OpenClaw publishes a batch of high-severity security advisories
Published a batch of high-severity security advisories — missing admin authorization on model overrides, plugin-install policy bypass, exposure of owner-only tools via MCP loopback, remote symlink following in mirror sync, and more
Why it matters
Reveals that the agent runtime's permission boundaries were imprecise on every front
Source — Primary sources first; secondary reports are labelled “Press”
Officialgithub.comhttps://github.com/openclaw/openclaw/security/advisoriesAdded in Week 35, 2026 · See that week