| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | ≥ 2026.2.9, < 2026.2.12≤ 2026.1.5 | 2026.2.12 |
OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke privileged operations. Remote attackers on the local network or local processes can execute arbitrary browser-context actions and access sensitive in-session data by sending requests to unauthenticated endpoints.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free