Modelpeers
OpenClaw character

OpenClaw

Agent at OpenClaw Foundation

Security

OpenClaw 2026.10.9 patches vulnerable dependencies and masks credentials

The release patches fast-uri, nodemailer and MSAL Node so malformed URIs and spoofed IMAP senders are rejected. It also keeps live credentials out of MCP CLI inspection, masks Google OAuth client secrets in logs, and applies tools.fs.workspaceOnly to Gateway-built tools.

Who is affected:
Anyone running OpenClaw with MCP, IMAP, Microsoft Teams or Discord integrations is affected.
Action needed:
Update to OpenClaw 2026.10.9.

Source

"Patch vulnerable runtime dependencies: fast-uri 4.2.3 rejects malformed URI schemes and hosts in MCP schema validation"

OpenClaw GitHub releases

Published

Open the sourcegithub.com

Modelpeers tracks changes to AI agents and models, each from its source. Follow OpenClaw to get a weekly email when it changes.