OpenClaw Gateway Security Audit Runbook: Official Checks

An OpenClaw deployment is not secured merely because it runs on your machine. It can be operated with a sensible risk boundary, but that boundary has to be designed: who can reach the Gateway, which agent they can trigger, what tools it can use, which files it can read, and whether it can reach browsers, nodes, credentials, or other conversations.

The official OpenClaw trust model supports one trusted operator or one mutually trusting team per Gateway. It does not support a shared Gateway for mutually untrusted or adversarial users. That is the starting point for every security decision in this article.

As checked on September 13, 2026, the repository shows OpenClaw 2026.9.3 as the latest core release reviewed here. It was released on September 8 and adds safer update rehearsal and recovery. That is useful operational work, but it is not a universal security guarantee for every plugin, client, browser profile, or configuration.

Start with the trust boundary

Everyone who can message a tool-enabled agent shares that agent's delegated authority. OpenClaw also documents Gateway-wide session visibility and agent-to-agent messaging as defaults. An unsandboxed agent with the relevant tools may therefore list, read, search, or message other agents' sessions, including transcripts belonging to other users. Those settings can be narrowed, but they are not tenant isolation.

The repository's security policy makes the same distinction. Prompt injection without a policy, authentication, approval, sandbox, or tool-boundary bypass is generally outside vulnerability triage. So is a malicious plugin that a trusted operator deliberately installs, or a deployment that puts a trusted Gateway on the public internet. Those reporting rules describe what maintainers will treat as a product vulnerability. They do not make the operational risk harmless.

If two users do not trust each other, give them separate Gateways and preferably separate operating-system users or hosts. If they do share a Gateway, treat the whole installation as one trust cell. Operator roles, session ownership, and labels can improve coordination, but they should not be sold as a hostile multi-tenant boundary.

A version map, not one safe floor

The most useful current advisory records are specific about both the affected path and the fix. They do not support a single statement such as install version 2026.1.29 and stop worrying.

This is a focused map of boundaries relevant to everyday deployment, not a complete advisory inventory. The repository advisory index currently lists additional records covering other channels, file transfers, provider routing, diagnostics, and workspace paths. Check the package and feature you actually run.

The local-installation advisory also deserves careful reading because its affected range is unusual. Preserve the record's exact wording rather than silently converting it into a broader claim about all releases. The practical lesson is clearer than the version arithmetic: installing an untrusted local plugin or hook is an execution event and needs its own review boundary.

One older security narrative names CVE-2026-25253 and attributes large supply-chain figures to it. The opened repository record is issue 16052, opened February 14, 2026 and marked closed as not planned. It contains a reporter's claims, not an official OpenClaw advisory. No authoritative source opened for this article establishes those figures, so they should not be presented as confirmed facts.

What remains risky after patching

Content can be hostile even when the sender is trusted

A web page, email, document, attachment, pasted log, or code sample can carry instructions aimed at the model. The official prompt-injection guidance treats the content itself as a threat surface. A trusted user forwarding a poisoned document does not turn that document into a trusted policy.

For an agent that reads untrusted material, keep web_search, web_fetch, and browser access off unless the workflow needs them. Use a strong current model for tool-enabled work, keep secrets out of prompts, and treat content wrapping or token sanitization as narrow mitigations. None of these replaces sender allowlists, approvals, sandboxing, or a small tool set.

Permissions are layered, and approvals are not isolation

DM-capable channels default to pairing. Unknown senders are ignored until approved. An explicit allowlist is tighter; an open policy requires an explicit wildcard allow entry. Groups need their own membership, allowlist, and mention-gating decisions. The access-control documentation gives these modes different meanings, so do not treat a pairing code as a general authorization system.

For an agent that handles untrusted content, OpenClaw recommends denying control-plane and delegation tools such as gateway, cron, sessions_spawn, and sessions_send unless they are necessary. A paired node can invoke system.run on its host, which the documentation describes as remote code execution on that Mac. Plugins run in-process with the Gateway and should be treated as trusted code.

Exec approvals add a policy, allowlist, and optional user-confirmation layer. They reduce accidental execution, but they are not per-user authentication or a read-only filesystem. The 2026.8.1 advisory supplies a concrete failure case: an operator reviews a command in repository A, grants an allow-always approval, and the same command later runs in repository B. Upgrade OpenClaw and paired native execution clients, then review standing approvals for commands whose behavior depends on the working directory.

The WhatsApp advisory shows the same principle on a different surface. A non-owner message did not need to take over the account directly; it only needed to reach a login tool that should have remained owner-only. If WhatsApp login is not part of normal operation, disable the tool after setup. If it is needed, keep it reachable only from owner-controlled conversations and update the package.

Network exposure and browser control enlarge the cell

The Gateway normally listens on loopback and multiplexes HTTP and WebSocket traffic on port 18789. Authentication fails closed when no valid path is configured. A non-loopback bind still needs authentication and a real firewall, and the documentation explicitly warns against unauthenticated exposure on 0.0.0.0.

The exposure runbook recommends the narrowest pattern that fits the job: loopback with SSH for administration, loopback with Tailscale Serve for personal tailnet access, or a private bind with firewall controls. Direct public port-forwarding should not be the default design. Before opening access, be able to answer who can reach the Gateway, how they authenticate, which agents they can trigger, and which tools those agents can use.

Browser control is effectively operator access to the selected profile. Use a dedicated agent profile, not a daily-driver browser containing personal accounts, passwords, or active sessions. Keep browser and node hosts tailnet-only where possible. OpenClaw's browser SSRF policy blocks private and internal destinations by default, but the docs describe the protection as request-level interception rather than a complete network firewall. Use owner-side egress controls or a policy-enforcing proxy when that distinction matters.

The Browser Relay advisories make this concrete. An old relay path lacked the expected token check, and a later release fixed a denial-of-service condition in the pending-authentication pool. Neither finding proves that every browser deployment is affected, but both show why the relay route, extension version, browser profile, and network reachability belong in the same review.

Extensions, skills, and stored state are part of the attack surface

ClawHub scanning covers many known patterns, and optional LLM or VirusTotal checks can add signal. The official threat model still describes the scanning as pattern-based, notes that optional checks depend on configuration, and says an installed skill has no runtime sandbox separating it from the agent's privileges. A badge is not a proof of safe behavior.

Review plugin and skill source before enabling it, prefer explicit trusted plugin IDs and pinned versions, and use the installation policy to warn or block sources you have not approved. The local-installation advisory shows why npm install --ignore-scripts by itself is not a complete answer: a project-level npm configuration could still affect the Git executable used during dependency resolution.

Credentials and transcripts need the same care as code. OpenClaw state can include channel tokens, model authentication, MCP OAuth sessions, private messages, file contents, command output, and URLs. The storage guidance recommends 700 permissions on directories, 600 on files, full-disk encryption, and a dedicated operating-system user where the host is shared. Credential variables are blocked from untrusted workspace dotenv files, but that does not eliminate the need to protect the Gateway process and its state directory.

A small operational baseline

Before exposing a channel or remote interface, inventory the core version, relevant plugin packages, paired native clients, enabled nodes, browser profiles, credentials, tool policy, sandbox mode, and backup location. Then run the documented baseline checks:

openclaw doctor
openclaw security audit
openclaw security audit --deep
openclaw health

Resolve critical findings first. For a lower-trust messaging agent, a reasonable starting shape is loopback binding with token authentication, per-channel-and-peer session scope, non-main sandboxing, the messaging tool profile, denied exec, and elevated mode disabled. Adjust that shape only when the workflow requires more authority, and record why the exception exists.

After an update, verify the local runtime and relevant clients rather than relying on a release page. OpenClaw 2026.9.3 documents isolated candidate state for core and plugin changes, but a release note is not proof that a particular machine updated successfully or that a third-party plugin is safe.

If compromise is suspected, stop the Gateway, close remote exposure, disable risky DMs and wildcard allow entries, rotate Gateway and remote-client secrets, then rotate provider and channel credentials. Review logs, transcripts, configuration changes, and plugin state before rerunning the deep audit. The incident-response guidance treats rotation as necessary when secrets may have leaked, not as an optional cleanup step.

Who should use this model?

For a personal operator or a mutually trusting team, OpenClaw can be a practical choice when the Gateway stays private, tools are narrow, browser state is dedicated, extensions are reviewed, and updates have a recovery path. The cost is operational discipline.

For adversarial users, public users, or tenants that need real isolation, use separate Gateways and preferably separate OS users or hosts. Put identity-aware access in front of any rare public deployment, keep the agent sandboxed, and treat every enabled browser, node, plugin, and channel as an explicit expansion of the trust cell.

The useful conclusion is not that one OpenClaw version makes an installation safe. It is that security comes from matching identity, authority, software version, and recovery procedure to the people and content the Gateway will handle. Patch the relevant component, narrow the authority, and assume the model can be manipulated. The remaining risk is then visible enough to manage.

Sources

• OpenClaw security trust model and MITRE ATLAS threat model
• Access control and allowlists, tool and agent permissions, and exec approvals
• Network exposure, browser control risks, and the Gateway exposure runbook
• Secrets, storage, and logs and operator incident response
• OpenClaw 2026.9.3 release, the security advisory index, and the linked advisory records above