Security — OpenClaw

No known compromise of OpenClaw infrastructure or of the official install and update channels.

Advisory numbers

GitHub counts reports received. Filing a report does not mean a vulnerability has been confirmed.

1,799 Reports filed Since January 2026.

58% Closed, no advisory Invalid, duplicate, or by design.

722 Fixed and published 39 carry a CVE.

14 Confirmed critical All 14 fixed and disclosed. Of 137 filed as critical, 123 were invalid, duplicate, or out of scope.

Fixes by area

33% 239 of 722 published fixes are in add-ons. Exposure depends on the affected component and your configuration; some add-ons are enabled by default.

Grouped by advisory title.

Latest advisory Sep 11, 2026

Updated Sep 11, 2026

Source GitHub advisories

Ongoing work

[**Skill scanning**
Static analysis, VirusTotal, and NVIDIA SkillSpector check every ClawHub skill version before listing.
How ClawScan works](/content/blog/openclaw-nvidia-skill-security/index.html)
[**Open scan dataset**
67,453 skill scans published on Hugging Face, with research on scanner disagreement.
Dataset](https://huggingface.co/datasets/OpenClaw/clawhub-security-signals)
[**Install blocking**
ClawHub blocks installation of skills it marks malicious or quarantined.
Moderation](https://docs.openclaw.ai/clawhub/moderation)
[**fs-safe**
Root-bounded file access shared by core and plugins.
Read more](/content/blog/where-openclaw-security-is-heading/index.html)

[**Exec approvals**
Full command-chain checks. Opt-in Auto mode reviews low-risk approval misses.
Safer than YOLO](/content/blog/safer-than-yolo-auto-mode-for-exec-approvals/index.html)
[**Proxyline**
Outbound traffic through a proxy you control, with egress policy in one place.
Network proxy](https://docs.openclaw.ai/security/network-proxy)
[**Regression rules**
OpenGrep rules from patched advisories run on every PR alongside CodeQL.
Static analysis](/content/blog/where-openclaw-security-is-heading/index.html)
[**Extended-stable channel**
A slower release channel, with a public maturity scorecard for every feature.
Release channels](/content/blog/extended-stable-releases-and-maturity-scorecards/index.html)

Write-ups

All posts related content



Jun 1, 2026 OpenClaw Collaborates with NVIDIA for Stronger Agent Skill Security \

Every ClawHub skill now ships with a Skill Card showing what it does and where it came from, and SkillSpector scans it for hidden instructions and agentic risks

Vincent KocPatrick Erichsen](/content/blog/openclaw-nvidia-skill-security/index.html)

Outside research

NVIDIA June 2026
Verified agent skills \ SkillSpector, Skill Cards, and NVIDIA engineers on the security triage rota.\ Read the article](https://developer.nvidia.com/blog/nvidia-verified-agent-skills-provide-capability-governance-for-ai-agents/)
GitHub 2026
Secure Open Source Fund \ OpenClaw joined a cohort of 67 projects.\ Read the article](https://github.blog/open-source/maintainers/securing-the-ai-software-supply-chain-security-results-across-67-open-source-projects/)

Report a vulnerability

Report unpatched vulnerabilities privately, never in a public issue or PR. Read the full policy

Core, apps & installers Private report on GitHub openclaw/openclaw
ClawHub Private report on GitHub openclaw/clawhub
Anything else security@openclaw.ai

Help us reproduce it

Version & code Affected release or commit, and the file and function if known.

Reproduction Steps that reproduce the issue on the latest release or main.

Impact What an attacker gains and which trust boundary is crossed.

Patch Include a fix if you have one.

Copy report template

After you report

Maintainers, including security engineers from NVIDIA and Tencent, triage reports.

Duplicates The earliest complete report takes priority.

Credit Named in the published advisory.

Bounty No paid bounty program.

Outside scope

OpenClaw assumes one trusted operator running multiple agents per gateway, not a shared multi-tenant service. Under this model, these are not security vulnerabilities by themselves: