← All articles

Security

OpenClaw Security Guide: Disclosed Vulnerabilities, Risks, and Hardening Checklist

6 min read

Updated

Is the popular open-source AI agent safe to run? Learn about OpenClaw's security vulnerabilities (CVEs), default exposure risks, and how to secure your setup.

OpenClaw is one of the most popular open-source AI agents, with over 267K stars on GitHub and an active community. It interacts directly with your machine to automate workflows, manage files, browse the web, and connect to more than 20 messaging platforms.

However, out of the box, a default OpenClaw installation presents significant security risks. Because it is a powerful local-first automation tool, its default configurations can expose your host machine and sensitive data to remote exploits if left unhardened.

This guide outlines the major security issues identified in OpenClaw, including critical vulnerabilities (CVEs), and provides a step-by-step hardening checklist to help secure your deployment.

Disclosed Vulnerabilities (CVEs)

Multiple high-severity vulnerabilities have been disclosed and patched. Understanding these issues highlights the importance of maintaining an up-to-date installation.

CVE-2026-25253: Remote Code Execution via Canvas Host

  • Severity: High (CVSS 8.8)
  • Impact: A remote attacker could craft a malicious gatewayUrl to exfiltrate WebSocket tokens, gaining full remote code execution on the host machine.
  • Affected Versions: All versions prior to 2026.1.29.
  • The Fix: Update to version 2026.1.29 or later. If updating is not immediately possible, disable the Canvas Host entirely by setting OPENCLAW_CANVAS_ENABLED=false in your environment.

Other Notable CVEs

  • CVE-2026-24763 (CVSS 8.8): Docker sandbox bypass via command injection using PATH manipulation. Patched in version 2026.1.30.
  • CVE-2026-33579 (CVSS 8.1-9.8): Privilege escalation via /pair approve, allowing pairing-scope access to escalate to full administrative control. Patched in version 2026.3.28.
  • CVE-2026-26327 (CVSS 7.1): Authentication bypass on untrusted local networks via rogue service advertisements. Patched.
  • CVE-2026-28478 (CVSS 8.7): Denial-of-service vulnerability triggered by unbounded webhook buffering. Patched in the 2026.3.x release line.

The 0.0.0.0 Binding Problem

By default, OpenClaw's Canvas Host binds to 0.0.0.0:3100. This configuration tells the service to listen on every available network interface, including:

  • Localhost (127.0.0.1)
  • Your local area network (LAN) IP
  • Your public IP address
  • Docker bridge networks and VPN interfaces

For a development tool with system access, this behavior is a serious risk. On a public cloud VPS, it exposes the Canvas Host directly to the internet.

Because the Canvas Host renders UI elements and processes incoming skill payloads, public exposure combined with unpatched vulnerabilities can allow unauthorized remote access. Default installations also expose the Control UI on port 18789 without authentication.

How to Fix It

Change the bind address to localhost in your .env configuration file:

CANVAS_HOST=127.0.0.1
CANVAS_PORT=3100

If you require remote access to the web interface, route the traffic through an SSH tunnel or configure a secure reverse proxy with authentication. Never expose these ports directly to the internet.

ClawHub Skills and Supply Chain Risks

ClawHub is the repository where users share custom OpenClaw skills (integrations, automations, and pipelines).

Because skills run with the same system permissions as the primary OpenClaw process, a malicious skill can read your filesystem, access your network, and read environment variables (including API keys).

Historically, the ecosystem has faced targeted attacks:

  • The ClawHavoc Campaign: In late January 2026, security researchers identified over 340 malicious skills uploaded by a single actor to deliver keyloggers and credential stealers.
  • Catalog Audits: Broader analyses of ClawHub’s catalog have flagged packages containing dangerous patterns, including reverse shells, credential exfiltration, and obfuscated code.
  • Typosquatting & Rank Manipulation: Malicious packages have utilized names similar to popular skills or manipulated download counts to appear legitimate.

While basic verification checks (like VirusTotal hash checking) and publisher verification labels exist, manual caution is necessary.

How to Minimize Skill Risks

  1. Review the Code: Inspect the source code of any custom skill before installation.
  2. Pin Versions: Hardcode the exact versions of the skills you use in your configuration. Turn off auto-updates.
  3. Use Sandbox Mode: Enable sandbox mode (OPENCLAW_SANDBOX=true) to restrict file and network access for running skills.
  4. Audit Regularly: Periodically check installed skills for unexpected network requests or file modifications.

Unencrypted Memory Files

OpenClaw maintains context and memory across chat sessions by writing Markdown files to a local directory (defaulting to ~/.openclaw/memory/).

These files are stored in plain, unencrypted text. If you share credentials, API keys, or database connection strings during a session, they will be saved directly to these files. Any user account, script, or backup tool with access to your home directory can read this data.

How to Fix It

  1. Encrypt the Storage: Use filesystem-level encryption (such as LUKS on Linux or FileVault on macOS) or an encrypted volume container to store the directory.
  2. Manage Permissions: Limit directory permissions so only your user can read it: 
    chmod 700 ~/.openclaw/memory/
  3. Avoid Secrets in Chats: Do not paste raw passwords or API keys directly into conversations. Reference them via environment variables.
  4. Prune Regularly: Clean up old memory files that are no longer required.

Multi-Channel Attack Surface

OpenClaw supports integrations with WhatsApp, Telegram, Discord, Slack, iMessage, SMS, and other messaging services.

Connecting OpenClaw to a messaging channel allows it to process incoming text and execute tasks. Without strict access controls, anyone who can message the bot on those platforms could trigger actions on your host machine.

How to Fix It

  • Set User Allowlists: Restrict access to specific account IDs using the environment variable: 
    OPENCLAW_ALLOWED_USERS=your_user_id_here
  • Enable Channel Sandboxing: Protect public-facing or group channels by turning on sandboxing: 
    OPENCLAW_CHANNEL_SANDBOX=true
  • Reduce Connections: Only activate the integrations you actively use.

Security Hardening Checklist

Use this checklist to secure your OpenClaw deployment:

  • Update Immediately: Run version v2026.3.28 or newer to resolve disclosed CVEs.
  • Restrict Binding: Set CANVAS_HOST=127.0.0.1 in your environment.
  • Enable Sandbox Mode: Set OPENCLAW_SANDBOX=true to restrict skill permissions.
  • Audit Active Skills: Remove unnecessary or unverified ClawHub skills.
  • Pin Skill Versions: Avoid automatic updates for third-party skills.
  • Secure the Memory Directory: Encrypt ~/.openclaw/memory/ and run chmod 700 on the folder.
  • Protect Messaging Channels: Define an allowlist of user IDs (OPENCLAW_ALLOWED_USERS) and enable OPENCLAW_CHANNEL_SANDBOX.
  • Configure a Reverse Proxy: Use a proxy with built-in authentication (like Basic Auth, Authelia, or OAuth) if remote access is required.
  • Adjust Log Levels: Set OPENCLAW_LOG_LEVEL=warn to prevent sensitive payloads from writing to disk.

Conclusion

OpenClaw is a highly capable automation tool, but its default settings prioritize ease of use over security. When running a tool with system-level access, configuring proper boundaries is essential. By locking down bind addresses, auditing third-party skills, sandboxing execution environments, and protecting session memories, you can run OpenClaw safely.