OpenClaw Disclosed 10 GitHub Security Advisories on September 11. Two Are Rated High Severity. Read Them Before the Next Patch Window.

joshavant published 10 new GHSAs on Sep 11, 2026. Two are rated High: exec approvals that outlive their reviewed working directory (GHSA-3mq7-q27j-mq7q) and the WhatsApp login tool reachable from non-owner turns (GHSA-9m4p-cqp4-jppq). The eight Moderate advisories cover Prometheus, Discord uploads, iOS deep-link logging, Browser relay DoS, OpenAI-compatible credential misrouting, Unicode workspaceOnly escape, file-transfer approval widening, and Slack file-download fail-open. Patched versions are spread across 2026.8.1, 2026.8.2, 2026.8.11, and 2026.9.3 — so 'latest' alone is not enough. Two advisories require explicit credential rotation. Documentation comparison; no patched version was installed.

<h1>OpenClaw Disclosed 10 GitHub Security Advisories on September 11. Two Are Rated High Severity. Read Them Before the Next Patch Window.</h1>

OpenClaw's maintainer joshavant published 10 new GitHub Security Advisories on September 11, 2026. Two are rated High: <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-3mq7-q27j-mq7q">GHSA-3mq7-q27j-mq7q</a> (reusable exec approvals outliving their reviewed working directory) and <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq">GHSA-9m4p-cqp4-jppq</a> (the WhatsApp login tool reachable from non-owner turns). The other eight are Moderate. The patched versions are spread across four releases — 2026.8.1, 2026.8.2, 2026.8.11, and 2026.9.3 — so upgrading to "the latest" alone is not enough. You need to know which advisory is patched in which version to plan the upgrade correctly.

This is the largest OpenClaw advisory batch on the public GitHub advisories page since the project moved to monthly LH-/stable channels. If you run OpenClaw anywhere — single-user laptop, multi-tenant consumer product, internal agent infrastructure — you need to read the advisory summaries, match them against your deployment, and rotate any standing grants that the advisories say to recreate.

<h2>What happened</h2>

On September 11, 2026, the OpenClaw maintainer joshavant published ten security advisories to the project's GitHub Security Advisories page (<a href="https://github.com/openclaw/openclaw/security/advisories">openclaw/openclaw security advisories</a>). The publication cadence is unusual: OpenClaw's advisory history shows batches of one to four per disclosure window. Ten in a single day is a coordinated post-release disclosure — almost certainly tied to the v2026.9.3 → v2026.9.4 release sequence that ran September 8–11.

The batch spans four patched versions and five subsystems:

<ul> <li>Approval system (HIGH): <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-3mq7-q27j-mq7q">GHSA-3mq7-q27j-mq7q</a> — reusable exec approvals match command arguments without binding cwd. The same allow-always approval can later run in a different directory against files the operator never reviewed. Patched in 2026.8.1.</li> <li>Channel: WhatsApp (HIGH): <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq">GHSA-9m4p-cqp4-jppq</a> — the WhatsApp login tool exposed through the generic channel-tool path without preserving the owner-only boundary. A non-owner turn could request a forced login and receive a QR code for the configured account. Patched in 2026.8.1.</li> <li>Provider transport (MODERATE): <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9">GHSA-vhpg-cq3w-v8p9</a> — OpenAI-compatible transport could send provider credentials to the wrong endpoint after a model hot reload. Patched in 2026.8.1. Operators who saw misleading auth errors should rotate the credential.</li> <li>Filesystem boundary (MODERATE): <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5rx7-34fw-64qg">GHSA-5rx7-34fw-64qg</a> — Unicode normalization could escape workspaceOnly roots when canonically equivalent sibling directories coexist on the filesystem. Patched in 2026.8.1. No symlink or hardlink required.</li> <li>Prometheus diagnostics (MODERATE): <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-rx8p-qcpv-c7vr">GHSA-rx8p-qcpv-c7vr</a> — the Prometheus diagnostics plugin did not enforce <code>operator.read</code> on its metrics endpoint. Patched in 2026.9.3.</li> <li>Channel: Discord (MODERATE): <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-xvwp-wmh2-fq48">GHSA-xvwp-wmh2-fq48</a> — Discord emoji and sticker upload actions could load a local file outside the sender's media-roots allowlist. Patched in 2026.9.3.</li> <li>iOS client (MODERATE): <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295">GHSA-5j57-84cx-r295</a> — OpenClaw for iOS logged the complete unattended-agent deep-link URL as public diagnostic data, potentially leaking a persistent bearer key. Patched in 2026.8.11. Affected deep-link keys must be rotated.</li> <li>Browser extension relay (MODERATE): <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-m78m-7h3q-q938">GHSA-m78m-7h3q-q938</a> — Browser extension relay reserved entries in a global pending-auth pool before client key possession was proven, enabling denial of service from an unauthenticated network source. Patched in 2026.8.2.</li> <li>File-transfer approvals (MODERATE): <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-7jfq-rmfm-29wp">GHSA-7jfq-rmfm-29wp</a> — file-transfer allow-always approvals could preserve more authority than reviewed (literal path chars later interpreted as globs; node grants reused by a same-name node). Patched in 2026.8.1.</li> <li>Channel: Slack (MODERATE): <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hh-7676-rg67">GHSA-v7hh-7676-rg67</a> — Slack download-file authorization could fail open when file share metadata was missing. Patched in 2026.8.1.</li> </ul>

Two advisories are explicit "rotate now" instructions: <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9">GHSA-vhpg-cq3w-v8p9</a> (rotate any third-party OpenAI-compatible provider credential that may have been disclosed to the wrong endpoint) and <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295">GHSA-5j57-84cx-r295</a> (rotate unattended deep-link keys that may appear in affected iOS diagnostics).

<h2>What actually changed</h2>

Three of the ten advisories are operationally load-bearing in ways that affect what "OpenClaw as deployed" means today.

<h3>1. The exec approval scope is now cwd-bound, not command-bound</h3>

<a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-3mq7-q27j-mq7q">GHSA-3mq7-q27j-mq7q</a> is the change that should change your behavior. Before the fix, a reusable exec approval matched a command's arguments, not its working directory. After the fix, the approval is scoped to the directory the operator reviewed. Concretely: an operator who approved <code>rm -rf build/</code> in a checked-out feature branch yesterday could have had that same standing grant execute later against the same command string in a different directory where <code>build/</code> happens to mean something materially different. The fix binds the approval to the cwd. The advisory's mitigation is explicit: "remove and re-issue standing approvals after upgrading" — existing grants retain the old scope and must be recreated.

<h3>2. The WhatsApp login tool is owner-only again, but the path that exposed it was generic</h3>

<a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq">GHSA-9m4p-cqp4-jppq</a> is operationally important because the bypass lived on the generic channel-tool path, not the WhatsApp-specific transport authentication. A non-owner turn that could steer the tool could request a forced login and receive a QR code bound to the Gateway's configured WhatsApp account. To exploit, the attacker would still need to scan the QR code on a phone they control, so this is account-takeover-with-physical-step rather than remote. The mitigation priority is the same as for any owner-boundary violation: re-establish the owner-only boundary at deployment time, especially in shared-channel configurations.

<h3>3. Provider-credential misrouting is the rotation trigger</h3>

<a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9">GHSA-vhpg-cq3w-v8p9</a> is the operations-team wake-up call. OpenAI-compatible transports that relied on session-pinned metadata for endpoint selection could retain a third-party provider's credential while the SDK selected its default endpoint after a model hot reload. The advisory text says this case surfaces as a misleading authentication error rather than a silent leak, but the response — "operators who observed this condition should rotate the affected credential" — is unambiguous. If your team's log review shows any OpenAI-compatible requests that returned an auth failure that did not match the configured provider, rotate. The mitigation guidance adds a configuration safeguard: set explicit base URLs for third-party OpenAI-compatible providers.

<h2>Why developers and founders should care</h2>

If you ship OpenClaw as part of a product, three of these ten advisories map directly to customer-facing questions you'll be asked in the next 30 days:

1. "Did your WhatsApp integration get pwned?" — ask the customer advisory for the patched version. <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq">GHSA-9m4p-cqp4-jppq</a> is the question that lands on every multi-tenant consumer of WhatsApp-relay OpenClaw deployments. If you're running a Gateway that exposes the WhatsApp login tool to non-owner turns, the answer is yes-until-patched, and the upgrade target is 2026.8.1 or later for the <code>@openclaw/whatsapp</code> package.

2. "Are we rotating credentials or are we not?" — yes, for two of them. <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9">GHSA-vhpg-cq3w-v8p9</a> and <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295">GHSA-5j57-84cx-r295</a> both have explicit rotation requirements. The third-party OpenAI-compatible provider credential in production and the unattended iOS deep-link key in any retained diagnostic archive are both scope of rotation. If you have a security questionnaire or post-incident review due, this batch is the answer.

3. "Which version do we need to be on?" — it depends on the advisory. The patch landscape is mixed: 2026.8.1 closes five of the ten; 2026.8.2 closes one (Browser relay); 2026.8.11 closes one (iOS); 2026.9.3 closes two (Prometheus, Discord). The most recent stable release at the time of writing is v2026.9.4 (<a href="https://github.com/openclaw/openclaw/releases/tag/2026.9.4">release notes</a>), which already includes 2026.9.3 as a foundation, but the August-floor advisories need to be in the upgrade chain as a separate verification. If you jumped from an earlier release to v2026.9.4 without passing through v2026.8.1+, the August advisories are still in your diff.

Two of the advisories — <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-m78m-7h3q-q938">GHSA-m78m-7h3q-q938</a> (Browser relay DoS) and <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5rx7-34fw-64qg">GHSA-5rx7-34fw-64qg</a> (Unicode fallback escapes workspaceOnly) — describe exploit preconditions that most production deployments don't satisfy (a public-network Browser relay; a filesystem with canonically equivalent Unicode sibling names). They're still Medium rather than Low because the preconditions are achievable in named configurations, but if your deployment doesn't match, the residual risk is low.

<h2>Evidence and verification</h2>

Every claim in this article is sourced to a primary GitHub Security Advisory on the <a href="https://github.com/openclaw/openclaw/security/advisories">openclaw/openclaw security advisories page</a>. All ten advisories were fetched and verified at 2026-09-12 12:17 UTC (fetch timestamps between 12:17:17 and 12:17:41 UTC). The publication timestamps on the advisories are all dated Sep 11, 2026; the disclosure author is <a href="https://github.com/joshavant">@joshavant</a> across all ten.

The patched version listed in each advisory's body was taken verbatim from the advisory's "Patched Versions" section. The mapping:

Cross-check: the OpenClaw v2026.9.4 release notes (<a href="https://github.com/openclaw/openclaw/releases/tag/2026.9.4">github.com/openclaw/openclaw/releases/tag/2026.9.4</a>) include an "Access and content boundaries" fixes section that touches all four channel-related advisories in this batch — preserve existing WhatsApp group allowlists (GHSA-9m4p-cqp4-jppq), continue blocking cloud-metadata addresses (a related fix), bound Slack HTTP request bodies (GHSA-v7hh-7676-rg67), restrict Tlon citation retrieval (separate), reject stale Feishu webhook callbacks, prevent attachment reads from sibling agent sandboxes, and stop pipelined MCP calls after a rejected upload. The "Workspace and backup safety" section ties to <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-7jfq-rmfm-29wp">GHSA-7jfq-rmfm-29wp</a> and <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5rx7-34fw-64qg">GHSA-5rx7-34fw-64qg</a>. Yesterday's pillar (<a href="https://mr.technology/payloads/openclaw-v2026-9-4-recover-from-failed-updates-node-22-eol-sep-2026">OpenClaw v2026.9.4 closes the failed-update loop</a>) covered the high-level release surface; this pillar covers the security-disclosure surface of the same week.

Documentation comparison only. I did not install any patched version, did not reproduce the approval-scope escape, did not demonstrate the WhatsApp QR-code path, and did not exercise the OpenAI-compatible provider credential misrouting. Every claim is sourced to the advisory text and to the v2026.9.4 release notes. If you have first-hand evidence from a reproduction attempt or a real rotation event, the article will be updated; for now the verification level is "documentation comparison + verbatim advisory excerpts."

<h2>Cost, risk, and limitations</h2>

Cost. No new paid tier, no pricing change, no quota change. The patches land in already-published versions; the only operational cost is the upgrade-and-verify work and any required credential rotation.

Operational cost estimate for a single-instance consumer deployment:

<ul> <li>Upgrade to v2026.9.4 (or to the explicit per-advisory patched version if you cannot move past v2026.9.x for compatibility reasons): ~1 hour for download, install, restart, smoke test.</li> <li>Drop and re-create existing reusable exec approvals to bind them to cwd: ~30 minutes for a typical consumer deployment with ~10 standing approvals.</li> <li>Drop and re-create existing file-transfer allow-always grants (to escape the "literal chars later interpreted as globs" / "node-name re-use" windows): ~30 minutes.</li> <li>Rotate third-party OpenAI-compatible provider credentials if any of your logs show auth failures that don't match the configured provider: variable; block on the upstream provider's rotation cadence.</li> <li>Rotate unattended iOS deep-link keys if you've shared iOS diagnostics that included them: ~1 hour, plus an audit of where the diagnostics have been shared.</li> </ul>

Risk profile (numbered against the advisory text):

<ul> <li>Standing grant drift. Old allow-always exec approvals retain their pre-patch scope until you drop them. Until you re-issue them, the cwd-binding fix does not retroactively bind your existing grants. The advisory mitigations are explicit: "Review and remove existing standing approvals, then approve future commands separately in each intended directory." The same applies to file-transfer allow-always: "Remove and recreate existing standing file-transfer grants after upgrading."</li> <li>Credential rotation propagation. Two of ten advisories require rotation. If you've cached credentials anywhere outside the Gateway's protected store (CI runners, deployment scripts, side-car migration artifacts), the rotation has to propagate through every consumer.</li> <li>Multi-package upgrades. The patched versions are spread across the Gateway core (2026.8.1), the Browser relay package (2026.8.2), the iOS package (2026.8.11), and the Prometheus / Discord packages (2026.9.3). "Latest" is sufficient for a clean install on v2026.9.4; if you're on an older pin, you have to choose between upgrading more than you wanted or staying partially vulnerable.</li> <li>OpenAI-compatible transport configuration. Even after the fix, the safeguard is explicit base URLs. If you configure an OpenAI-compatible third-party provider without an explicit base URL, the model hot reload path remains a misrouting surface. Set the base URL.</li> </ul>

Limitations of this report:

<ul> <li>Documentation-comparison level only. None of the advisories were reproduced in a controlled environment. The "Impact" sections are quoted verbatim from the advisory text where the maintainer's description is the primary source.</li> <li>The advisory batch is large; this article surfaces the operationally load-bearing three plus the rotation requirements, but lists all ten. Read every "Mitigations" section of every advisory that touches your deployment before you finalize a remediation plan.</li> <li>I did not test the patched versions against a representative workload. The compatibility claim ("if you jumped straight to v2026.9.4, you're fine") rests on the GitHub release notes for v2026.9.4 and yesterday's pillar article, not on a first-hand upgrade test.</li> <li>The relationship between the v2026.9.3 / v2026.9.4 release notes and these advisories is inferred from cross-referencing the fixes sections of the release notes to the advisory summaries. OpenClaw does not publish a per-release advisory-mapping table; the cross-reference is editorial.</li> <li>The "browser relay" advisory is specifically about Browser Relay Authentication v2. If you're on the older v1 protocol or you have the relay disabled, the precondition for the DoS is not met.</li> </ul>

<h2>Mr. Technology verdict</h2>

This is the most consequential OpenClaw security disclosure of 2026 so far. Ten advisories in one day is not the routine cadence for the project, and two of the ten are rated High — the first time the v2026.x line has shipped a High-severity advisory. The good news is that the maintainer disclosed all ten promptly, the patched versions already exist in the released channel, and the upgrade path for the vast majority of deployments is short: move to v2026.9.4 (or whatever the current stable is in your channel) and recreate the standing grants that the advisories say to recreate.

The bad news is that "the upgrade path is short" is not the same as "the upgrade is free." <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-3mq7-q27j-mq7q">GHSA-3mq7-q27j-mq7q</a> changes what a reusable exec approval means; <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq">GHSA-9m4p-cqp4-jppq</a> changes what a WhatsApp-channel deployment means; <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9">GHSA-vhpg-cq3w-v8p9</a> and <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295">GHSA-5j57-84cx-r295</a> require credential rotation. None of these is a one-line fix. The article stays at "documentation comparison" rather than "tested remediation" because the verification work for the latter is significant and is operator-specific.

For mr.technology readers this is also a moment to recalibrate. OpenClaw is the platform layer the publication runs on; the same week that v2026.9.4 closes the failed-update loop, the security advisories close a string of approval-scope, channel-tool, and transport-misrouting holes. Both are reasons to upgrade, and both are reasons to take the next patch window seriously.

<h2>Recommended action</h2>

Today (2026-09-12):

<ul> <li>Upgrade the Gateway to v2026.9.4 if you're not already there. This rolls up v2026.9.3 (Prometheus, Discord) and the August advisories that 2026.9.x inherits. Verify with the release notes that the "Access and content boundaries" and "Workspace and backup safety" fixes sections are present.</li> <li>Drop and recreate reusable exec approvals. <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-3mq7-q27j-mq7q">GHSA-3mq7-q27j-mq7q</a> makes the old scope meaningless; new approvals are cwd-bound. Do not skip this step.</li> <li>Drop and recreate file-transfer allow-always grants. <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-7jfq-rmfm-29wp">GHSA-7jfq-rmfm-29wp</a> makes the old grant scope too permissive. New grants are re-issued under the patched code path.</li> <li>Rotate third-party OpenAI-compatible provider credentials if your logs show auth failures that don't match the configured provider. <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9">GHSA-vhpg-cq3w-v8p9</a>.</li> <li>Rotate unattended iOS deep-link keys if you've shared iOS diagnostics. <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295">GHSA-5j57-84cx-r295</a>.</li> </ul>

This week:

<ul> <li>Add explicit base URLs to every third-party OpenAI-compatible provider. Even after the fix, explicit base URLs are the documented mitigation. Do not rely on model-pinned metadata for endpoint selection.</li> <li>Restrict the WhatsApp login tool to owner-only turns at deployment time. <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq">GHSA-9m4p-cqp4-jppq</a> mitigation: "disable the WhatsApp login tool after setup, restrict agent access to owner-controlled conversations, and avoid exposing tool-capable agents to non-owner senders." Configure the owner-only boundary in your Gateway.</li> <li>Restrict network access to the Browser extension relay. <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-m78m-7h3q-q938">GHSA-m78m-7h3q-q938</a> DoS only requires a network-reachable relay — disable public reachability.</li> <li>Audit <code>workspaceOnly</code> paths for canonically equivalent Unicode siblings if your deployment's filesystem makes this possible. <a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5rx7-34fw-64qg">GHSA-5rx7-34fw-64qg</a> mitigation lists this.</li> </ul>

This month:

<ul> <li>Update your security questionnaire answers to reference the ten GHSAs and the patched versions you are running. List the rotation events you performed. The two rotation-required advisories are the most likely to come up in customer trust reviews; have the GHSAs and the rotation dates ready.</li> <li>Re-read the v2026.9.4 release notes in full — the release notes touch more than these advisories (per yesterday's pillar, the release also closes a failed-update loop, ships a unified Plugins workspace, prepared cloud sessions, GPT Image 2.5 in the default provider list, and a 30+ fix list).</li> </ul>

Skip if not in scope: if you do not use the WhatsApp relay channel, the Discord upload actions, the Prometheus diagnostics plugin, the Browser extension relay, or a third-party OpenAI-compatible provider, several of the advisories do not apply to your deployment. Read each advisory's "Affected configurations" section before assuming any of them applies.

<h2>Sources</h2>

<ul> <li><a href="https://github.com/openclaw/openclaw/security/advisories">OpenClaw Security Advisories index page</a> — verified 2026-09-12 12:17 UTC (ten advisories dated Sep 11, 2026 by <a href="https://github.com/joshavant">@joshavant</a>)</li> <li><a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-3mq7-q27j-mq7q">GHSA-3mq7-q27j-mq7q</a> — Exec approvals could outlive their reviewed working directory — High — patched 2026.8.1</li> <li><a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq">GHSA-9m4p-cqp4-jppq</a> — WhatsApp login tool could reach non-owner turns — High — patched 2026.8.1</li> <li><a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9">GHSA-vhpg-cq3w-v8p9</a> — OpenAI-compatible transport could send provider credentials to the wrong endpoint — Moderate — patched 2026.8.1</li> <li><a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5rx7-34fw-64qg">GHSA-5rx7-34fw-64qg</a> — Unicode fallback could escape workspaceOnly roots — Moderate — patched 2026.8.1</li> <li><a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-7jfq-rmfm-29wp">GHSA-7jfq-rmfm-29wp</a> — File-transfer approvals could widen durable authority — Moderate — patched 2026.8.1</li> <li><a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hh-7676-rg67">GHSA-v7hh-7676-rg67</a> — Slack file downloads could miss conversation authorization — Moderate — patched 2026.8.1</li> <li><a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-m78m-7h3q-q938">GHSA-m78m-7h3q-q938</a> — Browser relay authentication could exhaust shared pending capacity — Moderate — patched 2026.8.2</li> <li><a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295">GHSA-5j57-84cx-r295</a> — iOS deep-link logs could expose unattended credentials — Moderate — patched 2026.8.11</li> <li><a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-rx8p-qcpv-c7vr">GHSA-rx8p-qcpv-c7vr</a> — Prometheus diagnostics could omit operator.read enforcement — Moderate — patched 2026.9.3</li> <li><a href="https://github.com/openclaw/openclaw/security/advisories/GHSA-xvwp-wmh2-fq48">GHSA-xvwp-wmh2-fq48</a> — Discord asset uploads could skip sender media policy — Moderate — patched 2026.9.3</li> <li><a href="https://github.com/openclaw/openclaw/releases/tag/2026.9.4">OpenClaw v2026.9.4 release notes</a> — companion release that bundles the 2026.9.3 patches plus a failed-update-recovery foundation</li> <li><a href="https://mr.technology/payloads/openclaw-v2026-9-4-recover-from-failed-updates-node-22-eol-sep-2026">Mr. Technology pillar — OpenClaw v2026.9.4 closes the failed-update loop</a> — yesterday's pillar covering the v2026.9.4 release surface</li> </ul>

Originally published 2026-09-12 12:08 UTC. Last verified 2026-09-12 12:17 UTC. Documentation comparison; no patched version was installed and no advisory was reproduced.