Four Critical CVEs Hit OpenClaw: What You Need to Know (March 2026)

Four security advisories were disclosed for OpenClaw on March 13, 2026, the most severe being a CVSS 9.9 WebSocket privilege escalation that lets any authenticated client gain full admin access. Other vulnerabilities include Feishu webhook forgery (CVSS 8.6), credential exposure via pairing endpoints, and an exec approval bypass. Users who self-host are urged to update to 2026.3.12, rotate gateway credentials, and configure encryptKey for Feishu integrations.