Skip to content

OpenClaw operator, browser, and channel boundary batch (GHSA)

Signal: GitHub Security Advisories REST fallback surfaced a 2026-05-05 OpenClaw batch of refreshed advisories where approval binding, plugin provenance, browser/network policy, media handling, channel callbacks, runtime configuration, and sandbox routing all required final trust-boundary checks.

Advisories in this batch

Why this is durable

Agent systems mix user-controlled workspaces, operator-owned configuration, browser/session state, channel messages, local files, and helper processes. The common failure mode is assuming an earlier policy decision still applies after routing through queues, plugins, browser tabs, media normalizers, filesystem helpers, or command wrappers. Durable defense means every privileged sink re-verifies who asked, from where, under which policy, and for which exact resource.

Immediate triage

  1. Upgrade OpenClaw to a release containing the May 2026 boundary fixes, prioritizing deployments with browser automation, channel bots, voice, ACP/subagents, operator.write surfaces, or workspace plugins enabled.
  2. Review trust-bearing queues and callbacks: heartbeat webhook wakes, collect-mode batches, Teams SSO invokes, agent-hook events, and channel setup flows should preserve sender identity and downgrade untrusted input before enqueueing.
  3. Audit browser and media egress: look for private-network browser navigation, existing-session browser actions, tab close/select operations, QQBot/Discord media fetches, and screenshots/snapshots taken after navigation to internal pages.
  4. Inspect workspace-controlled config: search .env, provider/auth choices, plugin catalogs, and operator-write-accessible settings for attempts to redirect runtime controls, providers, memory dreaming, Matrix profiles, or connector-like behavior.
  5. Recheck command/sandbox logs: flag busybox/toybox applet execution, env-argv assignments, preflighted scripts modified between approval and execution, and any sandboxed task that supplied host=node.

Hunt ideas

  • Query Gateway/browser logs for navigation to RFC1918, loopback, link-local, metadata, or internal DNS names from existing-session browser routes.
  • Diff channel-event sender IDs against the authorization context used when queue batches, hooks, or callbacks were processed.
  • Search media fetch logs for file:, loopback, internal hostnames, unusually large uploads, or re-uploaded bytes from reply text / event cover URLs.
  • Grep workspaces for OPENCLAW_, provider, runtime, browser, gateway, connector, Matrix, memory, or plugin variables in .env and generated dotenv files.
  • Compare approval prompts to executed argv after shell wrapper, applet, and env-assignment normalization.

Durable controls

  • Deny empty allow/approver lists by default; never let missing policy mean “everyone.”
  • Keep operator-owned configuration and plugin provenance separate from workspace-controlled files.
  • Apply SSRF policy at each URL-consuming sink, including existing browser sessions, tab operations, media downloads, and screenshots/snapshots.
  • Bind queued work to immutable sender, channel, owner, and policy context; downgrade untrusted webhooks before they can create trusted system events.
  • Normalize commands to final argv before approval and again before execution; reject wrappers, applets, env assignments, and TOCTOU changes that alter the approved operation.
  • Cap realtime frame sizes and redact config through a single canonical path rather than alias-specific filters.

Operator lesson

For agent runtimes, every convenience bridge is a trust-boundary bridge. Treat browser sessions, channel media, .env, plugin catalogs, queued events, and shell wrappers as attacker-controlled until the final privileged sink proves otherwise.