OpenClaw Security Advisories: 1,799 Reports, 14 Critical Flaws

A security ledger for the fastest-growing repo on GitHub

OpenClaw, the open-source AI assistant platform, has published a public accounting of its security workload. Since January 2026 the project has received 1,799 vulnerability reports 1. Of those, 58% were closed without an advisory because they were invalid, duplicates, or described intended behavior 1. Another 722 led to fixes with published advisories, and 39 of those advisories carry a CVE identifier 1. Fourteen issues were confirmed as critical, and the project says all 14 have been fixed and disclosed 1.

The page also reports no known compromise of OpenClaw's infrastructure or of its official install and update channels 1. That coverage is limited to the core project, its apps, and hosted installers. Third-party skills distributed through ClawHub are explicitly excluded 1.

The volume makes more sense once you account for OpenClaw's popularity. GitHub calls it the fastest-growing project in the platform's history and has profiled the maintainers working to build and secure it 3. ARMO puts its star count above 340,000 2. A project with that much attention draws a matching amount of scrutiny, from careful researchers as well as low-effort submitters.

The bug that shows the stakes

One disclosure shows what a confirmed critical issue looks like in practice. CVE-2026-32922 was published on March 29, 2026, and scores 9.9 under CVSS 3.1 and 9.4 under CVSS 4.0 2. ARMO, a cloud security vendor, describes it as one of the most severe vulnerabilities disclosed in the cloud-native ecosystem this year 2.

The flaw sits in a function called device.token.rotate. That function did not limit the scopes of a newly issued token to the scopes the caller already had 2. As a result, a client holding only the narrow operator.pairing scope could request a rotation and get back a full operator.admin token 2. ARMO says that from there, remote code execution on every connected node is a single API call away 2.

This is a classic authorization mistake. Its impact is amplified because OpenClaw is designed to sit at the center of a fleet of connected machines. A pairing credential is the kind of low-privilege token that tends to be handed out widely, so a bug that turns it into admin access is serious.

Reading the numbers

The headline figures support two readings.

The pessimistic reading treats roughly 1,800 reports in about seven months as a sign of strain. A project growing this fast may be shipping attack surface faster than it can review it, and 14 confirmed criticals in that window is not trivial.

The more generous reading looks at the ratios. Of 137 reports filed as critical, 123 were invalid, duplicates, or out of scope 1. That means fewer than one in nine self-described critical reports held up. Overall, a majority of reports produced no advisory at all 1. On these numbers, the raw count says as much about how many people are probing OpenClaw, and how loosely some of them label severity, as it does about the code's actual quality. The fact that only 39 of 722 published fixes carry a CVE 1 suggests most confirmed issues were minor enough not to warrant one.

The disclosure process itself is a point in the project's favor. OpenClaw publishes its triage numbers, credits reporters by name in advisories, and gives priority to the earliest complete report when duplicates arrive 1. It also says security engineers from NVIDIA and Tencent are among the maintainers doing triage 1. That is a level of corporate involvement many volunteer-run projects never get.

Where the fragility really lies

On this analysis, the advisory count is not where the fragility shows. It shows in the structure around that count.

• No paid bounty. OpenClaw does not run a paid bug bounty 1. Its triage team therefore absorbs a flood of reports without the filtering that payment rules and reputation systems tend to provide. Skilled researchers also have less incentive to prioritize the project.
• Excluded ecosystem. The security page's scope leaves out ClawHub skills 1. For an assistant platform, extensions are often where untrusted code meets privileged access. A clean core does not mean users are safe.
• Concentrated triage. Reports are sorted by a group of maintainers, some on loan from large companies 1. That arrangement works while those companies stay engaged, and it could become a weak point if their priorities change.

GitHub's open-source coverage puts OpenClaw alongside items such as a $100 million commitment to open source 3. The broader industry is paying attention to how critical projects get sustained. OpenClaw's transparency page is a useful model. Still, growth on this scale probably needs funded, durable security capacity, not only a well-organized inbox, and that requirement goes beyond OpenClaw itself.