What happened
NVD published a large cluster of OpenClaw security advisories on 2026-09-26 (GHSA-rrxp-5mx8-mvhh, GHSA-8xxh-v4vc-qvm4, GHSA-p3h6-v2h4-36q2, plus ~20 more covering MCP config persistence, sandbox.tools.deny bypass, Codex app-server tool policy bypass, channel allowlist bypasses, memory/dreaming owner-check gaps, and memory-tool policy retention). All stem from incomplete enforcement of owner-only / per-sender authorization and sandbox policy in an agent gateway that connects untrusted external channels to powerful host-level tools.
Why it matters
OpenClaw is a canonical 'bring your own agent' gateway that translates messages from public chat/voice channels into file, shell, browser and cron actions on the host. The batch shows multiple independent ways a non-owner remote caller (or a prompt-steered agent) can reach owner-only or sandbox-denied capabilities — a cluster of agent-authorization bypasses with real RCE/credential-exposure potential across the deployment.
Attack vector
Representative vectors: (100544) remote voice caller admitted by inbound-call policy drives owner-only tools because caller identity/non-owner status is not propagated; (100580) mixed-case payload in the model-facing cron tool bypasses the shell-execution guard and persists an attacker-selected command as the gateway process user; (100567) check-then-use DNS gap in remote CDP hostname validation enables DNS-rebinding SSRF to loopback/private/metadata addresses.
Affected systems
OpenClaw — npm package 'openclaw' and channel packages; fixed in 2026.7.1 / 2026.8.1 / 2026.9.2 depending on the issue.
Mitigation
Upgrade openclaw to 2026.8.1 (and channel packages to 2026.8.1; Discord voice race fixed in 2026.9.2). Disable dreaming/memory-recall where unused; restrict MCP stdio configs (/mcp set) to the owner; disable hostname-based remote CDP endpoints or pin/trust them.