OpenClaw recently had 9 security vulnerabilities disclosed in just 4 days, including one rated 9.9 out of 10 (Critical). Combined with the Axios supply chain attack, OpenClaw owners should take 10 minutes to run this health check.
Between March 18 and 21, 2026, security researchers disclosed 9 OpenClaw CVEs in just 4 days. Then on March 31, the Axios supply chain attack was revealed. Here's the full list.
| CVE ID | CVSS | Description | Fixed In |
|---|---|---|---|
| CVE-2026-22172 | 9.9 | WebSocket connections can self-declare admin privileges | 2026.3.12 |
| CVE-2026-32051 | 8.8 | operator.write privilege escalation to owner | 2026.3.1 |
| CVE-2026-22171 | 8.2 | Lark media download path traversal | 2026.2.19 |
| CVE-2026-32025 "ClawJacked" |
7.5 | Browsers can brute-force the local gateway | 2026.2.25 |
| CVE-2026-32048 | 7.5 | Sandbox escape — child processes don't inherit restrictions | 2026.3.1 |
| CVE-2026-32049 | 7.5 | Oversized media payload DoS | 2026.2.22 |
| CVE-2026-32032 | 7.0 | Untrusted SHELL environment variable | 2026.2.22 |
| CVE-2026-29607 | 6.4 | allow-always wrapper bypass | 2026.2.22 |
| CVE-2026-28460 | 5.9 | Allowlist bypass via shell newline characters | 2026.2.22 |
1.14.1 and 0.30.4 were backdooredplain-crypto-js packageGo through each item and check them off as you go. Your progress is automatically saved in your browser.
Version ≥ 2026.3.12 patches all 9 vulnerabilities.
openclaw --versionnpm update -g openclawCVE-2026-32025 allows browsers to brute-force an exposed gateway.
// Check gateway.bind in openclaw.json
{
"gateway": {
"bind": "loopback" // ← verify this
}
}"loopback" or "127.0.0.1""0.0.0.0" or not set"bind": "loopback"; use Tailscale or SSH tunnel for remote accessPassword mode is vulnerable to brute-force attacks.
// Check gateway.auth.mode
{
"gateway": {
"auth": {
"mode": "token" // ← verify this
}
}
}"token""password""mode": "token"Prevent strangers from triggering your Agent.
// Check channels.telegram settings
{
"channels": {
"telegram": {
"dmPolicy": "allowlist",
"allowFrom": ["your Telegram ID"]
}
}
}dmPolicy: "allowlist" + allowFrom configureddmPolicy: "open" or no allowFrom in groupsallowFrom restrictions — only allow your own IDCVE-2026-28460 and CVE-2026-29607 can bypass command approval.
// Check tools.exec.security
{
"tools": {
"exec": {
"security": "allowlist" // ← verify this
}
}
}"allowlist""full""security": "allowlist"Prevent the Agent from reading or writing critical system files.
// Check tools.fs.workspaceOnly
{
"tools": {
"fs": {
"workspaceOnly": true // ← verify this
}
}
}truefalse or not set"workspaceOnly": trueMalicious Axios versions install a RAT trojan.
# Check axios version
npm list axios | grep -E "1.14.1|0.30.4"
# Check for malicious package
ls node_modules/plain-crypto-js
# Check for RAT (macOS)
ls /Library/Caches/com.apple.act.mond
# Check for RAT (Linux)
ls /tmp/ld.pyAll the key settings in one table. Green = safe, Red = dangerous.
| Setting | ✅ Safe Value | ❌ Dangerous Value |
|---|---|---|
| Version | ≥ 2026.3.12 | < 2026.3.12 |
| gateway.bind | loopback | 0.0.0.0 |
| gateway.auth.mode | token | password |
| telegram.dmPolicy | allowlist | open |
| tools.exec.security | allowlist | full |
| tools.fs.workspaceOnly | true | false |
| axios version | ≠ 1.14.1, 0.30.4 | 1.14.1 or 0.30.4 |
Don't panic — follow these steps in order.
@BotFather)npm update -g openclawIf you find traces of the malicious Axios version (RAT files exist), your machine may have been fully compromised. Beyond the steps above, you should also check whether any keys, passwords, and tokens stored locally have been exfiltrated.
For a deeper dive into the vulnerabilities, check out these resources.