026-66418 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/388 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/388 Sat, 08 Aug 2026 19:40:48 GMT The decodeMatrixEnvAccountToken function used Number.isFinite to validate hex-decoded code points before passing them to String.fromCodePoint, but Number.isFinite does not bound values to the valid Unicode range (0x0-0x10FFFF). A crafted environment variable name with a hex escape exceeding 0x10FFFF causes String.fromCodePoint to throw an uncaught RangeError, crashing listMatrixEnvAccountIds and preventing discovery of all Matrix accounts during startup/doctor checks. The patch adds an explicit upper-bound check (codePoint > 0x10ffff) to reject such tokens gracefully. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/387 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/387 Sat, 08 Aug 2026 04:44:06 GMT The voice-call provider clients (Twilio/Telnyx/Plivo) built error messages by directly embedding the raw provider HTTP error response body, which can echo back credential-bearing request details such as the Authorization header value, API keys, or account tokens. These unredacted error messages were thrown and could propagate into application logs or user-facing diagnostics, exposing secrets to anyone with access to logs or error output. The patch adds `redactSensitiveText` to strip credential-like content from the error snippet before it is used in thrown errors. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/382 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/382 Fri, 07 Aug 2026 11:28:24 GMT The sub-agent hard-deny list (blocking tools like sessions_send, message, conversations_*, gateway) could be overridden by configuring those tool names in an operator's allow/alsoAllow config, allowing a sub-agent session to regain direct message-sending and session-control capabilities that are supposed to be permanently restricted to enforce the announce-chain communication contract. Additionally, the message tool was only disabled at spawn time for hidden launches, so resumed or dashboard-visible sub-agent sessions could rebuild their tool set without that restriction and message users directly, bypassing the intended isolation boundary. high confirmed CVE-2026-66421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/383 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/383 Fri, 07 Aug 2026 11:28:40 GMT Gateway connection URLs can embed basic-auth credentials or token/API-key query parameters. Before this patch, several diagnostic surfaces (`openclaw status`, `status --all` text/JSON, and `logs` CLI error output) printed the raw connection URL verbatim, including embedded secrets, and probe failure text/thrown errors could also echo credential-bearing URLs. This exposes live credentials to terminal output, log files, or bug reports pasted by operators. medium confirmed CVE-2026-66418 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/380 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/380 Fri, 07 Aug 2026 00:31:25 GMT The Google Chat API client read error response bodies from remote/proxy servers and included the raw text verbatim in surfaced error messages without redaction. If a malicious or misconfigured upstream/proxy server reflected the request's Authorization header (bearer token) back in the error response body, that token would be exposed in error messages returned to users, logs, or downstream consumers. The fix applies forced redaction (redactToolPayloadText) to the error response text before it is used in any error message. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/376 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/376 Thu, 06 Aug 2026 09:48:15 GMT The plugin-node capability authorizer only checked whether a capability token existed and was unexpired, without checking if the owning client had already been invalidated (e.g., removed by an operator). This allowed a removed node's already-issued capability URL to continue authorizing Canvas HTTP requests during the window between invalidation and full connection teardown, since the invalidated client remained in the clients set and its capability entry was still matched. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/377 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/377 Thu, 06 Aug 2026 09:49:00 GMT Feishu's message-action contract did not declare its native camel-case/snake-case chat identifier fields (chatId, chat_id, channel_id) as delivery targets for the edit, pin, and unpin actions. Because the shared cross-context policy engine only inspects declared delivery-target aliases, operators using these native Feishu fields could bypass the configured 'disable within-provider cross-context messaging' restriction and perform message mutations against a chat/conversation different from the current context. medium confirmed CVE-2026-66421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/374 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/374 Thu, 06 Aug 2026 04:27:38 GMT When a proxy or upstream server reflected the Discord bot's Authorization header value back in an error response (either HTML/text or JSON body), the raw bot token would be included unredacted in the error message surfaced to users/logs. This could expose the bot credential to anyone who could view logs, error output, or troubleshooting UI. The patch adds redaction of the token via redactToolPayloadText before formatting the final error text and before summarizing HTML bodies. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/369 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/369 Wed, 05 Aug 2026 04:28:35 GMT The stdout data handler for MCP stdio child processes called ReadBuffer.append synchronously without a try/catch. When a server (or attacker-influenced tool-result payload) produces a stdout frame exceeding the 10MiB ReadBuffer cap, append() throws synchronously inside the event callback, resulting in an unhandled exception that crashes the entire host process and terminates all concurrent sessions. The patch wraps the append/processReadBuffer calls in a try/catch that routes errors to onerror and gracefully closes the transport instead of crashing. high confirmed CVE-2026-66421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/360 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/360 Tue, 04 Aug 2026 15:06:14 GMT Shared group and channel chat sessions automatically loaded the workspace-root MEMORY.md file into the bootstrap context, exposing private long-term memory/context intended only for the main private session to all participants in a shared group or channel. Additionally, hooks could re-add or relabel the MEMORY.md file after initial filtering, bypassing session-type-based restrictions on private memory exposure. The patch enforces filtering of private memory files based on an authoritative chatType, re-applies the filter after hook mutations, and tracks file source identity to prevent relabeling/aliasing bypasses. high confirmed CVE-2026-66421 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/361 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/361 Tue, 04 Aug 2026 15:07:45 GMT The DiscordRealtimeVoiceSession queued completed 'exact speech' messages without any bound on count or size while provider readiness, an active response, or playback prevented delivery. A stalled or misbehaving session could accumulate an unbounded backlog of speech text in memory, leading to unbounded memory growth and eventual resource exhaustion, and could later flush a large stale backlog. The patch introduces a fixed budget (32 messages / 32 KiB) and terminates the session on overflow, clearing state to prevent unbounded growth. medium confirmed CVE-2026-66421