Security incidents, vulnerabilities, and advisories
173 articles
openclaw/openclaw released version v2026.9.6. This release includes breaking changes. Key updates: Updates: complete managed Gateway upgrades after Node.js installation paths change, and let normal Doctor, finalization, and post-core plugin work finish without implicit deadlines. (#145335, #15297...
openclaw/openclaw released version v2026.7.35. This release includes breaking changes. Key updates: **Security and credential safety:** harden command parsing, browser origin checks, plugin Git installs, diagnostics, service credentials, and webhook logging across Gateway and official plugins.; *...
openclaw/openclaw released version v2026.7.33. Key updates: **Security and credential safety:** harden command parsing, browser origin checks, plugin Git installs, diagnostics, service credentials, and webhook logging across Gateway and official plugins.; **Message and session integrity:** preser...
openclaw/openclaw released version v2026.9.4. This release includes breaking changes. Key updates: **Recover from compatible failed updates:** retain the previous package and restore it with the previous configuration and service when schema and configuration checks prove rollback is safe; databa...
openclaw/openclaw released version v2026.6.35. Key updates: **Safer provider and channel boundaries:** bundled providers and channel adapters now bound untrusted response bodies, reject oversized inputs before expensive work, and preserve safe recovery when transports fail. (#119942) Thanks @Romn...
openclaw/openclaw released version v2026.8.1. This release includes breaking changes. Key updates: **Find past conversations:** search visible conversation text by exact words or phrases and reopen the surrounding messages from a matching result. (#105057, #105635, #105585) Thanks @hercial61.; **...
openclaw/openclaw released version v2026.9.1-beta.1 (pre-release). Key updates: **Gateway restart recovery:** preserve admitted turns across repeated Gateway restarts so restart-safe runs continue through each checkpoint and deliver their final response. (#130491) Thanks @jalehman.; **Gateway con...
openclaw/openclaw released version v2026.8.1-beta.2 (pre-release). This release includes breaking changes. Key updates: **Secret egress host binding:** bind each shared-store secret to exact HTTPS destination hosts across CLI, Gateway RPC, and Control UI so unbound sentinel substitution fails clo...
openclaw/openclaw released version v2026.6.34. This release includes breaking changes. Key updates: **Safer browser and network boundaries:** sandboxed browser routes, trusted DNS targets, custom browser origins, and loopback provider endpoints now reject unsafe access paths. (#97958, #38290, #10...
openclaw/openclaw released version v2026.7.2-beta.7 (pre-release). Key updates: **State safety and recovery:** protect persisted data with a quarantine store that survives primary-database damage, crash-recoverable SQLite snapshots, crash-durable filesystem publication, schema-upgrade data-loss r...
