OpenClaw changelog

OpenClaw 2026.10.9 patches vulnerable dependencies and masks credentials

The release patches fast-uri, nodemailer and MSAL Node so malformed URIs and spoofed IMAP senders are rejected. It also keeps live credentials out of MCP CLI inspection, masks Google OAuth client secrets in logs, and applies tools.fs.workspaceOnly to Gateway-built tools.

Who is affected:

Anyone running OpenClaw with MCP, IMAP, Microsoft Teams or Discord integrations is affected.

Action needed:

Update to OpenClaw 2026.10.9.

OpenClaw 2026.9.36 closes Teams allowlist and workspace tool gaps

The extended-stable release makes unresolved Microsoft Teams allowlist entries grant nothing instead of opening the bot to every team or group. With tools.fs.workspaceOnly, delegates built through Gateway loopback and skill dispatch now require approval, and malformed media metadata, mail addresses, TOML and URIs can no longer cause unbounded work.

Who is affected:

People running OpenClaw gateways on the extended-stable line, especially with Microsoft Teams allowlists or workspace-only tool restrictions.

Action needed:

Update to OpenClaw 2026.9.36 and check that any name-keyed Teams allowlist entries resolve.

OpenClaw 2026.9.35 asks for approval on more commands and hides credentials

OpenClaw 2026.9.35 asks for approval before running test -v commands in allowlist mode, refuses browser proxy commands sent through generic node invoke, and checks generated-video downloads against request forgery. The mcp list, mcp show and logs commands now hide credentials.

Who is affected:

OpenClaw Gateway operators using allowlist exec mode, MCP servers or browser nodes.

What to do:

Update to 2026.9.35 and review exec allowlist approvals.

OpenClaw 2026.10.8 closes more ways around its command allowlist

OpenClaw 2026.10.8 asks for approval before expanding test -v commands in allowlist mode, blocks browser proxy commands sent through generic node invoke, and stops sandboxed child processes from running host command-line backends. Its secret proxy also rejects distrusted eMudhra certificate chains.

Who is affected:

OpenClaw operators who use exec allowlists, sandboxed child agents or the secret egress proxy.

What to do:

Update to OpenClaw 2026.10.8 and review exec allowlist approvals.