Peng Zhou (@zpbrent)

OpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke

OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch

OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitization

OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist

OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions

OpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification Notices

OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation

OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession

OpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots

OpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass