AgentShroud sits transparently between your AI agents and every system they touch. Every tool call, API request, file write, and cloud mutation is intercepted, inspected, and policy-enforced — without modifying the agent.
Every module is fully wired in the request pipeline. No dead code, no placeholders.
PromptGuard + HeuristicClassifier intercept and neutralize injection attempts before they reach tool execution.
Presidio-powered detection at 0.9 confidence minimum. Redacts PII from both inbound and outbound traffic.
Domain allowlisting, DNS filtering, and real-time egress approval queue with Telegram notifications.
High-risk actions — email sending, file deletion, external API calls, skill installation — route through a persistent approval queue.
7-page web control center: approvals, delegations, tool ACLs, shared memory, RBAC, and live agent activity.
Trivy-powered CVE digests delivered daily via Telegram. Severity-filtered, owner-gated, with error-report fallback.
1Password CLI, macOS Keychain, and secret-tool integration. No plaintext secrets on host disk during normal operation.
Cosign image signing, Trivy CVE scanning, Semgrep SAST, ClamAV malware scanning, Falco runtime enforcement.
STPA-Sec methodology (Nancy Leveson, MIT), developed with security advisor Steven Hay — code-path and live assessments run through the production interface, not a synthetic benchmark.
FR3→SL3 system integrity, FR6→SL3 audit logging with SHA-256 hash chains, FR7→SL2 availability hardening.
Every inbound request traverses all active layers. Enforcement is the default — monitor mode requires explicit opt-in.
| Layer | Modules |
|---|---|
| P0 Core | PromptGuard, TrustManager, EgressFilter, PII Sanitizer, Gateway Binding |
| P1 Middleware | SessionManager, TokenValidator, ConsentFramework, SubagentMonitor, AgentRegistry, Delegation, SharedMemory, ToolACL, PrivacyPolicy, RBAC, ContextGuard, ContextIntegrity, EncodingDetector, InputNormalizer, HeuristicClassifier, ApprovalHardening, BrowserSecurity |
| P2 Output | OutboundFilter, OutputCanary, OutputSchema, MultiTurnTracker, LogSanitizer, MetadataGuard, ToolResultSanitizer, ToolResultInjection, XmlLeakFilter, PromptProtection |
| P3 Tool Control | ToolACL, ToolChainAnalyzer, InstructionEnvelope, SubagentMonitor, ProgressiveLockdown, KillswitchMonitor |
| P4 Network | EgressFilter, EgressApproval, EgressMonitor, DNSFilter, NetworkValidator, WebContentScanner |
| P5 File & Memory | FileSandbox, PathIsolation, DriftDetector, MemoryIntegrity, MemoryLifecycle, GitGuard, EnvGuard, ConfigIntegrity |
| P6 Infrastructure | ImageVerifier (cosign/Sigstore), ClamAV, Trivy, Falco, Wazuh, EncryptedStore, KeyVault, KeyRotation, HealthReport, AlertDispatcher, CanaryTripwire, SOCCorrelation, ScannerIntegration |
OpenClaw is AgentShroud's flagship production bot — a Node.js autonomous agent shipped as agentshroud-openclaw. It has been in production since v1.0.x and is the primary interface for Telegram, Slack, iOS Shortcuts, Browser Extension, SSH, and REST API — all traffic governed by the full 75-module security pipeline.
Telegram bot, Slack workspace integration, iOS Shortcuts, Browser Extension, SSH terminal access, and REST API — every channel routes through AgentShroud before reaching any downstream system.
All egress routes via gateway:8181 (HTTP CONNECT proxy). All LLM calls route via gateway:8080. PII is redacted at 0.9 confidence before any response reaches a user. Credentials are never leaked in chat — blocked at the sanitizer layer.
Per-collaborator workspace isolation with encrypted memory volumes. Conversation context, task history, and collaborator profiles persist across restarts on the agentshroud-config volume.
Built-in web dashboard at port 18789 (published at 127.0.0.1:18789). Manage devices, view conversation history, and configure channels without CLI access.
# Add the bot to your Telegram workspace # Bot token stored in Docker secret: telegram_bot_token # Check status curl http://localhost:8080/status # Full setup guide: docs/setup-telegram.md
Hermes is the second AgentShroud-secured autonomous AI agent — Python-based, built on nousresearch/hermes-agent. It runs alongside OpenClaw inside the same 75-module governance envelope, fully isolated on the agentshroud-isolated network with all LLM and egress traffic routed through the gateway.
Telegram, Slack, Brave web search, web fetch, cron scheduling, subagent personas, and native MCP (Model Context Protocol) server integrations — all policy-enforced at the gateway.
All Hermes egress routes via gateway:8181 (HTTP CONNECT proxy). All LLM calls route via gateway:8080. Same 75-module pipeline as OpenClaw — no bypass path exists at the container level.
Exposes an OpenAI-compatible API on port 8642. Any tool or client that speaks the OpenAI chat completions format can connect to Hermes through the gateway's credential-injection and audit layer.
Built-in admin dashboard on port 9119. Access is gateway-auth-gated — unauthenticated requests are blocked before reaching the Hermes process.
# OpenAI-compatible endpoint (requires gateway auth token) base_url = "http://localhost:8642/v1" # Health check curl http://localhost:8642/health # Full setup guide: docs/setup/HERMES_SETUP.md
The ESP32-S3-BOX-3 is an optional hardware control surface that lets you interact with any AgentShroud-proxied agent by voice — say "Hi, ESP" or tap the screen, speak naturally, and hear the agent's reply through the built-in speaker. All audio routes through the full 75-module security pipeline: PII redaction, prompt-guard, audit hash-chain, egress policy.
Say "Hi, ESP" or tap anywhere on the touchscreen. Short tap → VAD timeout (8 s silence ends utterance). Long press → ends on release.
Press the MUTE button to cycle between Hermes (agentic, synchronous reply), Fast LLM (low-latency Claude Haiku proxy), and OpenClaw (async — replies on Telegram).
Utterances route through POST /forward?route_to=<agent> — the same AgentShroud pipeline used by all other control surfaces. Token-authenticated WebSocket over Tailscale Funnel (TLS 443).
Tailscale Funnel provides a public TLS endpoint on marvin. The device works on home WiFi, cellular hotspot, or any internet connection — no VPN client on the ESP required.
# Start the voice gateway docker-compose -f docker/docker-compose.yml -p agentshroud --profile voice up -d # Flash the firmware (ESP32-S3-BOX-3 on USB) cd firmware/voice-terminal idf.py -p /dev/cu.usbmodem* flash # Full setup guide: docs/integrations/voice-terminal-esp32-s3.md
All CVEs disclosed in OpenClaw (January–September 2026) are documented and tracked by AgentShroud’s defense-in-depth architecture.
| CVE | CVSS | Title | Status |
|---|---|---|---|
| ASH-OCLAW-006 | 9.9 CRITICAL | WebSocket Scope Self-Declaration | ✓ Mitigated |
| ASH-OCLAW-009 | 9.9 CRITICAL | Token Scope Expansion via device.token.rotate | ✓ Mitigated |
| ASH-OCLAW-018 | 9.9 CRITICAL | In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed... | ✓ Mitigated |
| ASH-OCLAW-019 | 9.9 CRITICAL | Versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to... | ✓ Mitigated |
| ASH-OCLAW-020 | 9.9 CRITICAL | Before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve com... | ✓ Mitigated |
| ASH-OCLAW-021 | 9.8 CRITICAL | CVE-2026-27002 | ✓ Mitigated |
| ASH-OCLAW-022 | 9.8 CRITICAL | Versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in ... | ✓ Mitigated |
| ASH-OCLAW-023 | 9.8 CRITICAL | Versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass... | ✓ Mitigated |
| ASH-OCLAW-024 | 9.8 CRITICAL | OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on... | ✓ Mitigated |
| ASH-OCLAW-025 | 9.8 CRITICAL | A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows... | ✓ Mitigated |
| ASH-OCLAW-026 | 9.8 CRITICAL | Before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows ... | ✓ Mitigated |
| ASH-OCLAW-027 | 9.8 CRITICAL | Before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction e... | ✓ Mitigated |
| ASH-OCLAW-028 | 9.8 CRITICAL | Before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllow... | ✓ Mitigated |
| ASH-OCLAW-029 | 9.8 CRITICAL | Before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode... | ✓ Mitigated |
| ASH-OCLAW-030 | 9.8 CRITICAL | Before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing veri... | ✓ Mitigated |
| ASH-OCLAW-031 | 9.8 CRITICAL | Before 2026.3.13 contains a remote command injection vulnerability in the iMessage atta... | ✓ Mitigated |
| ASH-OCLAW-032 | 9.4 CRITICAL | Versions prior to 2026.2.1 with the voice-call extension installed and enabled contain ... | ✓ Mitigated |
| ASH-OCLAW-033 | 9.4 CRITICAL | Versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where ... | ✓ Mitigated |
| ASH-OCLAW-034 | 9.3 CRITICAL | Before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGu... | ✓ Mitigated |
| ASH-OCLAW-017 | 8.8 HIGH | Privilege Escalation (operator.write reaches owner-only surfaces) | ✓ Mitigated |
| ASH-OCLAW-035 | 8.8 HIGH | (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query stri... | ✓ Mitigated |
| ASH-OCLAW-036 | 8.8 HIGH | (formerly Clawdbot) is a personal AI assistant you run on your own devices | ✓ Mitigated |
| ASH-OCLAW-037 | 8.8 HIGH | CVE-2026-26323 | ✓ Mitigated |
| ASH-OCLAW-038 | 8.8 HIGH | Versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attac... | ✓ Mitigated |
| ASH-OCLAW-039 | 8.8 HIGH | Version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command ... | ✓ Mitigated |
| ASH-OCLAW-040 | 8.8 HIGH | Versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that ... | ✓ Mitigated |
| ASH-OCLAW-041 | 8.8 HIGH | Versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.fil... | ✓ Mitigated |
| ASH-OCLAW-042 | 8.8 HIGH | Versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allo... | ✓ Mitigated |
| ASH-OCLAW-043 | 8.8 HIGH | Before 2026.3.12 contains an insufficient access control vulnerability in the /config a... | ✓ Mitigated |
| ASH-OCLAW-044 | 8.8 HIGH | Before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagen... | ✓ Mitigated |
| ASH-OCLAW-045 | 8.8 HIGH | Before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RP... | ✓ Mitigated |
| ASH-OCLAW-046 | 8.8 HIGH | Before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that a... | ✓ Mitigated |
| ASH-OCLAW-047 | 8.8 HIGH | Before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.appro... | ✓ Mitigated |
| ASH-OCLAW-048 | 8.8 HIGH | Before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allo... | ✓ Mitigated |
| ASH-OCLAW-049 | 8.8 HIGH | Before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin opera... | ✓ Mitigated |
| ASH-OCLAW-050 | 8.8 HIGH | Before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals tha... | ✓ Mitigated |
| ASH-OCLAW-817 | 8.8 HIGH | Google Meet node commands could skip exec approvals | ✓ Mitigated |
| ASH-OCLAW-827 | 8.8 HIGH | Slack group DMs could skip sender allowlists | ✓ Mitigated |
| ASH-OCLAW-844 | 8.8 HIGH | Cron tool could accept mixed-case command payloads | ✓ Mitigated |
| ASH-OCLAW-847 | 8.8 HIGH | Codex bind could omit owner authorization | ✓ Mitigated |
| ASH-OCLAW-873 | 8.8 HIGH | Codex computer-use install could omit owner authorization | ✓ Mitigated |
| ASH-OCLAW-880 | 8.8 HIGH | Inbound voice calls could inherit owner tool authority | ✓ Mitigated |
| ASH-OCLAW-886 | 8.8 HIGH | Codex native tools could ignore per-chat policy | ✓ Mitigated |
| ASH-OCLAW-887 | 8.8 HIGH | MCP configuration changes could omit owner authorization | ✓ Mitigated |
| ASH-OCLAW-051 | 8.6 HIGH | Versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the s... | ✓ Mitigated |
| ASH-OCLAW-052 | 8.6 HIGH | Before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode... | ✓ Mitigated |
| ASH-OCLAW-013 | 8.5 HIGH | Privilege Escalation via Silent Local Auth Reconnect | ✓ Mitigated |
| ASH-OCLAW-053 | 8.4 HIGH | CVE-2026-25593 | ✓ Mitigated |
| ASH-OCLAW-054 | 8.4 HIGH | Versions prior to 2026.2.14 contain an arbitrary file read vulnerability in the exec-ap... | ✓ Mitigated |
| ASH-OCLAW-055 | 8.4 HIGH | Versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /a... | ✓ Mitigated |
| ASH-OCLAW-056 | 8.4 HIGH | Before 2026.3.11 contains a session sandbox escape vulnerability in the session_status ... | ✓ Mitigated |
| ASH-OCLAW-057 | 8.4 HIGH | Before 2026.2.17 creates session transcript JSONL files with overly broad default permi... | ✓ Mitigated |
| ASH-OCLAW-058 | 8.4 HIGH | Before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ w... | ✓ Mitigated |
| ASH-OCLAW-059 | 8.3 HIGH | Versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the ... | ✓ Mitigated |
| ASH-OCLAW-060 | 8.3 HIGH | Versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the ... | ✓ Mitigated |
| ASH-OCLAW-061 | 8.3 HIGH | Before 2026.3.28 contains a server-side request forgery vulnerability in the fal provid... | ✓ Mitigated |
| ASH-OCLAW-840 | 8.3 HIGH | Skill tool dispatch could skip owner-only policy | ✓ Mitigated |
| ASH-OCLAW-848 | 8.3 HIGH | Browser node targets could bypass sandbox host control | ✓ Mitigated |
| ASH-OCLAW-864 | 8.3 HIGH | Agent cron tool could reach operator command jobs | ✓ Mitigated |
| ASH-OCLAW-866 | 8.3 HIGH | Browser proxy could miss its admin scope | ✓ Mitigated |
| ASH-OCLAW-867 | 8.3 HIGH | iOS Control UI did not enforce saved Gateway TLS pins | ✓ Mitigated |
| ASH-OCLAW-001 | 8.2 HIGH | Path Traversal in Feishu Media Download | ✓ Mitigated |
| ASH-OCLAW-870 | 8.2 HIGH | Browser CDP connections could discard DNS pinning | ✓ Mitigated |
| ASH-OCLAW-010 | 8.1 HIGH | Insufficient Access Control in Gateway /reset Endpoint | ✓ Mitigated |
| ASH-OCLAW-062 | 8.1 HIGH | Versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in p... | ✓ Mitigated |
| ASH-OCLAW-063 | 8.1 HIGH | Version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (exte... | ✓ Mitigated |
| ASH-OCLAW-064 | 8.1 HIGH | Versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect han... | ✓ Mitigated |
| ASH-OCLAW-065 | 8.1 HIGH | Versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients ... | ✓ Mitigated |
| ASH-OCLAW-066 | 8.1 HIGH | CVE-2026-32302 | ✓ Mitigated |
| ASH-OCLAW-067 | 8.1 HIGH | Versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Contr... | ✓ Mitigated |
| ASH-OCLAW-068 | 8.1 HIGH | Before 2026.3.28 contains an insufficient scope validation vulnerability in the node pa... | ✓ Mitigated |
| ASH-OCLAW-069 | 8.1 HIGH | Before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed... | ✓ Mitigated |
| ASH-OCLAW-070 | 8.1 HIGH | Before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin su... | ✓ Mitigated |
| ASH-OCLAW-071 | 8.1 HIGH | Before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-p... | ✓ Mitigated |
| ASH-OCLAW-846 | 8.1 HIGH | WhatsApp login tool could reach non-owner turns | ✓ Mitigated |
| ASH-OCLAW-016 | 8.0 HIGH | Privilege Escalation via Plugin HTTP Auth Scope Minting | ✓ Mitigated |
| ASH-OCLAW-072 | 8.0 HIGH | Versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect p... | ✓ Mitigated |
| ASH-OCLAW-073 | 8.0 HIGH | Before 2026.3.11 contains an approval integrity vulnerability where system.run approval... | ✓ Mitigated |
| ASH-OCLAW-845 | 8.0 HIGH | Escaped newlines could confuse exec allowlist parsing | ✓ Mitigated |
| ASH-OCLAW-860 | 8.0 HIGH | Exec wrapper allowlists could trust arbitrary inner commands | ✓ Mitigated |
| ASH-OCLAW-871 | 8.0 HIGH | Claude permission replies could omit owner authorization | ✓ Mitigated |
| ASH-OCLAW-074 | 7.8 HIGH | CVE-2026-27001 | ✓ Mitigated |
| ASH-OCLAW-075 | 7.8 HIGH | Versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.e... | ✓ Mitigated |
| ASH-OCLAW-076 | 7.8 HIGH | Versions prior to 2026.2.22 on macOS contain a path validation bypass vulnerability in ... | ✓ Mitigated |
| ASH-OCLAW-077 | 7.8 HIGH | Before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and... | ✓ Mitigated |
| ASH-OCLAW-832 | 7.8 HIGH | Workspace Cloud SDK arguments could execute code during Gmail setup | ✓ Mitigated |
| ASH-OCLAW-851 | 7.8 HIGH | OpenShell filesystem mutations could race path validation | ✓ Mitigated |
| ASH-OCLAW-012 | 7.7 HIGH | Path Traversal in Sandbox Enforcement (unnormalized mediaUrl) | ✓ Mitigated |
| ASH-OCLAW-078 | 7.7 HIGH | CVE-2026-25157 | ✓ Mitigated |
| ASH-OCLAW-079 | 7.7 HIGH | Versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook ... | ✓ Mitigated |
| ASH-OCLAW-080 | 7.7 HIGH | Versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox bro... | ✓ Mitigated |
| ASH-OCLAW-081 | 7.7 HIGH | Versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authenti... | ✓ Mitigated |
| ASH-OCLAW-082 | 7.6 HIGH | CVE-2026-26322 | ✓ Mitigated |
| ASH-OCLAW-083 | 7.6 HIGH | CVE-2026-27487 | ✓ Mitigated |
| ASH-OCLAW-084 | 7.6 HIGH | Versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fet... | ✓ Mitigated |
| ASH-OCLAW-085 | 7.6 HIGH | Versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundar... | ✓ Mitigated |
| ASH-OCLAW-086 | 7.6 HIGH | Versions prior to commit b57b680 contain an approval bypass vulnerability due to incons... | ✓ Mitigated |
| ASH-OCLAW-826 | 7.6 HIGH | message.action could trust spoofed requester provenance | ✓ Mitigated |
| ASH-OCLAW-876 | 7.6 HIGH | chat.send could expose owner-only infrastructure tools | ✓ Mitigated |
| ASH-OCLAW-005 | 7.5 HIGH | WebSocket Brute-Force / ClawJacked (No Rate Limiting on Localhost) | ✓ Mitigated |
| ASH-OCLAW-007 | 7.5 HIGH | Sandbox Escape via sessions_spawn | ✓ Mitigated |
| ASH-OCLAW-008 | 7.5 HIGH | Oversized Media Payload DoS | ✓ Mitigated |
| ASH-OCLAW-014 | 7.5 HIGH | Server-Side Request Forgery (SSRF) in Channel Extension fetch() | ✓ Mitigated |
| ASH-OCLAW-087 | 7.5 HIGH | CVE-2026-25474 | ✓ Mitigated |
| ASH-OCLAW-088 | 7.5 HIGH | CVE-2026-26316 | ✓ Mitigated |
| ASH-OCLAW-089 | 7.5 HIGH | CVE-2026-26319 | ✓ Mitigated |
| ASH-OCLAW-090 | 7.5 HIGH | CVE-2026-26321 | ✓ Mitigated |
| ASH-OCLAW-091 | 7.5 HIGH | CVE-2026-26324 | ✓ Mitigated |
| ASH-OCLAW-092 | 7.5 HIGH | Versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack s... | ✓ Mitigated |
| ASH-OCLAW-093 | 7.5 HIGH | Versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction,... | ✓ Mitigated |
| ASH-OCLAW-094 | 7.5 HIGH | Versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (m... | ✓ Mitigated |
| ASH-OCLAW-095 | 7.5 HIGH | Versions prior to 2026.2.13 contain a vulnerability in the browser control API in which... | ✓ Mitigated |
| ASH-OCLAW-096 | 7.5 HIGH | Versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat ... | ✓ Mitigated |
| ASH-OCLAW-097 | 7.5 HIGH | Versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handle... | ✓ Mitigated |
| ASH-OCLAW-098 | 7.5 HIGH | Versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker ... | ✓ Mitigated |
| ASH-OCLAW-099 | 7.5 HIGH | Versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithG... | ✓ Mitigated |
| ASH-OCLAW-100 | 7.5 HIGH | Versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles... | ✓ Mitigated |
| ASH-OCLAW-101 | 7.5 HIGH | Versions2026.2.21-2 prior to 2026.2.22 and @openclaw/voice-call versions 2026.2.21 prio... | ✓ Mitigated |
| ASH-OCLAW-102 | 7.5 HIGH | Versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo... | ✓ Mitigated |
| ASH-OCLAW-103 | 7.5 HIGH | Versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handler... | ✓ Mitigated |
| ASH-OCLAW-104 | 7.5 HIGH | Versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxM... | ✓ Mitigated |
| ASH-OCLAW-105 | 7.5 HIGH | Versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME a... | ✓ Mitigated |
| ASH-OCLAW-106 | 7.5 HIGH | Through 2026.3.23 (fixed in commit 4797bbc) contains a path traversal vulnerability in ... | ✓ Mitigated |
| ASH-OCLAW-107 | 7.5 HIGH | Before 2026.3.13 reads and buffers Telegram webhook request bodies before validating th... | ✓ Mitigated |
| ASH-OCLAW-108 | 7.5 HIGH | Before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup... | ✓ Mitigated |
| ASH-OCLAW-109 | 7.5 HIGH | Before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMed... | ✓ Mitigated |
| ASH-OCLAW-110 | 7.5 HIGH | Before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged w... | ✓ Mitigated |
| ASH-OCLAW-825 | 7.5 HIGH | Gateway upgrade-like requests could retain unauthenticated sockets | ✓ Mitigated |
| ASH-OCLAW-835 | 7.5 HIGH | Dreaming could widen restricted sender authority | ✓ Mitigated |
| ASH-OCLAW-839 | 7.5 HIGH | Reusable exec approvals could authorize changed arguments | ✓ Mitigated |
| ASH-OCLAW-863 | 7.5 HIGH | Matrix authorization could conflate case-distinct user IDs | ✓ Mitigated |
| ASH-OCLAW-875 | 7.5 HIGH | Config revision hashes could expose password verifiers | ✓ Mitigated |
| ASH-OCLAW-111 | 7.4 HIGH | Versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_s... | ✓ Mitigated |
| ASH-OCLAW-112 | 7.4 HIGH | Versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the... | ✓ Mitigated |
| ASH-OCLAW-113 | 7.4 HIGH | Canvas Authentication Bypass Vulnerability | ✓ Mitigated |
| ASH-OCLAW-015 | 7.3 HIGH | Improper Access Control in Session Kill Endpoint | ✓ Mitigated |
| ASH-OCLAW-114 | 7.3 HIGH | CVE-2026-27488 | ✓ Mitigated |
| ASH-OCLAW-115 | 7.3 HIGH | Versions 2026.1.29 prior to 2026.2.1 contain a vulnerability in the Twitch plugin (must... | ✓ Mitigated |
| ASH-OCLAW-116 | 7.3 HIGH | Before 2026.3.11 contains an approval integrity vulnerability allowing attackers to exe... | ✓ Mitigated |
| ASH-OCLAW-117 | 7.3 HIGH | Before 2026.3.22 performs cite expansion before completing channel and DM authorization... | ✓ Mitigated |
| ASH-OCLAW-822 | 7.3 HIGH | Exec approvals could outlive their reviewed working directory | ✓ Mitigated |
| ASH-OCLAW-118 | 7.2 HIGH | CVE-2026-26325 | ✓ Mitigated |
| ASH-OCLAW-119 | 7.2 HIGH | Versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it... | ✓ Mitigated |
| ASH-OCLAW-120 | 7.2 HIGH | Versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass v... | ✓ Mitigated |
| ASH-OCLAW-121 | 7.1 HIGH | CVE-2026-26317 | ✓ Mitigated |
| ASH-OCLAW-122 | 7.1 HIGH | Versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing a... | ✓ Mitigated |
| ASH-OCLAW-123 | 7.1 HIGH | Versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in t... | ✓ Mitigated |
| ASH-OCLAW-124 | 7.1 HIGH | Versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId... | ✓ Mitigated |
| ASH-OCLAW-125 | 7.1 HIGH | Version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in sy... | ✓ Mitigated |
| ASH-OCLAW-126 | 7.1 HIGH | Versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exe... | ✓ Mitigated |
| ASH-OCLAW-127 | 7.1 HIGH | Versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run gua... | ✓ Mitigated |
| ASH-OCLAW-128 | 7.1 HIGH | Versions prior to 2026.2.19 contain a local command injection vulnerability in Windows ... | ✓ Mitigated |
| ASH-OCLAW-129 | 7.1 HIGH | Versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster ex... | ✓ Mitigated |
| ASH-OCLAW-130 | 7.1 HIGH | Versions prior to 2026.2.19 contain an allowlist bypass vulnerability in the exec safeB... | ✓ Mitigated |
| ASH-OCLAW-131 | 7.1 HIGH | Versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.r... | ✓ Mitigated |
| ASH-OCLAW-132 | 7.1 HIGH | Versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trust... | ✓ Mitigated |
| ASH-OCLAW-133 | 7.1 HIGH | Before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated ... | ✓ Mitigated |
| ASH-OCLAW-134 | 7.1 HIGH | Before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run a... | ✓ Mitigated |
| ASH-OCLAW-135 | 7.1 HIGH | Through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agent... | ✓ Mitigated |
| ASH-OCLAW-849 | 7.1 HIGH | Synology file delivery could lose DNS pinning | ✓ Mitigated |
| ASH-OCLAW-877 | 7.1 HIGH | Signal reactions could bind to the wrong approval | ✓ Mitigated |
| ASH-OCLAW-004 | 7.0 HIGH | Arbitrary Shell Execution via SHELL Environment Variable | ✓ Mitigated |
| ASH-OCLAW-136 | 6.9 MEDIUM | Versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors duri... | ✓ Mitigated |
| ASH-OCLAW-137 | 6.8 MEDIUM | Versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticat... | ✓ Mitigated |
| ASH-OCLAW-138 | 6.8 MEDIUM | Versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive... | ✓ Mitigated |
| ASH-OCLAW-139 | 6.8 MEDIUM | Versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental ... | ✓ Mitigated |
| ASH-OCLAW-861 | 6.8 MEDIUM | Feishu tools could use disabled default accounts | ✓ Mitigated |
| ASH-OCLAW-140 | 6.7 MEDIUM | CVE-2026-26972 | ✓ Mitigated |
| ASH-OCLAW-141 | 6.7 MEDIUM | CVE-2026-27008 | ✓ Mitigated |
| ASH-OCLAW-142 | 6.7 MEDIUM | Versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins c... | ✓ Mitigated |
| ASH-OCLAW-143 | 6.7 MEDIUM | 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution... | ✓ Mitigated |
| ASH-OCLAW-878 | 6.7 MEDIUM | Windows allowlist execution could use workspace shadows | ✓ Mitigated |
| ASH-OCLAW-144 | 6.6 MEDIUM | Versions prior to 2026.2.22 contain an environment variable injection vulnerability in ... | ✓ Mitigated |
| ASH-OCLAW-145 | 6.5 MEDIUM | CVE-2026-25475 | ✓ Mitigated |
| ASH-OCLAW-146 | 6.5 MEDIUM | CVE-2026-26320 | ✓ Mitigated |
| ASH-OCLAW-147 | 6.5 MEDIUM | CVE-2026-26327 | ✓ Mitigated |
| ASH-OCLAW-148 | 6.5 MEDIUM | CVE-2026-26328 | ✓ Mitigated |
| ASH-OCLAW-149 | 6.5 MEDIUM | CVE-2026-26329 | ✓ Mitigated |
| ASH-OCLAW-150 | 6.5 MEDIUM | Versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch ... | ✓ Mitigated |
| ASH-OCLAW-151 | 6.5 MEDIUM | Version 2026.1.14-1 prior to 2026.2.12 contain an improper network binding vulnerabilit... | ✓ Mitigated |
| ASH-OCLAW-152 | 6.5 MEDIUM | Versions prior to 2026.2.2 contain a server-side request forgery vulnerability in attac... | ✓ Mitigated |
| ASH-OCLAW-153 | 6.5 MEDIUM | Versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegra... | ✓ Mitigated |
| ASH-OCLAW-154 | 6.5 MEDIUM | Versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patche... | ✓ Mitigated |
| ASH-OCLAW-155 | 6.5 MEDIUM | Versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voic... | ✓ Mitigated |
| ASH-OCLAW-156 | 6.5 MEDIUM | Versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in sys... | ✓ Mitigated |
| ASH-OCLAW-157 | 6.5 MEDIUM | Versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access cont... | ✓ Mitigated |
| ASH-OCLAW-158 | 6.5 MEDIUM | Versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu men... | ✓ Mitigated |
| ASH-OCLAW-159 | 6.5 MEDIUM | Versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAtta... | ✓ Mitigated |
| ASH-OCLAW-160 | 6.5 MEDIUM | Versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events... | ✓ Mitigated |
| ASH-OCLAW-161 | 6.5 MEDIUM | Versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/c... | ✓ Mitigated |
| ASH-OCLAW-162 | 6.5 MEDIUM | Versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in ... | ✓ Mitigated |
| ASH-OCLAW-163 | 6.5 MEDIUM | Versions prior to 2026.2.22 contain an authorization bypass vulnerability in the Feishu... | ✓ Mitigated |
| ASH-OCLAW-164 | 6.5 MEDIUM | Versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the gre... | ✓ Mitigated |
| ASH-OCLAW-165 | 6.5 MEDIUM | Versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbo... | ✓ Mitigated |
| ASH-OCLAW-166 | 6.5 MEDIUM | Versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pair... | ✓ Mitigated |
| ASH-OCLAW-167 | 6.5 MEDIUM | Versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed abs... | ✓ Mitigated |
| ASH-OCLAW-168 | 6.5 MEDIUM | Gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that ... | ✓ Mitigated |
| ASH-OCLAW-169 | 6.5 MEDIUM | Versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approv... | ✓ Mitigated |
| ASH-OCLAW-170 | 6.5 MEDIUM | Versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplicati... | ✓ Mitigated |
| ASH-OCLAW-171 | 6.5 MEDIUM | Versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace ... | ✓ Mitigated |
| ASH-OCLAW-172 | 6.5 MEDIUM | Before 2026.3.11 contains an authorization bypass vulnerability allowing channel comman... | ✓ Mitigated |
| ASH-OCLAW-173 | 6.5 MEDIUM | Before 2026.3.12 applies rate limiting only after successful webhook authentication, al... | ✓ Mitigated |
| ASH-OCLAW-174 | 6.5 MEDIUM | Before 2026.3.28 downloads and stores inbound media from Zalo channels before validatin... | ✓ Mitigated |
| ASH-OCLAW-175 | 6.5 MEDIUM | Before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk w... | ✓ Mitigated |
| ASH-OCLAW-176 | 6.5 MEDIUM | Before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allow... | ✓ Mitigated |
| ASH-OCLAW-177 | 6.5 MEDIUM | Before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in ... | ✓ Mitigated |
| ASH-OCLAW-178 | 6.5 MEDIUM | Before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verific... | ✓ Mitigated |
| ASH-OCLAW-179 | 6.5 MEDIUM | Before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct... | ✓ Mitigated |
| ASH-OCLAW-180 | 6.5 MEDIUM | Before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat co... | ✓ Mitigated |
| ASH-OCLAW-181 | 6.5 MEDIUM | Versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability w... | ✓ Mitigated |
| ASH-OCLAW-182 | 6.5 MEDIUM | Before 2026.3.22 contains an information disclosure vulnerability that allows attackers... | ✓ Mitigated |
| ASH-OCLAW-183 | 6.5 MEDIUM | Before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist com... | ✓ Mitigated |
| ASH-OCLAW-184 | 6.5 MEDIUM | Before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers... | ✓ Mitigated |
| ASH-OCLAW-185 | 6.5 MEDIUM | Before 2026.3.22 contains an authorization bypass vulnerability in interactive callback... | ✓ Mitigated |
| ASH-OCLAW-186 | 6.5 MEDIUM | Before 2026.3.22 contains an authentication bypass vulnerability in the X-Forwarded-For... | ✓ Mitigated |
| ASH-OCLAW-187 | 6.5 MEDIUM | Before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:... | ✓ Mitigated |
| ASH-OCLAW-188 | 6.5 MEDIUM | Before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool t... | ✓ Mitigated |
| ASH-OCLAW-189 | 6.5 MEDIUM | Canvas Path Traversal Information Disclosure Vulnerability | ✓ Mitigated |
| ASH-OCLAW-824 | 6.5 MEDIUM | Diagnostics export could omit owner authorization | ✓ Mitigated |
| ASH-OCLAW-843 | 6.5 MEDIUM | Trajectory export could omit owner authorization | ✓ Mitigated |
| ASH-OCLAW-852 | 6.5 MEDIUM | LINE group allowlist could inherit DM access | ✓ Mitigated |
| ASH-OCLAW-853 | 6.5 MEDIUM | Structured attachments could hide unvalidated host paths | ✓ Mitigated |
| ASH-OCLAW-858 | 6.5 MEDIUM | Channel read actions could skip target allowlists | ✓ Mitigated |
| ASH-OCLAW-882 | 6.5 MEDIUM | Slack file downloads could miss conversation authorization | ✓ Mitigated |
| ASH-OCLAW-884 | 6.5 MEDIUM | Outbound attachments could ignore requester read denials | ✓ Mitigated |
| ASH-OCLAW-003 | 6.4 MEDIUM | Allow-Always Wrapper Persistence Bypass | ✓ Mitigated |
| ASH-OCLAW-190 | 6.4 MEDIUM | Versions prior to 2026.2.24 contain a command injection vulnerability in the system.run... | ✓ Mitigated |
| ASH-OCLAW-834 | 6.4 MEDIUM | Discord realtime transcripts could inherit another speaker's owner status | ✓ Mitigated |
| ASH-OCLAW-841 | 6.4 MEDIUM | File-transfer approvals could widen durable authority | ✓ Mitigated |
| ASH-OCLAW-011 | 6.3 MEDIUM | Environment Variable Override Bypass | ✓ Mitigated |
| ASH-OCLAW-191 | 6.3 MEDIUM | A vulnerability was determined in OpenClaw 2026.2.19-2 | ✓ Mitigated |
| ASH-OCLAW-192 | 6.3 MEDIUM | Versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory inj... | ✓ Mitigated |
| ASH-OCLAW-193 | 6.3 MEDIUM | Versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safe-bin c... | ✓ Mitigated |
| ASH-OCLAW-194 | 6.3 MEDIUM | Before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable s... | ✓ Mitigated |
| ASH-OCLAW-195 | 6.3 MEDIUM | Before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writ... | ✓ Mitigated |
| ASH-OCLAW-818 | 6.3 MEDIUM | Memory dreaming changes could omit owner checks | ✓ Mitigated |
| ASH-OCLAW-830 | 6.3 MEDIUM | iOS deep-link logs could expose unattended credentials | ✓ Mitigated |
| ASH-OCLAW-854 | 6.3 MEDIUM | Video asset downloads could reach private destinations | ✓ Mitigated |
| ASH-OCLAW-869 | 6.3 MEDIUM | WhatsApp session resets could bypass command authorization | ✓ Mitigated |
| ASH-OCLAW-890 | 6.3 MEDIUM | Active Memory global toggles could omit owner checks | ✓ Mitigated |
| ASH-OCLAW-196 | 6.2 MEDIUM | Before 2026.3.8 contains a path traversal vulnerability in the skills download installe... | ✓ Mitigated |
| ASH-OCLAW-197 | 6.1 MEDIUM | Versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mir... | ✓ Mitigated |
| ASH-OCLAW-198 | 6.1 MEDIUM | Versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archi... | ✓ Mitigated |
| ASH-OCLAW-199 | 6.1 MEDIUM | Version 2026.2.22 prior to 2026.2.23 contain an arbitrary code execution vulnerability ... | ✓ Mitigated |
| ASH-OCLAW-200 | 6.1 MEDIUM | Versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing at... | ✓ Mitigated |
| ASH-OCLAW-201 | 6.1 MEDIUM | Versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run exec... | ✓ Mitigated |
| ASH-OCLAW-202 | 6.1 MEDIUM | Versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in... | ✓ Mitigated |
| ASH-OCLAW-203 | 6.1 MEDIUM | Versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn com... | ✓ Mitigated |
| ASH-OCLAW-204 | 6.1 MEDIUM | Before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped c... | ✓ Mitigated |
| ASH-OCLAW-205 | 6.1 MEDIUM | Before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat com... | ✓ Mitigated |
| ASH-OCLAW-206 | 6.0 MEDIUM | Versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] to... | ✓ Mitigated |
| ASH-OCLAW-207 | 6.0 MEDIUM | Versions prior to 2026.2.22 fail to consistently validate redirect chains against confi... | ✓ Mitigated |
| ASH-OCLAW-002 | 5.9 MEDIUM | Allowlist Bypass via Shell Line-Continuation | ✓ Mitigated |
| ASH-OCLAW-208 | 5.9 MEDIUM | Versions prior to 2026.2.12 use non-constant-time string comparison for hook token vali... | ✓ Mitigated |
| ASH-OCLAW-209 | 5.9 MEDIUM | OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authenticatio... | ✓ Mitigated |
| ASH-OCLAW-210 | 5.9 MEDIUM | Versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin... | ✓ Mitigated |
| ASH-OCLAW-211 | 5.9 MEDIUM | Versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord ... | ✓ Mitigated |
| ASH-OCLAW-212 | 5.9 MEDIUM | Versions prior to 2026.2.22 contain an authorization bypass vulnerability in the toolsB... | ✓ Mitigated |
| ASH-OCLAW-213 | 5.9 MEDIUM | Versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication... | ✓ Mitigated |
| ASH-OCLAW-214 | 5.9 MEDIUM | Before 2026.3.22 contains an improper authentication verification vulnerability in Goog... | ✓ Mitigated |
| ASH-OCLAW-215 | 5.9 MEDIUM | Before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers ... | ✓ Mitigated |
| ASH-OCLAW-838 | 5.9 MEDIUM | Trusted-host DNS checks could admit unspecified addresses | ✓ Mitigated |
| ASH-OCLAW-216 | 5.8 MEDIUM | CVE-2026-27009 | ✓ Mitigated |
| ASH-OCLAW-217 | 5.7 MEDIUM | Versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allow... | ✓ Mitigated |
| ASH-OCLAW-218 | 5.7 MEDIUM | Before 2026.3.22 contains an identity spoofing vulnerability in ACP permission resoluti... | ✓ Mitigated |
| ASH-OCLAW-219 | 5.6 MEDIUM | 1.26 | ✓ Mitigated |
| ASH-OCLAW-220 | 5.5 MEDIUM | CVE-2026-27003 | ✓ Mitigated |
| ASH-OCLAW-221 | 5.5 MEDIUM | CVE-2026-27004 | ✓ Mitigated |
| ASH-OCLAW-222 | 5.5 MEDIUM | Versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArc... | ✓ Mitigated |
| ASH-OCLAW-223 | 5.5 MEDIUM | Versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enfor... | ✓ Mitigated |
| ASH-OCLAW-224 | 5.5 MEDIUM | Versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handlin... | ✓ Mitigated |
| ASH-OCLAW-225 | 5.5 MEDIUM | Versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 i... | ✓ Mitigated |
| ASH-OCLAW-819 | 5.5 MEDIUM | ACP file URLs could skip out-of-cwd read approval | ✓ Mitigated |
| ASH-OCLAW-859 | 5.5 MEDIUM | iOS Share Extension stored Gateway credentials outside Keychain | ✓ Mitigated |
| ASH-OCLAW-872 | 5.5 MEDIUM | Workspace endpoint override could expose Azure Speech credentials | ✓ Mitigated |
| ASH-OCLAW-226 | 5.4 MEDIUM | Versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows ... | ✓ Mitigated |
| ASH-OCLAW-227 | 5.4 MEDIUM | Versions prior to 2026.2.26 fail to enforce sender authorization in member and message ... | ✓ Mitigated |
| ASH-OCLAW-228 | 5.4 MEDIUM | Versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP cl... | ✓ Mitigated |
| ASH-OCLAW-229 | 5.4 MEDIUM | Before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reacti... | ✓ Mitigated |
| ASH-OCLAW-230 | 5.4 MEDIUM | Versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in... | ✓ Mitigated |
| ASH-OCLAW-231 | 5.4 MEDIUM | Before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allow... | ✓ Mitigated |
| ASH-OCLAW-821 | 5.4 MEDIUM | Google Meet attendance CSV could interpret names as formulas | ✓ Mitigated |
| ASH-OCLAW-823 | 5.4 MEDIUM | Browser wait predicates could reach blocked destinations | ✓ Mitigated |
| ASH-OCLAW-842 | 5.4 MEDIUM | Microsoft Teams access-group failures could admit unlisted senders | ✓ Mitigated |
| ASH-OCLAW-865 | 5.4 MEDIUM | sessions.create could miss admin scope for keyed reconfiguration | ✓ Mitigated |
| ASH-OCLAW-874 | 5.4 MEDIUM | Group activation changes could omit owner authorization | ✓ Mitigated |
| ASH-OCLAW-879 | 5.4 MEDIUM | QQBot voice filenames could escape the staging directory | ✓ Mitigated |
| ASH-OCLAW-883 | 5.4 MEDIUM | OpenAI-compatible transport could send provider credentials to the wrong endpoint | ✓ Mitigated |
| ASH-OCLAW-891 | 5.4 MEDIUM | Usage CSV export could interpret session labels as formulas | ✓ Mitigated |
| ASH-OCLAW-232 | 5.3 MEDIUM | CVE-2026-27486 | ✓ Mitigated |
| ASH-OCLAW-233 | 5.3 MEDIUM | Version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, co... | ✓ Mitigated |
| ASH-OCLAW-234 | 5.3 MEDIUM | Versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser o... | ✓ Mitigated |
| ASH-OCLAW-235 | 5.3 MEDIUM | Versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction tha... | ✓ Mitigated |
| ASH-OCLAW-236 | 5.3 MEDIUM | Versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the ... | ✓ Mitigated |
| ASH-OCLAW-237 | 5.3 MEDIUM | Versions prior to 2026.2.23 contain a sandbox bypass vulnerability in the sandboxed ima... | ✓ Mitigated |
| ASH-OCLAW-238 | 5.3 MEDIUM | Versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks... | ✓ Mitigated |
| ASH-OCLAW-239 | 5.3 MEDIUM | Versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value... | ✓ Mitigated |
| ASH-OCLAW-240 | 5.3 MEDIUM | Versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability tha... | ✓ Mitigated |
| ASH-OCLAW-241 | 5.3 MEDIUM | Versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in syst... | ✓ Mitigated |
| ASH-OCLAW-242 | 5.3 MEDIUM | Before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that ... | ✓ Mitigated |
| ASH-OCLAW-243 | 5.3 MEDIUM | Before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAu... | ✓ Mitigated |
| ASH-OCLAW-244 | 5.3 MEDIUM | Before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice... | ✓ Mitigated |
| ASH-OCLAW-245 | 5.3 MEDIUM | Before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media ... | ✓ Mitigated |
| ASH-OCLAW-246 | 5.3 MEDIUM | Before 2026.3.25 parses JSON request bodies before validating webhook signatures, allow... | ✓ Mitigated |
| ASH-OCLAW-247 | 5.3 MEDIUM | Before 2026.3.25 contains an access control vulnerability where verification notices by... | ✓ Mitigated |
| ASH-OCLAW-248 | 5.3 MEDIUM | Before 2026.3.25 contains an authorization bypass vulnerability in Microsoft Teams feed... | ✓ Mitigated |
| ASH-OCLAW-249 | 5.3 MEDIUM | Before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback qu... | ✓ Mitigated |
| ASH-OCLAW-250 | 5.3 MEDIUM | Before 2026.3.25 contains an authentication bypass vulnerability in raw card send surfa... | ✓ Mitigated |
| ASH-OCLAW-251 | 5.3 MEDIUM | Before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook... | ✓ Mitigated |
| ASH-OCLAW-252 | 5.3 MEDIUM | Client PKCE Verifier Information Disclosure Vulnerability | ✓ Mitigated |
| ASH-OCLAW-828 | 5.3 MEDIUM | Session filename generation could regain denied tools | ✓ Mitigated |
| ASH-OCLAW-833 | 5.3 MEDIUM | Unicode fallback could escape workspaceOnly roots | ✓ Mitigated |
| ASH-OCLAW-836 | 5.3 MEDIUM | Embedding fallback could forward a provider key across vendors | ✓ Mitigated |
| ASH-OCLAW-855 | 5.3 MEDIUM | Synology pre-auth limits could lock out valid webhooks | ✓ Mitigated |
| ASH-OCLAW-868 | 5.3 MEDIUM | Browser relay authentication could exhaust shared pending capacity | ✓ Mitigated |
| ASH-OCLAW-888 | 5.3 MEDIUM | Discord asset uploads could skip sender media policy | ✓ Mitigated |
| ASH-OCLAW-889 | 5.3 MEDIUM | Twilio pre-auth limits could lock out valid webhooks | ✓ Mitigated |
| ASH-OCLAW-253 | 5.1 MEDIUM | Before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway ... | ✓ Mitigated |
| ASH-OCLAW-254 | 4.8 MEDIUM | Versions prior to 2026.2.13 use non-constant-time string comparison for hook token vali... | ✓ Mitigated |
| ASH-OCLAW-255 | 4.8 MEDIUM | Versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the ... | ✓ Mitigated |
| ASH-OCLAW-256 | 4.8 MEDIUM | Versions prior to 2026.2.26 server-http contains an authentication bypass vulnerability... | ✓ Mitigated |
| ASH-OCLAW-257 | 4.8 MEDIUM | Versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in syste... | ✓ Mitigated |
| ASH-OCLAW-258 | 4.8 MEDIUM | Versions prior to 2026.2.21 BlueBubbles webhook handler contains a passwordless fallbac... | ✓ Mitigated |
| ASH-OCLAW-259 | 4.8 MEDIUM | Before 2026.3.25 contains a missing rate limiting vulnerability in webhook authenticati... | ✓ Mitigated |
| ASH-OCLAW-260 | 4.8 MEDIUM | Before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook aut... | ✓ Mitigated |
| ASH-OCLAW-261 | 4.8 MEDIUM | Before 2026.3.22 contains a webhook path route replacement vulnerability in the Synolog... | ✓ Mitigated |
| ASH-OCLAW-262 | 4.8 MEDIUM | Before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webho... | ✓ Mitigated |
| ASH-OCLAW-263 | 4.6 MEDIUM | Versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session... | ✓ Mitigated |
| ASH-OCLAW-264 | 4.6 MEDIUM | Before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bon... | ✓ Mitigated |
| ASH-OCLAW-265 | 4.4 MEDIUM | CVE-2026-27485 | ✓ Mitigated |
| ASH-OCLAW-266 | 4.4 MEDIUM | Versions prior to 2026.2.17 contain a path traversal vulnerability in the $include dire... | ✓ Mitigated |
| ASH-OCLAW-267 | 4.4 MEDIUM | Versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vul... | ✓ Mitigated |
| ASH-OCLAW-268 | 4.3 MEDIUM | CVE-2026-26326 | ✓ Mitigated |
| ASH-OCLAW-269 | 4.3 MEDIUM | CVE-2026-27484 | ✓ Mitigated |
| ASH-OCLAW-270 | 4.3 MEDIUM | Versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set overri... | ✓ Mitigated |
| ASH-OCLAW-271 | 4.3 MEDIUM | Versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction... | ✓ Mitigated |
| ASH-OCLAW-272 | 4.3 MEDIUM | Before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams... | ✓ Mitigated |
| ASH-OCLAW-273 | 4.3 MEDIUM | Before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Z... | ✓ Mitigated |
| ASH-OCLAW-274 | 4.3 MEDIUM | Before 2026.3.25 contains an authorization bypass vulnerability where group reaction ev... | ✓ Mitigated |
| ASH-OCLAW-275 | 4.3 MEDIUM | Before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models ... | ✓ Mitigated |
| ASH-OCLAW-276 | 4.3 MEDIUM | Versions 2026.2.13 through 2026.3.24 contain an ANSI escape sequence injection vulnerab... | ✓ Mitigated |
| ASH-OCLAW-277 | 4.3 MEDIUM | Before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowin... | ✓ Mitigated |
| ASH-OCLAW-820 | 4.3 MEDIUM | Discord guild reads could skip target allowlists | ✓ Mitigated |
| ASH-OCLAW-829 | 4.3 MEDIUM | Talk Voice changes could omit admin authorization | ✓ Mitigated |
| ASH-OCLAW-862 | 4.3 MEDIUM | Feishu unpin could miss cross-context policy | ✓ Mitigated |
| ASH-OCLAW-881 | 4.3 MEDIUM | Prometheus diagnostics could omit operator.read enforcement | ✓ Mitigated |
| ASH-OCLAW-278 | 4.2 MEDIUM | Before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group po... | ✓ Mitigated |
| ASH-OCLAW-279 | 4.2 MEDIUM | Before 2026.3.22 contains a policy confusion vulnerability in room authorization that m... | ✓ Mitigated |
| ASH-OCLAW-857 | 4.2 MEDIUM | Revoked Canvas capability could remain active during disconnect | ✓ Mitigated |
| ASH-OCLAW-280 | 4.0 MEDIUM | CVE-2026-27576 | ✓ Mitigated |
| ASH-OCLAW-281 | 3.7 LOW | (formerly Clawdbot) is a personal AI assistant users run on their own devices | ✓ Mitigated |
| ASH-OCLAW-282 | 3.7 LOW | Versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal ... | ✓ Mitigated |
| ASH-OCLAW-283 | 3.7 LOW | Versions prior to 2026.2.25 contain an access control vulnerability in signal reaction ... | ✓ Mitigated |
| ASH-OCLAW-284 | 3.7 LOW | Versions prior to 2026.2.26 contains an authorization bypass vulnerability in the pairi... | ✓ Mitigated |
| ASH-OCLAW-285 | 3.7 LOW | Versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owne... | ✓ Mitigated |
| ASH-OCLAW-286 | 3.7 LOW | Before 2026.3.22 contains a policy bypass vulnerability where queued node actions are n... | ✓ Mitigated |
| ASH-OCLAW-287 | 3.6 LOW | Versions prior to 2026.2.19 contain a race condition vulnerability in concurrent update... | ✓ Mitigated |
| ASH-OCLAW-288 | 3.3 LOW | CVE-2026-27007 | ✓ Mitigated |
| ASH-OCLAW-289 | 3.3 LOW | 2.17 | ✓ Mitigated |
| ASH-OCLAW-290 | 3.3 LOW | Versions prior to 2026.2.22 contain a path traversal vulnerability in the static file h... | ✓ Mitigated |
| ASH-OCLAW-831 | 3.3 LOW | MCP loopback could omit sandbox tool deny policy | ✓ Mitigated |
| ASH-OCLAW-291 | 3.1 LOW | Versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pair... | ✓ Mitigated |
| ASH-OCLAW-837 | 3.1 LOW | Truncated tar listings could bypass extraction limits | ✓ Mitigated |
| ASH-OCLAW-856 | 3.1 LOW | Webhook TaskFlow cancellation could target unrelated sessions | ✓ Mitigated |
| ASH-OCLAW-885 | 3.1 LOW | Active Memory recall could ignore requester policy | ✓ Mitigated |
| ASH-OCLAW-292 | 2.6 LOW | Versions prior to 2026.2.26 contain an approval context-binding weakness in system.run ... | ✓ Mitigated |
| ASH-OCLAW-850 | 2.6 LOW | Memory tools could retain revoked access | ✓ Mitigated |
| ASH-OCLAW-293 | 2.5 LOW | Before 2026.3.11 contains a credential fallback vulnerability where unavailable local g... | ✓ Mitigated |
| ASH-OCLAW-294 | — HIGH | 1-Click RCE via Authentication Token Exfiltration From gatewayUrl | ✓ Mitigated |
| ASH-OCLAW-295 | — HIGH | OC-02: Gateway /tools/invoke tool escalation + ACP permission auto-approval | ✓ Mitigated |
| ASH-OCLAW-296 | — CRITICAL | Remote Code Execution via Node Invoke Approval Bypass in Gateway | ✓ Mitigated |
| ASH-OCLAW-297 | — HIGH | Hook Session Key Override Enables Targeted Cross-Session Routing | ✓ Mitigated |
| ASH-OCLAW-298 | — HIGH | Arbitrary transcript path file write via gateway sessionFile | ✓ Mitigated |
| ASH-OCLAW-299 | — HIGH | SSRF in Image Tool Remote Fetch | ✓ Mitigated |
| ASH-OCLAW-300 | — MEDIUM | Webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust) | ✓ Mitigated |
| ASH-OCLAW-301 | — MEDIUM | SSRF via attachment/media URL hydration | ✓ Mitigated |
| ASH-OCLAW-302 | — HIGH | Unauthenticated Nostr profile HTTP endpoints allow remote profile/config tampering | ✓ Mitigated |
| ASH-OCLAW-303 | — LOW | OpenClaw log poisoning (indirect prompt injection) via WebSocket headers | ✓ Mitigated |
| ASH-OCLAW-304 | — MEDIUM | Optional voice-call plugin: webhook verification may be bypassed behind certain proxy conf | ✓ Mitigated |
| ASH-OCLAW-305 | — HIGH | Potential access-group authorization bypass if channel type lookup fails | ✓ Mitigated |
| ASH-OCLAW-306 | — HIGH | Nextcloud Talk allowlist bypass via actor.name display name spoofing | ✓ Mitigated |
| ASH-OCLAW-307 | — HIGH | Authorization bypass: `operator.write` can resolve exec approvals via `chat.send` -> `/app | ✓ Mitigated |
| ASH-OCLAW-308 | — CRITICAL | Path Traversal in Plugin Installation | ✓ Mitigated |
| ASH-OCLAW-309 | — HIGH | Gateway connect could skip device identity checks when auth.token was present but not yet | ✓ Mitigated |
| ASH-OCLAW-310 | — HIGH | Windows cmd.exe parsing may bypass exec allowlist/approval gating | ✓ Mitigated |
| ASH-OCLAW-311 | — HIGH | Browser Relay /cdp websocket missing auth could allow cross-tab cookie access | ✓ Mitigated |
| ASH-OCLAW-312 | — HIGH | Exec allowlist bypass via command substitution/backticks inside double quotes | ✓ Mitigated |
| ASH-OCLAW-313 | — MEDIUM | Slack: dmPolicy=open allowed any DM sender to run privileged slash commands | ✓ Mitigated |
| ASH-OCLAW-314 | — HIGH | Denial of service via unbounded webhook request body buffering | ✓ Mitigated |
| ASH-OCLAW-315 | — HIGH | Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misr | ✓ Mitigated |
| ASH-OCLAW-316 | — MEDIUM | SSRF in optional Tlon (Urbit) extension authentication | ✓ Mitigated |
| ASH-OCLAW-317 | — MEDIUM | Non-constant-time token comparison in hooks authentication | ✓ Mitigated |
| ASH-OCLAW-318 | — MEDIUM | Config writes could persist resolved ${VAR} secrets to disk | ✓ Mitigated |
| ASH-OCLAW-319 | — MEDIUM | Inter-session prompts could be treated as direct user instructions | ✓ Mitigated |
| ASH-OCLAW-320 | — HIGH | Path traversal (Zip Slip) in archive extraction during explicit installation commands | ✓ Mitigated |
| ASH-OCLAW-321 | — LOW | Google Chat spoofing access with allowlist authorized mutable email principal despite send | ✓ Mitigated |
| ASH-OCLAW-322 | — HIGH | missing authentication for local browser-control endpoints | ✓ Mitigated |
| ASH-OCLAW-323 | — HIGH | Potential code execution via unsafe hook module path handling in Gateway | ✓ Mitigated |
| ASH-OCLAW-324 | — HIGH | Zip Slip path traversal in tar archive extraction | ✓ Mitigated |
| ASH-OCLAW-325 | — HIGH | LFI in BlueBubbles media path handling | ✓ Mitigated |
| ASH-OCLAW-326 | — HIGH | Two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension | ✓ Mitigated |
| ASH-OCLAW-327 | — MEDIUM | Hook transform module path allows traversal and arbitrary JavaScript module loading | ✓ Mitigated |
| ASH-OCLAW-328 | — LOW | Option injection in pre-commit hook can stage ignored files | ✓ Mitigated |
| ASH-OCLAW-329 | — HIGH | Path traversal in apply_patch could write/delete files outside the workspace | ✓ Mitigated |
| ASH-OCLAW-330 | — MEDIUM | OpenClaw safeBins file-existence oracle information disclosure | ✓ Mitigated |
| ASH-OCLAW-331 | — MEDIUM | Windows Scheduled Task script generation allowed local command injection via unsafe cmd ar | ✓ Mitigated |
| ASH-OCLAW-332 | — MEDIUM | Command Injection via unescaped environment assignments in Windows Scheduled Task script g | ✓ Mitigated |
| ASH-OCLAW-333 | — LOW | Windows Lobster shell fallback command injection in constrained fallback path | ✓ Mitigated |
| ASH-OCLAW-334 | — MEDIUM | Auth inconsistency on local Browser Extension Relay /extension endpoint | ✓ Mitigated |
| ASH-OCLAW-335 | — MEDIUM | SSRF guard bypass via IPv6 transition over ISATAP | ✓ Mitigated |
| ASH-OCLAW-336 | — MEDIUM | iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation | ✓ Mitigated |
| ASH-OCLAW-337 | — MEDIUM | Path traversal in Feishu media temp-file naming allows writes outside os.tmpdir() | ✓ Mitigated |
| ASH-OCLAW-338 | — MEDIUM | Command injection via Windows shell fallback in Lobster tool execution | ✓ Mitigated |
| ASH-OCLAW-339 | — LOW | Plugin runtime command execution is part of trusted plugin boundary | ✓ Mitigated |
| ASH-OCLAW-340 | — LOW | Owner-only gateway tool access checks were incomplete in specific authenticated DM flows | ✓ Mitigated |
| ASH-OCLAW-341 | — MEDIUM | OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write | ✓ Mitigated |
| ASH-OCLAW-342 | — MEDIUM | `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks | ✓ Mitigated |
| ASH-OCLAW-343 | — HIGH | ZDI-CAN-29311: OpenClaw Canvas Authentication Bypass Vulnerability | ✓ Mitigated |
| ASH-OCLAW-344 | — MEDIUM | ZDI-CAN-29312: OpenClaw Canvas Path Traversal Information Disclosure Vulnerability | ✓ Mitigated |
| ASH-OCLAW-345 | — MEDIUM | Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection | ✓ Mitigated |
| ASH-OCLAW-346 | — MEDIUM | Skill env override host env injection | ✓ Mitigated |
| ASH-OCLAW-347 | — HIGH | OC-06: Arbitrary file read via $include directive | ✓ Mitigated |
| ASH-OCLAW-348 | — HIGH | Multiple E2E/test Dockerfiles run all processes as root | ✓ Mitigated |
| ASH-OCLAW-349 | — MEDIUM | Browser navigation guard allowed non-network URL schemes, enabling authenticated browser-t | ✓ Mitigated |
| ASH-OCLAW-350 | — MEDIUM | Windows system.run approval mismatch on cmd.exe /c trailing arguments | ✓ Mitigated |
| ASH-OCLAW-351 | — MEDIUM | BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback) | ✓ Mitigated |
| ASH-OCLAW-352 | — MEDIUM | BASH_ENV / ENV startup-file injection into spawned shell commands | ✓ Mitigated |
| ASH-OCLAW-353 | — MEDIUM | Config env vars allowed startup env injection into service runtime | ✓ Mitigated |
| ASH-OCLAW-354 | — MEDIUM | Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container | ✓ Mitigated |
| ASH-OCLAW-355 | — MEDIUM | Canvas route hardening for mixed-trust deployments | ✓ Mitigated |
| ASH-OCLAW-356 | — HIGH | Shell command injection in exec allowlist mode via unquoted heredoc expansion | ✓ Mitigated |
| ASH-OCLAW-357 | — MEDIUM | OC-91: WhatsApp reaction action bypasses JID authorization for allowFrom-restricted target | ✓ Mitigated |
| ASH-OCLAW-358 | — MEDIUM | TTS model directives allowed provider switching by default | ✓ Mitigated |
| ASH-OCLAW-359 | — MEDIUM | ACP resource_link metadata prompt interpolation allowed prompt-injection content via title | ✓ Mitigated |
| ASH-OCLAW-360 | — LOW | OC-65: overflow compaction retry counter reset after truncation amplifies bounded retry/co | ✓ Mitigated |
| ASH-OCLAW-361 | — MEDIUM | tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode | ✓ Mitigated |
| ASH-OCLAW-362 | — MEDIUM | Non-default safeBins sort configuration can bypass intended allowlist approval constraints | ✓ Mitigated |
| ASH-OCLAW-363 | — MEDIUM | Avatar symlink traversal can expose out-of-workspace local files | ✓ Mitigated |
| ASH-OCLAW-364 | — MEDIUM | allow-always wrapper persistence could bypass future approvals and enable command executio | ✓ Mitigated |
| ASH-OCLAW-365 | — MEDIUM | system.run allowlist bypass via shell line-continuation command substitution | ✓ Mitigated |
| ASH-OCLAW-366 | — MEDIUM | Elevated allowFrom matching tightened for sender-scoped authorization | ✓ Mitigated |
| ASH-OCLAW-367 | — MEDIUM | Feishu allowFrom authorization bypass via display-name collision | ✓ Mitigated |
| ASH-OCLAW-368 | — MEDIUM | Shell-env fallback trusted startup env and could execute attacker-influenced login-shell p | ✓ Mitigated |
| ASH-OCLAW-369 | — LOW | tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in | ✓ Mitigated |
| ASH-OCLAW-370 | — MEDIUM | system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE) | ✓ Mitigated |
| ASH-OCLAW-371 | — MEDIUM | Hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants | ✓ Mitigated |
| ASH-OCLAW-372 | — MEDIUM | Agent avatar symlink traversal in gateway session metadata | ✓ Mitigated |
| ASH-OCLAW-373 | — MEDIUM | Hook transform path containment missed symlink-resolved escapes | ✓ Mitigated |
| ASH-OCLAW-374 | — MEDIUM | macOS optional allowlist basename matching could bypass path-based policy | ✓ Mitigated |
| ASH-OCLAW-375 | — MEDIUM | Exec allowlist wrapper analysis did not unwrap env/shell dispatch chains | ✓ Mitigated |
| ASH-OCLAW-376 | — MEDIUM | macOS `system.run` allowlist bypass via quoted command substitution | ✓ Mitigated |
| ASH-OCLAW-377 | — MEDIUM | Inbound media downloads could exceed configured byte limits before rejection across multip | ✓ Mitigated |
| ASH-OCLAW-378 | — LOW | Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read | ✓ Mitigated |
| ASH-OCLAW-379 | — MEDIUM | Shell env fallback trusts unvalidated SHELL path from host environment | ✓ Mitigated |
| ASH-OCLAW-380 | — MEDIUM | Node role device-identity bypass allows unauthorized node.event injection | ✓ Mitigated |
| ASH-OCLAW-381 | — MEDIUM | BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty | ✓ Mitigated |
| ASH-OCLAW-382 | — MEDIUM | Discord `allowFrom` slug-collision authorization bypass | ✓ Mitigated |
| ASH-OCLAW-383 | — MEDIUM | Zip extraction symlink traversal could write outside destination | ✓ Mitigated |
| ASH-OCLAW-384 | — MEDIUM | non-default configuration: manually adding sort to tools.exec.safeBins could bypass allowl | ✓ Mitigated |
| ASH-OCLAW-385 | — LOW | macOS companion app (beta): allowlist parsing mismatch for system.run shell chains | ✓ Mitigated |
| ASH-OCLAW-386 | — MEDIUM | Loopback CDP probe can leak Gateway token to local listener | ✓ Mitigated |
| ASH-OCLAW-387 | — MEDIUM | DUPLICATE of GHSA-3c6h-g97w-fg78: safeBins denied flags can be bypassed via GNU long-optio | ✓ Mitigated |
| ASH-OCLAW-388 | — HIGH | exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation | ✓ Mitigated |
| ASH-OCLAW-389 | — MEDIUM | exec allow-always can be bypassed via unrecognized multiplexer shell wrappers (busybox/toy | ✓ Mitigated |
| ASH-OCLAW-390 | — MEDIUM | commands.allowFrom sender authorization accepted conversation identifiers via ctx.From | ✓ Mitigated |
| ASH-OCLAW-391 | — MEDIUM | image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-w | ✓ Mitigated |
| ASH-OCLAW-392 | — MEDIUM | allowlist exec-guard bypass via env -S | ✓ Mitigated |
| ASH-OCLAW-393 | — MEDIUM | Node exec approvals could be replayed across nodes | ✓ Mitigated |
| ASH-OCLAW-394 | — LOW | iOS deep link (openclaw://agent) can trigger gateway agent requests without local confirma | ✓ Mitigated |
| ASH-OCLAW-395 | — HIGH | tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowli | ✓ Mitigated |
| ASH-OCLAW-396 | — MEDIUM | non-default autoAllowSkills setting could bypass on-miss exec prompt | ✓ Mitigated |
| ASH-OCLAW-397 | — MEDIUM | shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL | ✓ Mitigated |
| ASH-OCLAW-398 | — MEDIUM | Stored XSS in exported session HTML viewer via markdown/raw-HTML rendering | ✓ Mitigated |
| ASH-OCLAW-399 | — MEDIUM | Zalo group sender allowlist bypass permits unauthorized GROUP dispatch | ✓ Mitigated |
| ASH-OCLAW-400 | — MEDIUM | Temporary path handling could write outside OpenClaw temp boundary | ✓ Mitigated |
| ASH-OCLAW-401 | — MEDIUM | safeBins static default trusted dirs allow writable-dir binary hijack (`jq`) | ✓ Mitigated |
| ASH-OCLAW-402 | — MEDIUM | system.run shell-wrapper positional argv carriers could execute hidden commands under misl | ✓ Mitigated |
| ASH-OCLAW-403 | — MEDIUM | Sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-pare | ✓ Mitigated |
| ASH-OCLAW-404 | — MEDIUM | Telegram: Unauthorized Senders Trigger Media Download and Disk Write Before Access Check | ✓ Mitigated |
| ASH-OCLAW-405 | — MEDIUM | Dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run | ✓ Mitigated |
| ASH-OCLAW-406 | — LOW | sandbox network isolation bypass via docker.network=container: |
✓ Mitigated |
| ASH-OCLAW-407 | — HIGH | Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs | ✓ Mitigated |
| ASH-OCLAW-408 | — LOW | IPv6 multicast SSRF classifier bypass | ✓ Mitigated |
| ASH-OCLAW-409 | — LOW | macOS beta onboarding exposed PKCE verifier via OAuth state | ✓ Mitigated |
| ASH-OCLAW-410 | — MEDIUM | Gateway agents.files symlink escape allowed out-of-workspace file read/write | ✓ Mitigated |
| ASH-OCLAW-411 | — MEDIUM | Signal reaction-only status events could, in limited cases, be enqueued before access chec | ✓ Mitigated |
| ASH-OCLAW-412 | — MEDIUM | Telegram message_reaction authorization bypass allows unauthorized system-event injection | ✓ Mitigated |
| ASH-OCLAW-413 | — MEDIUM | Browser trace/download path symlink escape in temp output handling | ✓ Mitigated |
| ASH-OCLAW-414 | — MEDIUM | Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups | ✓ Mitigated |
| ASH-OCLAW-415 | — MEDIUM | Trusted-proxy Control UI pairing bypass allowed unpaired node sessions | ✓ Mitigated |
| ASH-OCLAW-416 | — HIGH | Hardlink alias checks could bypass workspace-only file boundaries in specific configuratio | ✓ Mitigated |
| ASH-OCLAW-417 | — MEDIUM | system.run approval TOCTOU via mutable symlink cwd target on node host | ✓ Mitigated |
| ASH-OCLAW-418 | — MEDIUM | Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot | ✓ Mitigated |
| ASH-OCLAW-419 | — MEDIUM | MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pendin | ✓ Mitigated |
| ASH-OCLAW-420 | — HIGH | Browser-origin WebSocket auth hardening gap could enable loopback password brute-force cha | ✓ Mitigated |
| ASH-OCLAW-421 | — MEDIUM | Node system.run approval bypass via parent-symlink cwd rebind | ✓ Mitigated |
| ASH-OCLAW-422 | — LOW | voice-call Twilio replay dedupe now bound to authenticated webhook identity | ✓ Mitigated |
| ASH-OCLAW-423 | — LOW | Cross-account DM pairing authorization bypass via unscoped pairing store access | ✓ Mitigated |
| ASH-OCLAW-424 | — LOW | BlueBubbles group allowlist mismatch via DM pairing-store fallback | ✓ Mitigated |
| ASH-OCLAW-425 | — MEDIUM | Microsoft Teams media fetch SSRF hardening: unified guarded fetch across Graph and attachm | ✓ Mitigated |
| ASH-OCLAW-426 | — MEDIUM | Node system.run approval context-binding weakness in approval-enabled host=node flows | ✓ Mitigated |
| ASH-OCLAW-427 | — MEDIUM | DM pairing-store identities could satisfy group allowlist authorization | ✓ Mitigated |
| ASH-OCLAW-428 | — HIGH | Gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels pa | ✓ Mitigated |
| ASH-OCLAW-429 | — LOW | Signal group allowlist authorization bypass via DM pairing-store leakage | ✓ Mitigated |
| ASH-OCLAW-430 | — HIGH | LINE group allowlist scope mismatch with DM pairing-store entries | ✓ Mitigated |
| ASH-OCLAW-431 | — HIGH | workspace path guard bypass on non-existent out-of-root symlink leaf | ✓ Mitigated |
| ASH-OCLAW-432 | — HIGH | Sandbox dangling-symlink alias handling could bypass workspace-only write boundary | ✓ Mitigated |
| ASH-OCLAW-433 | — MEDIUM | /api/channels gateway-auth boundary bypass via path canonicalization mismatch | ✓ Mitigated |
| ASH-OCLAW-434 | — MEDIUM | Browser control startup could continue unauthenticated after auth bootstrap failure | ✓ Mitigated |
| ASH-OCLAW-435 | — HIGH | Authorization mismatch allowed write-scope agent runs to reach owner-only tools | ✓ Mitigated |
| ASH-OCLAW-436 | — MEDIUM | Unicode canonicalization drift in node metadata policy classification could broaden node a | ✓ Mitigated |
| ASH-OCLAW-437 | — HIGH | system.run approvals did not bind PATH-token executable identity, enabling post-approval e | ✓ Mitigated |
| ASH-OCLAW-438 | — MEDIUM | Sandbox media TOCTOU could read files outside sandbox root | ✓ Mitigated |
| ASH-OCLAW-439 | — MEDIUM | TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root bou | ✓ Mitigated |
| ASH-OCLAW-440 | — HIGH | ACPX Windows wrapper shell fallback allowed cwd injection in specific paths | ✓ Mitigated |
| ASH-OCLAW-441 | — MEDIUM | Unauthorized sender bypass in stop triggers and /models command authorization | ✓ Mitigated |
| ASH-OCLAW-442 | — MEDIUM | web_search citation redirect SSRF via private-network-allowing policy | ✓ Mitigated |
| ASH-OCLAW-443 | — MEDIUM | Node camera URL payload host-binding bypass allowed gateway fetch pivots | ✓ Mitigated |
| ASH-OCLAW-444 | — MEDIUM | ZIP extraction race could write outside destination via parent symlink rebind | ✓ Mitigated |
| ASH-OCLAW-445 | — MEDIUM | stageSandboxMedia destination symlink traversal can overwrite files outside sandbox worksp | ✓ Mitigated |
| ASH-OCLAW-446 | — MEDIUM | Node system.run approval hardening wrapper semantic drift can execute unintended local scr | ✓ Mitigated |
| ASH-OCLAW-447 | — HIGH | Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP | ✓ Mitigated |
| ASH-OCLAW-448 | — MEDIUM | Unified root-bound write hardening for browser output and related path-boundary flows | ✓ Mitigated |
| ASH-OCLAW-449 | — MEDIUM | Pre-auth webhook body parsing can enable unauthenticated slow-request DoS | ✓ Mitigated |
| ASH-OCLAW-450 | — MEDIUM | hooks count non-POST requests toward auth lockout | ✓ Mitigated |
| ASH-OCLAW-451 | — HIGH | Dashboard leaked gateway auth material via browser URL/query and localStorage | ✓ Mitigated |
| ASH-OCLAW-452 | — HIGH | fetch-guard forwards custom authorization headers across cross-origin redirects | ✓ Mitigated |
| ASH-OCLAW-453 | — MEDIUM | Cross-account sender authorization expansion in `/allowlist ... --store` account scoping | ✓ Mitigated |
| ASH-OCLAW-454 | — MEDIUM | `operator.write` chat.send could reach admin-only config writes | ✓ Mitigated |
| ASH-OCLAW-455 | — MEDIUM | `system.run` env override filtering allowed dangerous helper-command pivots | ✓ Mitigated |
| ASH-OCLAW-456 | — MEDIUM | system.run allow-always persistence included shell-commented payload tails | ✓ Mitigated |
| ASH-OCLAW-457 | — MEDIUM | Sandboxed /acp spawn requests could initialize host ACP sessions | ✓ Mitigated |
| ASH-OCLAW-458 | — MEDIUM | system.run allowlist approval parsing missed PowerShell encoded-command wrappers | ✓ Mitigated |
| ASH-OCLAW-459 | — MEDIUM | system.run wrapper-depth boundary could skip shell approval gating | ✓ Mitigated |
| ASH-OCLAW-460 | — MEDIUM | system.run approvals did not bind mutable script operands across approval and execution | ✓ Mitigated |
| ASH-OCLAW-461 | — MEDIUM | skills-install-download can be redirected outside the tools root by rebinding the validate | ✓ Mitigated |
| ASH-OCLAW-462 | — MEDIUM | MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist i | ✓ Mitigated |
| ASH-OCLAW-463 | — CRITICAL | Pairing-scoped device tokens could mint `operator.admin` and reach node RCE | ✓ Mitigated |
| ASH-OCLAW-464 | — HIGH | Leaf subagents could steer sibling sessions across sandbox boundaries | ✓ Mitigated |
| ASH-OCLAW-465 | — MEDIUM | Channel commands could bypass account-scoped `configWrites` restrictions | ✓ Mitigated |
| ASH-OCLAW-466 | — MEDIUM | Discord guild reaction ingress could bypass users and roles allowlists | ✓ Mitigated |
| ASH-OCLAW-467 | — MEDIUM | Write-scoped callers could reach admin-only session reset logic through `agent` | ✓ Mitigated |
| ASH-OCLAW-468 | — HIGH | Unbound interpreter and runtime commands could bypass node-host approval integrity | ✓ Mitigated |
| ASH-OCLAW-469 | — HIGH | Plugin subagent routes could bypass gateway authorization with synthetic admin scopes | ✓ Mitigated |
| ASH-OCLAW-470 | — MEDIUM | Zalouser allowlist authorization matched mutable group names by default | ✓ Mitigated |
| ASH-OCLAW-471 | — CRITICAL | WebSocket shared-auth connections could self-declare elevated scopes | ✓ Mitigated |
| ASH-OCLAW-472 | — HIGH | Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces | ✓ Mitigated |
| ASH-OCLAW-473 | — MEDIUM | Zalo webhook rate limiting could be bypassed before secret validation | ✓ Mitigated |
| ASH-OCLAW-474 | — HIGH | `browser.request` let `operator.write` persist admin-only browser profile changes | ✓ Mitigated |
| ASH-OCLAW-475 | — HIGH | `session_status` let sandboxed subagents access parent or sibling session state | ✓ Mitigated |
| ASH-OCLAW-476 | — HIGH | Telegram webhook request bodies were read before secret validation, enabling unauthenticat | ✓ Mitigated |
| ASH-OCLAW-477 | — HIGH | Bootstrap setup codes could be replayed to escalate pending pairing scopes before approval | ✓ Mitigated |
| ASH-OCLAW-478 | — MEDIUM | Unsanitized iMessage attachment paths allowed SCP remote-path command injection | ✓ Mitigated |
| ASH-OCLAW-479 | — MEDIUM | Session transcript files were created without forced user-only permissions | ✓ Mitigated |
| ASH-OCLAW-480 | — HIGH | Gateway agent /reset exposes admin session reset to operator.write callers | ✓ Mitigated |
| ASH-OCLAW-481 | — HIGH | Plivo V2 verified replay identity drifts on query-only variants | ✓ Mitigated |
| ASH-OCLAW-482 | — MEDIUM | Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication | ✓ Mitigated |
| ASH-OCLAW-483 | — HIGH | system.run allowlist bypass via unregistered time dispatch wrapper. | ✓ Mitigated |
| ASH-OCLAW-484 | — MEDIUM | Remote media error responses could trigger unbounded memory allocation before failure. | ✓ Mitigated |
| ASH-OCLAW-485 | — HIGH | Synology Chat reply delivery could be rebound through username-based user resolution. | ✓ Mitigated |
| ASH-OCLAW-486 | — MEDIUM | TXT-only Bonjour and DNS-SD discovery metadata could still steer CLI routing when service | ✓ Mitigated |
| ASH-OCLAW-487 | — HIGH | Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforceme | ✓ Mitigated |
| ASH-OCLAW-488 | — HIGH | Trusted-proxy Control UI sessions could retain self-declared privileged scopes without dev | ✓ Mitigated |
| ASH-OCLAW-489 | — MEDIUM | Voice Call webhook buffered request bodies before provider signature checks, enabling boun | ✓ Mitigated |
| ASH-OCLAW-490 | — HIGH | Gateway host exec env override handling did not consistently apply the shared host env pol | ✓ Mitigated |
| ASH-OCLAW-491 | — MEDIUM | Sessions send Action Missing controlScope Enforcement Allows Leaf Subagents to Message Con | ✓ Mitigated |
| ASH-OCLAW-492 | — CRITICAL | Gateway device.pair.approve Lets operator.pairing Escalate a New Device into operator.admi | ✓ Mitigated |
| ASH-OCLAW-493 | — MEDIUM | Mattermost callback dispatch allowed non-allowlisted sender actions. | ✓ Mitigated |
| ASH-OCLAW-494 | — HIGH | Google Chat app-url webhook auth accepted non-deployment add-on principals. | ✓ Mitigated |
| ASH-OCLAW-495 | — MEDIUM | Tlon settings empty-allowlist reconciliation bypassed intended revocation. | ✓ Mitigated |
| ASH-OCLAW-496 | — HIGH | Mutating internal ACP chat commands missed operator.admin scope enforcement. | ✓ Mitigated |
| ASH-OCLAW-497 | — MEDIUM | Tlon cite expansion happened before channel and DM authorization completed. | ✓ Mitigated |
| ASH-OCLAW-498 | — MEDIUM | Image tool bypassed tools.fs.workspaceOnly and could read mounted files outside the worksp | ✓ Mitigated |
| ASH-OCLAW-499 | — HIGH | Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Bindi | ✓ Mitigated |
| ASH-OCLAW-500 | — MEDIUM | Gateway HTTP Session History Route Bypasses Operator Read Scope | ✓ Mitigated |
| ASH-OCLAW-501 | — CRITICAL | Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin | ✓ Mitigated |
| ASH-OCLAW-502 | — CRITICAL | Gateway local shared-auth reconnect silently widens paired device scope from operator.read | ✓ Mitigated |
| ASH-OCLAW-503 | — HIGH | Gateway Plugin HTTP auth: "gateway" Mints operator.admin Runtime Scope | ✓ Mitigated |
| ASH-OCLAW-504 | — MEDIUM | Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Weak Webh | ✓ Mitigated |
| ASH-OCLAW-505 | — MEDIUM | Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook | ✓ Mitigated |
| ASH-OCLAW-506 | — MEDIUM | BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webho | ✓ Mitigated |
| ASH-OCLAW-507 | — MEDIUM | Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName | ✓ Mitigated |
| ASH-OCLAW-508 | — MEDIUM | Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers | ✓ Mitigated |
| ASH-OCLAW-509 | — MEDIUM | Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State | ✓ Mitigated |
| ASH-OCLAW-510 | — HIGH | `session_status` sessionId resolution bypasses sandboxed session-tree visibility | ✓ Mitigated |
| ASH-OCLAW-511 | — MEDIUM | Feishu webhook reads and parses unauthenticated request bodies before signature validation | ✓ Mitigated |
| ASH-OCLAW-512 | — HIGH | SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for | ✓ Mitigated |
| ASH-OCLAW-513 | — MEDIUM | Gateway HTTP /v1/models Route Bypasses Operator Read Scope | ✓ Mitigated |
| ASH-OCLAW-514 | — HIGH | Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send | ✓ Mitigated |
| ASH-OCLAW-515 | — MEDIUM | Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement | ✓ Mitigated |
| ASH-OCLAW-516 | — MEDIUM | Incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell- | ✓ Mitigated |
| ASH-OCLAW-517 | — HIGH | `browser.request` still allows `POST /reset-profile` through the `operator.write` surface | ✓ Mitigated |
| ASH-OCLAW-518 | — HIGH | Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parame | ✓ Mitigated |
| ASH-OCLAW-519 | — MEDIUM | Zalo channel downloads media before sender authorization | ✓ Mitigated |
| ASH-OCLAW-520 | — HIGH | CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway | ✓ Mitigated |
| ASH-OCLAW-521 | — HIGH | node.pair.approve missing callerScopes validation allows low-privilege operator to approve | ✓ Mitigated |
| ASH-OCLAW-522 | — HIGH | Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non | ✓ Mitigated |
| ASH-OCLAW-523 | — MEDIUM | Discord component interaction ingress skips guild/channel policy enforcement | ✓ Mitigated |
| ASH-OCLAW-524 | — HIGH | Device removal and token revocation do not terminate active WebSocket sessions | ✓ Mitigated |
| ASH-OCLAW-525 | — HIGH | Gateway exec allow-always over-trusts positional carrier executables | ✓ Mitigated |
| ASH-OCLAW-526 | — MEDIUM | OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code e | ✓ Mitigated |
| ASH-OCLAW-527 | — HIGH | message tool media parameter bypasses tool policy filesystem isolation | ✓ Mitigated |
| ASH-OCLAW-528 | — HIGH | Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset` | ✓ Mitigated |
| ASH-OCLAW-529 | — LOW | OpenClaw SSRF guard misses four IPv6 special-use ranges | ✓ Mitigated |
| ASH-OCLAW-530 | — MEDIUM | Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/v | ✓ Mitigated |
| ASH-OCLAW-531 | — HIGH | OpenClaw Gateway WebSocket denial of service via unbounded pre-auth upgrades | ✓ Mitigated |
| ASH-OCLAW-532 | — HIGH | OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure | ✓ Mitigated |
| ASH-OCLAW-533 | — HIGH | Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing | ✓ Mitigated |
| ASH-OCLAW-534 | — HIGH | Gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper | ✓ Mitigated |
| ASH-OCLAW-535 | — MEDIUM | Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file | ✓ Mitigated |
| ASH-OCLAW-536 | — CRITICAL | CWD `.env` environment variable injection bypasses host-env policy and allows config takeo | ✓ Mitigated |
| ASH-OCLAW-537 | — CRITICAL | Incomplete host env sanitization blocklist allows supply-chain redirection via package-man | ✓ Mitigated |
| ASH-OCLAW-538 | — MEDIUM | Nextcloud Talk webhook missing rate limiting on shared secret authentication | ✓ Mitigated |
| ASH-OCLAW-539 | — MEDIUM | Unauthenticated plugin-auth HTTP routes receive operator runtime scopes | ✓ Mitigated |
| ASH-OCLAW-540 | — MEDIUM | OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.g | ✓ Mitigated |
| ASH-OCLAW-541 | — LOW | Voice-call Plivo replay mutates in-process callback origin before replay rejection | ✓ Mitigated |
| ASH-OCLAW-542 | — HIGH | Workspace `.env` can override the bundled hooks root and load attacker hook code | ✓ Mitigated |
| ASH-OCLAW-543 | — LOW | Zalo webhook replay cache cross-target messageId scope bypass | ✓ Mitigated |
| ASH-OCLAW-544 | — HIGH | Workspace `.env` can override the bundled plugin trust root | ✓ Mitigated |
| ASH-OCLAW-545 | — LOW | Gateway `device.token.rotate` does not terminate active WebSocket sessions after credentia | ✓ Mitigated |
| ASH-OCLAW-546 | — CRITICAL | Sandbox escape via TOCTOU race in remote FS bridge readFile | ✓ Mitigated |
| ASH-OCLAW-547 | — HIGH | `PIP_INDEX_URL` and `UV_INDEX_URL` bypass host exec env sanitization and redirect Python p | ✓ Mitigated |
| ASH-OCLAW-548 | — MEDIUM | Incomplete fix for CVE-2026-32062: voice-call still parses large WebSocket frames before s | ✓ Mitigated |
| ASH-OCLAW-549 | — MEDIUM | Discord voice ingress authorization can be bypassed via channel, name, and stale-role vali | ✓ Mitigated |
| ASH-OCLAW-550 | — MEDIUM | Feishu thread history and quoted messages bypass sender allowlist | ✓ Mitigated |
| ASH-OCLAW-551 | — MEDIUM | Matrix thread root and reply context bypass sender allowlist | ✓ Mitigated |
| ASH-OCLAW-552 | — LOW | Fake DeviceToken Bypasses Shared Auth Rate Limiting | ✓ Mitigated |
| ASH-OCLAW-553 | — CRITICAL | Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation | ✓ Mitigated |
| ASH-OCLAW-554 | — LOW | Security Scan Failure Does Not Block Plugin Installation (Fail-Open) | ✓ Mitigated |
| ASH-OCLAW-555 | — MEDIUM | MSTeams thread history bypasses sender allowlist via Graph API | ✓ Mitigated |
| ASH-OCLAW-556 | — HIGH | Device-Paired Node Skips Node Scope Gate → Host RCE.md | ✓ Mitigated |
| ASH-OCLAW-557 | — LOW | LINE webhook handler lacks shared pre-auth concurrency budget before signature verificatio | ✓ Mitigated |
| ASH-OCLAW-558 | — LOW | Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding | ✓ Mitigated |
| ASH-OCLAW-559 | — LOW | Tlon media downloads can bypass core safety limits and exhaust disk | ✓ Mitigated |
| ASH-OCLAW-560 | — MEDIUM | SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery | ✓ Mitigated |
| ASH-OCLAW-561 | — MEDIUM | Incomplete `host-env-security-policy.json` allows untrusted model to substitute compiler b | ✓ Mitigated |
| ASH-OCLAW-562 | — MEDIUM | Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS | ✓ Mitigated |
| ASH-OCLAW-563 | — LOW | SSH-based sandbox backends pass unsanitized process.env to child processes | ✓ Mitigated |
| ASH-OCLAW-564 | — HIGH | SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host | ✓ Mitigated |
| ASH-OCLAW-565 | — MEDIUM | Media download follows cross-origin redirects with Authorization headers intact | ✓ Mitigated |
| ASH-OCLAW-566 | — MEDIUM | Marketplace Plugin Download Follows Redirects Without SSRF Protection | ✓ Mitigated |
| ASH-OCLAW-567 | — MEDIUM | Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls | ✓ Mitigated |
| ASH-OCLAW-568 | — MEDIUM | Media Local Roots Self-Whitelisting in appendLocalMediaParentRoots Allows Mod |
✓ Mitigated |
| ASH-OCLAW-569 | — MEDIUM | Host exec environment sanitization misses package, registry, Docker, compiler, and TLS ove | ✓ Mitigated |
| ASH-OCLAW-570 | — MEDIUM | Telegram audio preflight transcription enables resource consumption by unauthorized sender | ✓ Mitigated |
| ASH-OCLAW-571 | — MEDIUM | Discord audio preflight transcription before member authorization | ✓ Mitigated |
| ASH-OCLAW-572 | — HIGH | OpenShell Mirror Sync: Sandbox Escape via Unrestricted File Sync + Symlink Traversal | ✓ Mitigated |
| ASH-OCLAW-573 | — HIGH | Paired node escalates to gateway RCE via unrestricted node.event agent dispatch | ✓ Mitigated |
| ASH-OCLAW-574 | — MEDIUM | MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exha | ✓ Mitigated |
| ASH-OCLAW-575 | — MEDIUM | HTTP operator endpoints lack browser-origin validation in trusted-proxy mode | ✓ Mitigated |
| ASH-OCLAW-576 | — HIGH | Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode | ✓ Mitigated |
| ASH-OCLAW-577 | — MEDIUM | Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file r | ✓ Mitigated |
| ASH-OCLAW-578 | — MEDIUM | Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses | ✓ Mitigated |
| ASH-OCLAW-579 | — LOW | OpenClaw Gateway Control Interface Information Disclosure Vulnerability | ✓ Mitigated |
| ASH-OCLAW-580 | — MEDIUM | `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels | ✓ Mitigated |
| ASH-OCLAW-581 | — HIGH | Agentic Consent Bypass: LLM Agent Can Silently Disable Exec Approval via `config.patch` | ✓ Mitigated |
| ASH-OCLAW-582 | — HIGH | OpenClaw <= 2026.3.23 Media Parsing Path Traversal to Arbitrary File Read | ✓ Mitigated |
| ASH-OCLAW-583 | — HIGH | Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace | ✓ Mitigated |
| ASH-OCLAW-584 | — MEDIUM | `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed inv | ✓ Mitigated |
| ASH-OCLAW-585 | — MEDIUM | Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send | ✓ Mitigated |
| ASH-OCLAW-586 | — MEDIUM | Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send | ✓ Mitigated |
| ASH-OCLAW-587 | — MEDIUM | OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled worksp | ✓ Mitigated |
| ASH-OCLAW-588 | — MEDIUM | Discord voice manager bypasses channel-level member access allowlist | ✓ Mitigated |
| ASH-OCLAW-589 | — LOW | Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config | ✓ Mitigated |
| ASH-OCLAW-590 | — LOW | diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is | ✓ Mitigated |
| ASH-OCLAW-591 | — LOW | Telegram legacy allowFrom migration fans default-account trust into all named accounts | ✓ Mitigated |
| ASH-OCLAW-592 | — MEDIUM | macOS Wide-Area Discovery Accepts Arbitrary Tailnet Peer as DNS Authority and Exfiltrates | ✓ Mitigated |
| ASH-OCLAW-593 | — MEDIUM | Remote onboarding preserves attacker-discovered endpoint after trust decline, routing gate | ✓ Mitigated |
| ASH-OCLAW-594 | — LOW | Discord Slash Commands Bypass Group DM Channel Allowlist | ✓ Mitigated |
| ASH-OCLAW-595 | — LOW | Discord Component Interaction Misclassifies Group DM as Direct Message | ✓ Mitigated |
| ASH-OCLAW-596 | — HIGH | Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime | ✓ Mitigated |
| ASH-OCLAW-597 | — HIGH | Bootstrap setup codes were not bound to the intended device role and scopes, allowing firs | ✓ Mitigated |
| ASH-OCLAW-598 | — MEDIUM | Forged Nostr DMs could create pairing state before signature verification | ✓ Mitigated |
| ASH-OCLAW-599 | — MEDIUM | Shell init-file options could satisfy exec allowlist script matching | ✓ Mitigated |
| ASH-OCLAW-600 | — LOW | Zalo replay dedupe cache could suppress events across authenticated webhook targets | ✓ Mitigated |
| ASH-OCLAW-601 | — LOW | Pairing pending-request caps were enforced per channel instead of per account | ✓ Mitigated |
| ASH-OCLAW-602 | — MEDIUM | Untrusted workspace channel shadows could execute during built-in channel setup | ✓ Mitigated |
| ASH-OCLAW-603 | — MEDIUM | Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/ki | ✓ Mitigated |
| ASH-OCLAW-604 | — MEDIUM | Windows-compatible env override keys could bypass system.run approval binding | ✓ Mitigated |
| ASH-OCLAW-605 | — MEDIUM | Complex interpreter pipelines could skip exec script preflight validation | ✓ Mitigated |
| ASH-OCLAW-606 | — HIGH | QQ Bot structured payloads could read arbitrary local files | ✓ Mitigated |
| ASH-OCLAW-607 | — MEDIUM | iOS A2UI bridge trusted generic local-network pages for agent.request dispatch | ✓ Mitigated |
| ASH-OCLAW-608 | — HIGH | OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped | ✓ Mitigated |
| ASH-OCLAW-609 | — LOW | Gateway hello snapshots exposed host config and state paths to non-admin clients | ✓ Mitigated |
| ASH-OCLAW-610 | — LOW | Shared-secret comparison call sites leaked length information through timing | ✓ Mitigated |
| ASH-OCLAW-611 | — MEDIUM | Zalo replay dedupe keys could suppress messages across chats or senders | ✓ Mitigated |
| ASH-OCLAW-612 | — HIGH | pnpm dlx approvals did not bind local script operands | ✓ Mitigated |
| ASH-OCLAW-613 | — MEDIUM | Slack thread context could include messages from non-allowlisted senders | ✓ Mitigated |
| ASH-OCLAW-614 | — LOW | Android accepted cleartext remote gateway endpoints and sent stored credentials over ws:// | ✓ Mitigated |
| ASH-OCLAW-615 | — LOW | Trailing-dot localhost CDP hosts could bypass remote loopback protections | ✓ Mitigated |
| ASH-OCLAW-616 | — MEDIUM | Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48- | ✓ Mitigated |
| ASH-OCLAW-617 | — HIGH | Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement | ✓ Mitigated |
| ASH-OCLAW-618 | — HIGH | Lower-trust background runtime output is injected into trusted `System:` events, and local | ✓ Mitigated |
| ASH-OCLAW-619 | — HIGH | Shared reply MEDIA: paths are treated as trusted and can trigger cross-channel local file | ✓ Mitigated |
| ASH-OCLAW-620 | — MEDIUM | QQ Bot Extension: Missing SSRF Protection on All Media Fetch Paths | ✓ Mitigated |
| ASH-OCLAW-621 | — HIGH | Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `Syst | ✓ Mitigated |
| ASH-OCLAW-622 | — MEDIUM | Browser SSRF Policy Bypass via Interaction-Triggered Navigation | ✓ Mitigated |
| ASH-OCLAW-623 | — MEDIUM | Multiple Code Paths Missing Base64 Pre-Allocation Size Checks | ✓ Mitigated |
| ASH-OCLAW-624 | — HIGH | strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gatew | ✓ Mitigated |
| ASH-OCLAW-625 | — HIGH | OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing | ✓ Mitigated |
| ASH-OCLAW-626 | — HIGH | HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env de | ✓ Mitigated |
| ASH-OCLAW-627 | — HIGH | OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutati | ✓ Mitigated |
| ASH-OCLAW-628 | — HIGH | OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-up | ✓ Mitigated |
| ASH-OCLAW-629 | — HIGH | GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p | ✓ Mitigated |
| ASH-OCLAW-630 | — MEDIUM | Existing WS sessions survive shared gateway token rotation | ✓ Mitigated |
| ASH-OCLAW-631 | — MEDIUM | resolvedAuth closure becomes stale after config reload | ✓ Mitigated |
| ASH-OCLAW-632 | — HIGH | B-M3: ClawHub package downloads are not enforced with integrity verification | ✓ Mitigated |
| ASH-OCLAW-633 | — MEDIUM | /allowlist omits owner-only enforcement for cross-channel allowlist writes | ✓ Mitigated |
| ASH-OCLAW-634 | — HIGH | Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into | ✓ Mitigated |
| ASH-OCLAW-635 | — MEDIUM | Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on | ✓ Mitigated |
| ASH-OCLAW-636 | — HIGH | `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects | ✓ Mitigated |
| ASH-OCLAW-637 | — MEDIUM | Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachabl | ✓ Mitigated |
| ASH-OCLAW-638 | — HIGH | OpenClaw Host-Exec Environment Variable Injection | ✓ Mitigated |
| ASH-OCLAW-639 | — LOW | TOCTOU read in exec script preflight | ✓ Mitigated |
| ASH-OCLAW-640 | — MEDIUM | Browser snapshot and screenshot routes could expose internal page content after navigation | ✓ Mitigated |
| ASH-OCLAW-641 | — HIGH | config.get redaction bypass through sourceConfig and runtimeConfig aliases | ✓ Mitigated |
| ASH-OCLAW-642 | — LOW | Microsoft Teams SSO invoke handler missed sender authorization checks | ✓ Mitigated |
| ASH-OCLAW-643 | — MEDIUM | Collect-mode queue batches could reuse the last sender authorization context | ✓ Mitigated |
| ASH-OCLAW-644 | — MEDIUM | Heartbeat owner downgrade missed untrusted webhook wake events | ✓ Mitigated |
| ASH-OCLAW-645 | — MEDIUM | Delivery queue recovery could lose group tool-policy context for media replay | ✓ Mitigated |
| ASH-OCLAW-646 | — MEDIUM | Empty approver lists could grant explicit approval authorization | ✓ Mitigated |
| ASH-OCLAW-647 | — MEDIUM | Discord event cover images bypassed sandbox media normalization | ✓ Mitigated |
| ASH-OCLAW-648 | — MEDIUM | Heartbeat owner downgrade missed local async exec completion events | ✓ Mitigated |
| ASH-OCLAW-649 | — MEDIUM | Agent hook events could enqueue trusted system events from unsanitized external input | ✓ Mitigated |
| ASH-OCLAW-650 | — MEDIUM | Voice-call realtime WebSocket accepted oversized frames | ✓ Mitigated |
| ASH-OCLAW-651 | — HIGH | Sandboxed agents could escape exec routing via host=node override | ✓ Mitigated |
| ASH-OCLAW-652 | — MEDIUM | Matrix profile config persistence was reachable from operator.write message tools | ✓ Mitigated |
| ASH-OCLAW-653 | — MEDIUM | Memory dreaming config persistence was reachable from operator.write commands | ✓ Mitigated |
| ASH-OCLAW-654 | — MEDIUM | Nostr profile mutation routes allowed operator.write config persistence | ✓ Mitigated |
| ASH-OCLAW-655 | — MEDIUM | Shell-wrapper detection missed env-argv assignment injection forms | ✓ Mitigated |
| ASH-OCLAW-656 | — HIGH | busybox and toybox applet execution weakened exec approval binding | ✓ Mitigated |
| ASH-OCLAW-657 | — HIGH | Exec environment denylist missed high-risk interpreter startup variables | ✓ Mitigated |
| ASH-OCLAW-658 | — HIGH | Workspace .env could inject OpenClaw runtime-control variables | ✓ Mitigated |
| ASH-OCLAW-659 | — HIGH | Channel setup catalog lookups could include untrusted workspace plugin shadows | ✓ Mitigated |
| ASH-OCLAW-660 | — MEDIUM | Remote marketplace repository paths could escape through symlink traversal | ✓ Mitigated |
| ASH-OCLAW-661 | — HIGH | Workspace provider auth choices could auto-enable untrusted provider plugins | ✓ Mitigated |
| ASH-OCLAW-662 | — HIGH | Browser SSRF hostname validation could be bypassed by DNS rebinding | ✓ Mitigated |
| ASH-OCLAW-663 | — HIGH | Browser SSRF policy default allowed private-network navigation | ✓ Mitigated |
| ASH-OCLAW-664 | — HIGH | QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes | ✓ Mitigated |
| ASH-OCLAW-665 | — HIGH | Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0 | ✓ Mitigated |
| ASH-OCLAW-666 | — MEDIUM | screen_record outPath bypassed workspace-only filesystem guard | ✓ Mitigated |
| ASH-OCLAW-667 | — HIGH | Browser interaction routes could pivot into local CDP and regain file reads | ✓ Mitigated |
| ASH-OCLAW-668 | — HIGH | Browser tabs action select and close routes bypassed SSRF policy | ✓ Mitigated |
| ASH-OCLAW-669 | — MEDIUM | CDP /json/version WebSocket URL could pivot to untrusted second-hop targets | ✓ Mitigated |
| ASH-OCLAW-670 | — HIGH | QQBot media tags could read arbitrary local files through reply text | ✓ Mitigated |
| ASH-OCLAW-671 | — MEDIUM | Existing-session browser interaction routes bypassed SSRF policy enforcement | ✓ Mitigated |
| ASH-OCLAW-672 | — HIGH | Sandbox noVNC helper route exposed interactive browser session credentials | ✓ Mitigated |
| ASH-OCLAW-673 | — MEDIUM | Browser press/type interaction routes missed complete navigation guard coverage | ✓ Mitigated |
| ASH-OCLAW-674 | — MEDIUM | Sender policy bypass in host media attachment reads allows unauthorized local file disclos | ✓ Mitigated |
| ASH-OCLAW-675 | — HIGH | Matrix room control-command authorization no longer trusts DM pairing-store entries | ✓ Mitigated |
| ASH-OCLAW-676 | — MEDIUM | Webchat media embedding enforces local-root containment for tool-result files | ✓ Mitigated |
| ASH-OCLAW-677 | — HIGH | Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation | ✓ Mitigated |
| ASH-OCLAW-678 | — LOW | QMD memory_get restricts reads to canonical or indexed memory paths | ✓ Mitigated |
| ASH-OCLAW-679 | — CRITICAL | Feishu webhook and card-action validation now fail closed | ✓ Mitigated |
| ASH-OCLAW-680 | — MEDIUM | MCP stdio server env could load dangerous startup variables from workspace config | ✓ Mitigated |
| ASH-OCLAW-681 | — MEDIUM | Agent gateway config mutations could change protected operator settings | ✓ Mitigated |
| ASH-OCLAW-682 | — MEDIUM | Hook mapping templates could bypass hook session-key opt-in | ✓ Mitigated |
| ASH-OCLAW-683 | — LOW | QQBot direct media upload skipped URL SSRF validation | ✓ Mitigated |
| ASH-OCLAW-684 | — MEDIUM | Workspace dotenv could override OpenClaw runtime-control environment variables | ✓ Mitigated |
| ASH-OCLAW-685 | — LOW | Paired-device pairing actions were not limited to the caller device | ✓ Mitigated |
| ASH-OCLAW-686 | — LOW | Assistant media route missed scope enforcement for trusted-proxy auth | ✓ Mitigated |
| ASH-OCLAW-687 | — MEDIUM | Feishu card actions could misclassify DMs and skip dmPolicy | ✓ Mitigated |
| ASH-OCLAW-688 | — LOW | Isolated cron awareness events were recorded as trusted system events | ✓ Mitigated |
| ASH-OCLAW-689 | — MEDIUM | Workspace dotenv MiniMax host override could redirect credentialed requests | ✓ Mitigated |
| ASH-OCLAW-690 | — LOW | Browser CDP profile creation skipped strict-mode SSRF checks | ✓ Mitigated |
| ASH-OCLAW-691 | — MEDIUM | Bundled MCP/LSP tools could bypass configured tool policy | ✓ Mitigated |
| ASH-OCLAW-692 | — MEDIUM | Owner-enforced commands could accept wildcard channel senders as command owners | ✓ Mitigated |
| ASH-OCLAW-693 | — MEDIUM | Webchat audio embedding could read local files without local-root containment | ✓ Mitigated |
| ASH-OCLAW-694 | — LOW | Gateway Control UI bootstrap config required Gateway auth | ✓ Mitigated |
| ASH-OCLAW-695 | — MEDIUM | Workspace dotenv files cannot override connector endpoint hosts | ✓ Mitigated |
| ASH-OCLAW-696 | — MEDIUM | Exec allowlist analysis rejects shell expansion in unquoted heredocs | ✓ Mitigated |
| ASH-OCLAW-697 | — HIGH | MCP loopback owner context is derived from server-issued bearer tokens | ✓ Mitigated |
| ASH-OCLAW-698 | — HIGH | OpenShell FS bridge writes stay pinned to the sandbox mount root | ✓ Mitigated |
| ASH-OCLAW-699 | — HIGH | OpenShell FS bridge reads pin and verify the opened file before returning bytes | ✓ Mitigated |
| ASH-OCLAW-700 | — MEDIUM | ACP child sessions inherit subagent security envelope constraints | ✓ Mitigated |
| ASH-OCLAW-701 | — MEDIUM | Zalo outbound photo URLs are validated through the SSRF guard | ✓ Mitigated |
| ASH-OCLAW-702 | — MEDIUM | Webhooks SecretRef route secret remains valid after rotation/reload | ✓ Mitigated |
| ASH-OCLAW-703 | — HIGH | Arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-k | ✓ Mitigated |
| ASH-OCLAW-704 | — HIGH | Gateway config mutation guard allowed unsafe model-driven config writes | ✓ Mitigated |
| ASH-OCLAW-705 | — MEDIUM | Host environment sanitizer missed two Node.js control variables | ✓ Mitigated |
| ASH-OCLAW-706 | — MEDIUM | Exec allowlist could miss side effects from transparent command wrappers | ✓ Mitigated |
| ASH-OCLAW-707 | — MEDIUM | Hostname checks could treat trailing-dot hosts inconsistently | ✓ Mitigated |
| ASH-OCLAW-708 | — MEDIUM | Message read actions could skip channel allowlist checks | ✓ Mitigated |
| ASH-OCLAW-709 | — MEDIUM | Shell wrapper argv could change between approval and execution | ✓ Mitigated |
| ASH-OCLAW-710 | — MEDIUM | Combined POSIX shell options could confuse exec revalidation | ✓ Mitigated |
| ASH-OCLAW-711 | — MEDIUM | Bundle MCP loopback could miss its exec denylist on session spawn | ✓ Mitigated |
| ASH-OCLAW-712 | — HIGH | Exec approval display truncation could hide the command being approved | ✓ Mitigated |
| ASH-OCLAW-713 | — MEDIUM | Shell positional parameters could weaken strict inline-eval checks | ✓ Mitigated |
| ASH-OCLAW-714 | — HIGH | POSIX node system.run safe-bin allowlist could be widened by shell expansion | ✓ Mitigated |
| ASH-OCLAW-715 | — MEDIUM | Marketplace runtime extension metadata could point at unscanned payloads | ✓ Mitigated |
| ASH-OCLAW-716 | — HIGH | Browser act interactions could bypass private-network navigation checks | ✓ Mitigated |
| ASH-OCLAW-717 | — HIGH | Paired nodes could forge exec lifecycle events without system.run provenance | ✓ Mitigated |
| ASH-OCLAW-718 | — HIGH | Pairing-scoped device session could restore revoked node token authority | ✓ Mitigated |
| ASH-OCLAW-719 | — HIGH | Hook-triggered CLI runs could receive owner MCP tool authority | ✓ Mitigated |
| ASH-OCLAW-720 | — MEDIUM | Same-host trusted-proxy deployments could accept local forged identity headers | ✓ Mitigated |
| ASH-OCLAW-721 | — HIGH | Control UI locality spoofing could mint a durable admin device token | ✓ Mitigated |
| ASH-OCLAW-722 | — HIGH | MCP Streamable HTTP redirects could forward configured custom headers to another origin | ✓ Mitigated |
| ASH-OCLAW-723 | — MEDIUM | Bootstrap token replay could widen pending pairing scopes | ✓ Mitigated |
| ASH-OCLAW-724 | — MEDIUM | Shell inline-command parsing could miss an allowlist check | ✓ Mitigated |
| ASH-OCLAW-725 | — LOW | Slack reaction events could ignore reaction notification settings | ✓ Mitigated |
| ASH-OCLAW-726 | — MEDIUM | Slack plugin approvals used the exec approver gate for plugin actions | ✓ Mitigated |
| ASH-OCLAW-727 | — HIGH | QQBot native approval buttons did not enforce configured approver identity | ✓ Mitigated |
| ASH-OCLAW-728 | — HIGH | Scoped chat.send route inheritance could bypass admin command scope gates | ✓ Mitigated |
| ASH-OCLAW-729 | — LOW | BlueBubbles sender policy could match mutable conversation identifiers | ✓ Mitigated |
| ASH-OCLAW-730 | — MEDIUM | Exported session HTML could keep unsafe markdown links | ✓ Mitigated |
| ASH-OCLAW-731 | — MEDIUM | Node pairing reconnection could confuse approval scope state | ✓ Mitigated |
| ASH-OCLAW-732 | — MEDIUM | PowerShell encoded-command aliases could miss exec allowlist checks | ✓ Mitigated |
| ASH-OCLAW-733 | — MEDIUM | Trusted retry endpoint checks could match hostname prefixes | ✓ Mitigated |
| ASH-OCLAW-734 | — MEDIUM | memory-wiki ingest could read local files with operator.write scope | ✓ Mitigated |
| ASH-OCLAW-735 | — MEDIUM | [AgentGG] Discord allowFrom could bind to mutable display names | ✓ Mitigated |
| ASH-OCLAW-736 | — MEDIUM | [AgentGG] Matrix allowFrom could bind to mutable display names | ✓ Mitigated |
| ASH-OCLAW-737 | — MEDIUM | Native command authorization could skip owner-command enforcement | ✓ Mitigated |
| ASH-OCLAW-738 | — MEDIUM | Telegram interactive callbacks could skip commands.allowFrom | ✓ Mitigated |
| ASH-OCLAW-739 | — MEDIUM | Active Memory write scope could mutate global config | ✓ Mitigated |
| ASH-OCLAW-740 | — LOW | Skill-command dispatch could skip before-tool-call hooks | ✓ Mitigated |
| ASH-OCLAW-741 | — MEDIUM | Skill Workshop apply flow could override pending approval | ✓ Mitigated |
| ASH-OCLAW-742 | — LOW | Feishu dynamic-agent bindings could miss configWrites enforcement | ✓ Mitigated |
| ASH-OCLAW-743 | — MEDIUM | macOS Swift exec allowlist missed combined POSIX inline flags | ✓ Mitigated |
| ASH-OCLAW-744 | — MEDIUM | Mattermost handlers could fall open when channel type was missing | ✓ Mitigated |
| ASH-OCLAW-745 | — MEDIUM | [AgentGG] Slack allowFrom could bind to mutable display names | ✓ Mitigated |
| ASH-OCLAW-746 | — MEDIUM | Config recovery could restore openclaw.json with broad file permissions | ✓ Mitigated |
| ASH-OCLAW-747 | — HIGH | Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing | ✓ Mitigated |
| ASH-OCLAW-748 | — MEDIUM | [AgentGG] Zalo allowFrom could bind to mutable display names | ✓ Mitigated |
| ASH-OCLAW-749 | — HIGH | Non-owner chat senders could issue device-pairing bootstrap codes | ✓ Mitigated |
| ASH-OCLAW-750 | — MEDIUM | QQBot admin commands could skip DM-only and allowFrom policy | ✓ Mitigated |
| ASH-OCLAW-751 | — MEDIUM | QQBot streaming command could mutate config without explicit allowFrom | ✓ Mitigated |
| ASH-OCLAW-752 | — MEDIUM | message.action forwarding could send Gateway credentials to model-supplied loopback URLs | ✓ Mitigated |
| ASH-OCLAW-753 | — MEDIUM | Browser debug/export routes could reuse already-open blocked tabs | ✓ Mitigated |
| ASH-OCLAW-754 | — MEDIUM | memory-wiki shared search could miss session visibility checks | ✓ Mitigated |
| ASH-OCLAW-755 | — HIGH | Linux and macOS exec allowlists skipped configured argument patterns | ✓ Mitigated |
| ASH-OCLAW-756 | — MEDIUM | QQBot pre-dispatch slash commands could skip allowFrom checks | ✓ Mitigated |
| ASH-OCLAW-757 | — MEDIUM | Workspace .env could override Homebrew executable selection for skill install flows | ✓ Mitigated |
| ASH-OCLAW-758 | — MEDIUM | Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution | ✓ Mitigated |
| ASH-OCLAW-759 | — MEDIUM | Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots | ✓ Mitigated |
| ASH-OCLAW-760 | — MEDIUM | Fake package roots could influence memory-core artifact loading | ✓ Mitigated |
| ASH-OCLAW-761 | — MEDIUM | Workspace-derived service PATH could influence trash command selection | ✓ Mitigated |
| ASH-OCLAW-762 | — MEDIUM | Workspace .env npm_execpath could influence bundled runtime dependency install | ✓ Mitigated |
| ASH-OCLAW-763 | — MEDIUM | Sandboxed session spawn could expose the real workspace path to child prompts | ✓ Mitigated |
| ASH-OCLAW-764 | — MEDIUM | Empty-scope device re-pairing could confuse caller scope containment | ✓ Mitigated |
| ASH-OCLAW-765 | — MEDIUM | Tool group policy callers could accept unvalidated group IDs | ✓ Mitigated |
| ASH-OCLAW-766 | — MEDIUM | Focus command could miss controlScope enforcement | ✓ Mitigated |
| ASH-OCLAW-767 | — MEDIUM | Embedded runner policy could be confused by provider aliases | ✓ Mitigated |
| ASH-OCLAW-768 | — MEDIUM | Internal/webchat command auth could inherit ownerAllowFrom wildcard state | ✓ Mitigated |
| ASH-OCLAW-769 | — MEDIUM | Mattermost slash token revocation could lag until monitor refresh | ✓ Mitigated |
| ASH-OCLAW-770 | — MEDIUM | MCP loopback could skip owner-only tool policy for non-owner callers | ✓ Mitigated |
| ASH-OCLAW-771 | — MEDIUM | Slack and Zalo webhook secrets could remain active after secrets.reload | ✓ Mitigated |
| ASH-OCLAW-772 | — HIGH | OpenAI-compatible HTTP model overrides could miss admin authorization | ✓ Mitigated |
| ASH-OCLAW-773 | — HIGH | Feishu tools could ignore per-account disablement | ✓ Mitigated |
| ASH-OCLAW-774 | — HIGH | Feishu permission tools could ignore per-account disablement | ✓ Mitigated |
| ASH-OCLAW-775 | — HIGH | OpenShell mirror sync could follow remote symlink parents | ✓ Mitigated |
| ASH-OCLAW-776 | — HIGH | flock wrapper could bypass durable exec approval binding | ✓ Mitigated |
| ASH-OCLAW-777 | — HIGH | Message mutations could skip requester authorization | ✓ Mitigated |
| ASH-OCLAW-778 | — HIGH | Discord guild actions could skip cross-provider requester authorization | ✓ Mitigated |
| ASH-OCLAW-779 | — MEDIUM | Plugin install wrappers could skip install policy | ✓ Mitigated |
| ASH-OCLAW-780 | — HIGH | Plugin install commands could allow non-owner persistence | ✓ Mitigated |
| ASH-OCLAW-781 | — HIGH | MCP loopback could expose owner-only tools to non-owner runs | ✓ Mitigated |
| ASH-OCLAW-782 | — HIGH | WhatsApp group IDs could satisfy elevated sender allowlists | ✓ Mitigated |
| ASH-OCLAW-783 | — HIGH | Browser CDP discovery could accept blocked WebSocket URLs | ✓ Mitigated |
| ASH-OCLAW-784 | — MEDIUM | Native web search could ignore OpenClaw tool policy | ✓ Mitigated |
| ASH-OCLAW-785 | — HIGH | Host exec environment filtering could miss interpreter startup variables | ✓ Mitigated |
| ASH-OCLAW-786 | — HIGH | Host exec environment filtering could allow Git ext transport | ✓ Mitigated |
| ASH-OCLAW-787 | — HIGH | Sandbox exec-server HTTP requests could reach internal networks | ✓ Mitigated |
| ASH-OCLAW-788 | — HIGH | Isolated cron jobs could regain denied exec tools | ✓ Mitigated |
| ASH-OCLAW-789 | — HIGH | Host exec environment filtering could miss rustup startup variables | ✓ Mitigated |
| ASH-OCLAW-790 | — HIGH | Sandbox bind mounts could bypass parent-directory denylist checks | ✓ Mitigated |
| ASH-OCLAW-791 | — HIGH | MS Teams message actions could miss requester authorization | ✓ Mitigated |
| ASH-OCLAW-792 | — HIGH | Discord moderation actions could miss trusted requester checks | ✓ Mitigated |
| ASH-OCLAW-793 | — MEDIUM | MCP SSE redirects could forward Authorization headers | ✓ Mitigated |
| ASH-OCLAW-794 | — HIGH | ClickClack agent-mode dispatch could ignore toolsAllow | ✓ Mitigated |
| ASH-OCLAW-795 | — MEDIUM | MS Teams outbound requests could leak Bot Framework tokens | ✓ Mitigated |
| ASH-OCLAW-796 | — MEDIUM | Bot Framework serviceUrl validation could leak bot tokens | ✓ Mitigated |
| ASH-OCLAW-797 | — MEDIUM | QQBot media upload could reach untrusted remote URLs | ✓ Mitigated |
| ASH-OCLAW-798 | — HIGH | QQBot exec approvals could allow non-allowlisted senders | ✓ Mitigated |
| ASH-OCLAW-799 | — HIGH | device.pair.approve could bypass role-management checks | ✓ Mitigated |
| ASH-OCLAW-800 | — HIGH | Hooks allowedAgentIds could be bypassed with blank agent IDs | ✓ Mitigated |
| ASH-OCLAW-801 | — MEDIUM | WebSocket auth attempts could avoid non-browser rate limits | ✓ Mitigated |
| ASH-OCLAW-802 | — MEDIUM | ClickClack allowFrom could allow non-allowlisted commands | ✓ Mitigated |
| ASH-OCLAW-803 | — HIGH | Setup-mode discovery could load untrusted workspace plugins | ✓ Mitigated |
| ASH-OCLAW-804 | — HIGH | Device-pair approval could expose node system.run early | ✓ Mitigated |
| ASH-OCLAW-805 | — MEDIUM | [AgentGG] MS Teams allowFrom could bind to mutable display names | ✓ Mitigated |
| ASH-OCLAW-806 | — MEDIUM | Skill command dispatch could skip effective tool policy | ✓ Mitigated |
| ASH-OCLAW-807 | — HIGH | Browser act route could miss current-tab URL checks | ✓ Mitigated |
| ASH-OCLAW-808 | — HIGH | Browser snapshot routes could miss post-navigation SSRF checks | ✓ Mitigated |
| ASH-OCLAW-809 | — HIGH | Exec allowlist glob matching could allow traversal bypasses | ✓ Mitigated |
| ASH-OCLAW-810 | — HIGH | Identity-bearing HTTP callers could reach admin-scoped tools | ✓ Mitigated |
| ASH-OCLAW-811 | — MEDIUM | Remote media URLs could slow-read exhaust tool workers | ✓ Mitigated |
| ASH-OCLAW-812 | — MEDIUM | Trajectory export could skip broad credential redaction | ✓ Mitigated |
| ASH-OCLAW-813 | — HIGH | MS Teams safeFetch could race DNS rebinding checks | ✓ Mitigated |
| ASH-OCLAW-814 | — HIGH | HTTP Canvas responses could forge trusted A2UI actions | ✓ Mitigated |
| ASH-OCLAW-815 | — HIGH | Node exec approvals could use different gateway and node environments | ✓ Mitigated |
| ASH-OCLAW-816 | — HIGH | Workspace dotenv files could override provider credentials | ✓ Mitigated |
All CVEs disclosed in Hermes Agent (March–July 2026) are documented and tracked by AgentShroud’s defense-in-depth architecture.
| CVE | CVSS | Title | Status |
|---|---|---|---|
| ASH-HERMES-014 | 5.9 MEDIUM | Dependency CVE: python-olm (libolm) side-channel/signature weaknesses -- permanently unfixed upstream | ⚠ Partial |
| ASH-HERMES-005 | 8.1 HIGH | OS Command Injection in terminal_tool approval.py detect_dangerous_command | ✓ Mitigated |
| ASH-HERMES-013 | 7.8 HIGH | Dependency CVE: Pillow OS command injection via Image.show() on Windows | ✓ Mitigated |
| ASH-HERMES-004 | 6.1 HIGH | Information Disclosure via _make_run_env in local.py | ✓ Mitigated |
| ASH-HERMES-006 | 5.6 MEDIUM | Missing Authentication on Hermes Agent API Endpoints (GHSA-r7hr-pvjh-r4p3) | ✓ Mitigated |
| ASH-HERMES-007 | 5.6 MEDIUM | Missing Authentication on Hermes Agent Management Endpoints | ✓ Mitigated |
| ASH-HERMES-003 | 5.3 MEDIUM | WebUI Path Traversal via Workspace Path Manipulation | ✓ Mitigated |
| ASH-HERMES-008 | 5.3 MEDIUM | Dependency CVE: pyasn1 unbounded-exponent REAL decode DoS | ✓ Mitigated |
| ASH-HERMES-010 | 5.3 MEDIUM | Dependency CVE: pydantic-settings NestedSecretsSettingsSource symlink escape | ✓ Mitigated |
| ASH-HERMES-012 | 5.3 MEDIUM | Dependency CVE: httplib2 unbounded gzip/deflate decompression DoS | ✓ Mitigated |
| ASH-HERMES-002 | 4.8 MEDIUM | Symlink Following in File Tools _check_sensitive_path | ✓ Mitigated |
| ASH-HERMES-009 | 4.5 MEDIUM | Dependency CVE: PyNaCl bundled libsodium Ed25519 point-validation gap | ✓ Mitigated |
| ASH-HERMES-001 | 4.0 MEDIUM | Path Traversal in WeChat Work Adapter | ✓ Mitigated |
| ASH-HERMES-011 | 3.3 LOW | Dependency CVE: Pygments AdlLexer catastrophic-backtracking ReDoS | ✓ Mitigated |
Ships like a product, not a science project. Every release goes through a guarded blue/green deploy with automatic rollback, is validated across every runtime before it lands, and passes only on a genuinely healthy runtime. And because a security product must not hide its own vulnerabilities behind a green check, we publish our container-image CVE posture in full: as of v1.3.0, every container CVE with an available in-place fix is mitigated, verified against a fresh Trivy database (2026-07-15). Nothing is suppressed — the findings that remain have no upstream fix yet, and we enumerate each one with reachability analysis.
A new ref is deployed to a GREEN canary and validated by post-deploy-check.sh before the BLUE production instance is ever touched. A failed health check auto-rolls-back to the previous ref; a pre-deploy-<UTC> tag anchors every rollback. No eval, refuses to run as the prod user.
✓ Live-validated on marvin
One command runs the suite across every host over SSH and aggregates per-host PASS / FAIL / UNREACHABLE — a change is validated on every runtime (x86 + arm) before a coordinated rollout. A flaky host never aborts the sweep.
✓ Shipped
Deploys pass only when the gateway serves /status 200 and the Docker network is clean. Startup warnings are curated and documented as known-benign — a green deploy means a genuinely healthy runtime, not a suppressed one.
✓ Enforced
Alongside the OpenClaw and Hermes application-CVE registries above, we report our own container images — base OS packages and baked-in tool binaries — exactly as Trivy finds them, including items with no upstream fix. Measured against a single fresh Trivy DB snapshot (2026-07-15), v1.3.0 lands every in-place fix that exists: 516 HIGH (down from 535, −19) and 48 CRITICAL across all four images. The CRITICALs do not fall because every one of them is a Debian base-OS package marked fix: NONE upstream — there is no patched build to apply. We show that honestly rather than paint it green.
| Image | Critical | High | Status |
|---|---|---|---|
| agentshroud-gateway (v1.3.0) | 5 | 132 | ✓ HIGH −16 vs 148 — slsa-verifier rebuilt from source (19H → 3H) |
| agentshroud-openclaw (v1.3.0) | 17 | 137 | ◐ no in-place fix left — residue is Debian fix: NONE + closed-source op |
| agentshroud-hermes (v1.3.0) | 19 | 181 | ◐ HIGH −3 vs 184 (venv patch bumps) — bulk is the upstream vendored base |
| agentshroud-voice-gateway (v1.3.0) | 7 | 66 | ◐ zero fixable — every finding is Debian fix: NONE |
Trivy CRITICAL + HIGH, all four images rebuilt & rescanned against one fresh DB snapshot (2026-07-15) so the deltas are apples-to-apples. After every in-place fix, 0 fixable CRITICAL-or-HIGH findings remain — every residual has FixedVersion: (none) at the OS layer, is inside a closed-source binary (op), is a vendored sub-binary only its parent project can rebuild (falcoctl in Falco 0.44.1, latest), or is a core-dependency major/minor jump that would break an upstream-pinned agent. None is suppressed; all remain scanner-visible. Full per-CVE enumeration in docs/security/cve-mitigation-matrix.md.
gpg, openssh, git, zlib, libc6, expat, curl and base libraries. Every base image is at its latest pinned digest with apt upgrade in each package-manager stage. The residual are Debian packages marked status: affected, fix: NONE upstream — no patched build exists in the suite to apply.
✓ Mitigated where a fix exists
cosign, docker CLI, fluent-bit, Falco and Wazuh were bumped to patched releases; slsa-verifier was rebuilt from source against patched Go with extended dependency overrides (x/crypto, x/net, go-jose, otel, rekor), taking its HIGH findings 19 → 3. The 3 left are a compile-break pair (fulcio/timestamp-authority) with no in-place fix; falcoctl is a vendored sub-binary only the Falco project can rebuild.
✓ Every available in-place fix applied
The health-report scan reports every severity. .trivyignore is zeroed — the sole prior entry (CVE-2021-23358) was retired by the Wazuh 4.14.5 bump, not suppressed; a fresh no-ignorefile scan confirms it is absent. No CVE with an available fix is hidden. Accepting a known-fixable vuln in a security tool would be theater.
✓ Reported honestly
Built for regulated and OT-adjacent environments from the start.
Self-assessed alignment against publicly available framework guidance — not a certified or independently audited Security Level. Overall system rating: SL 2, with SL 3 capability reached in the specific Foundational Requirements below. See the full compliance matrix for methodology.
Self-hosted Docker stack. No external cloud dependencies.
git clone https://github.com/idallasjlabs/agentshroud.git cd agentshroud # Store credentials in your OS backend (prompts interactively) # Auto-detects: 1Password CLI → macOS Keychain → Linux secret-tool → ~/.agentshroud/secrets/ ./docker/setup-secrets.sh store # Bring up the stack — secrets are extracted ephemerally and cleaned up on exit scripts/asb up
Prerequisites
sk-ant-oat01-...asb commands
| asb up | Start the stack |
| asb down | Stop the stack |
| asb rebuild | Rebuild images and restart |
| asb status | Show container health |
| asb logs [service] | Tail logs |
| asb test | Run test suite inside gateway |
Full setup guide in the README. Works on macOS (Colima) and Linux (Docker CE).
If your team is deploying AI agents against real infrastructure, the governance gap is real. AgentShroud closes it.
Also available via GitHub Sponsors
🎙️ Introduction to AgentShroud — podcast episode