Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Security Bug] Upgrade wizard resets allowlist to open/pairing [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#63809•Fetched 2026-04-10 03:41:51
View on GitHub
Comments
0
Participants
1
Timeline
2
Reactions
0
Author
smilemonksmilemonk
Participants
smilemonksmilemonk
Timeline (top)
cross-referenced ×1referenced ×1

Root Cause

Impact:

  • All security settings are reverted on every upgrade
  • 2026-03-23 security incident happened because of this vulnerability
  • Users are exposed to unauthorized access after each upgrade

Fix Action

Fixed

PR fix notes

PR #63827: fix(security): preserve dmPolicy settings during wizard runs

Description (problem / solution / changelog)

Summary

Previously, running openclaw update or openclaw configure would reset dmPolicy to the default pairing value because the wizard channel configuration prompt did not preserve the existing dmPolicy setting.

This fix adds initialValue: current to preserve dmPolicy during wizard runs.

Fixes Issue #63809

Changed files

  • 2026-03-30-security-ghsa.md (added, +76/-0)
  • CHANGELOG.md (modified, +1319/-362)
  • extensions/msteams/src/monitor-handler/message-handler.ts (modified, +11/-4)
  • extensions/nostr/src/channel.ts (modified, +47/-0)
  • extensions/nostr/src/nostr-bus.ts (modified, +13/-0)
  • extensions/voice-call/src/webhook-security.ts (modified, +3/-1)
  • package.json (modified, +5/-3)
  • pnpm-lock.yaml (modified, +84/-66)
  • src/auto-reply/reply/commands-allowlist.ts (modified, +26/-41)
  • src/auto-reply/reply/commands-config.ts (modified, +23/-20)
  • src/auto-reply/reply/commands.test.ts (modified, +114/-229)
  • src/browser/control-auth.ts (modified, +3/-13)
  • src/channels/plugins/config-writes.ts (modified, +18/-73)
  • src/channels/plugins/plugins-core.test.ts (modified, +8/-152)
  • src/commands/doctor-completion.ts (modified, +27/-6)
  • src/commands/health.ts (modified, +50/-0)
  • src/commands/onboard-channels.ts (modified, +1/-0)
  • src/gateway/http-auth-helpers.ts (modified, +37/-1)
  • src/gateway/origin-check.ts (modified, +19/-0)
  • src/gateway/server-http.ts (modified, +11/-0)
  • src/gateway/server-methods/agents.ts (modified, +36/-2)
  • src/gateway/server-methods/cron.ts (modified, +42/-0)
  • src/gateway/server-methods/devices.test.ts (added, +120/-0)
  • src/gateway/server-methods/devices.ts (modified, +13/-2)
  • src/gateway/server-methods/types.ts (modified, +15/-1)
  • src/gateway/server-plugins.ts (modified, +34/-2)
  • src/gateway/server.impl.ts (modified, +801/-395)
  • src/gateway/server.silent-scope-upgrade-reconnect.poc.test.ts (added, +352/-0)
  • src/gateway/server/http-auth.ts (modified, +29/-2)
  • src/gateway/server/plugins-http.runtime-scopes.test.ts (added, +163/-0)
  • src/gateway/server/plugins-http.test.ts (modified, +195/-144)
  • src/gateway/server/plugins-http.ts (modified, +6/-15)
  • src/gateway/server/ws-connection/handshake-auth-helpers.test.ts (modified, +13/-47)
  • src/gateway/server/ws-connection/handshake-auth-helpers.ts (modified, +32/-44)
  • src/gateway/server/ws-connection/message-handler.ts (modified, +95/-19)
  • src/gateway/session-kill-http.test.ts (added, +319/-0)
  • src/gateway/session-kill-http.ts (added, +162/-0)
  • src/gateway/sessions-patch.ts (modified, +17/-1)
  • src/infra/dotenv.ts (modified, +85/-2)
  • src/infra/exec-wrapper-resolution.ts (modified, +33/-1)
  • src/infra/node-pairing.ts (modified, +40/-0)
  • src/node-host/runner.ts (modified, +5/-2)
RAW_BUFFERClick to expand / collapse

When OpenClaw upgrades, it runs wizard configure which overwrites the allowlist dmPolicy back to open/pairing. This has already caused a security incident where an attacker used this to gain unauthorized access. Upgrading should NOT reset security-critical config.

Reproduction:

  1. Set dmPolicy to allowlist in openclaw.json
  2. Run openclaw update to upgrade OpenClaw
  3. After upgrade, check config — dmPolicy is reset to open or pairing

Impact:

  • All security settings are reverted on every upgrade
  • 2026-03-23 security incident happened because of this vulnerability
  • Users are exposed to unauthorized access after each upgrade

Suggested fix: Either skip security-related config (dmPolicy, allowFrom) during wizard configure, or prompt user before overwriting these critical settings.

extent analysis

TL;DR

Modify the wizard configure process to preserve or prompt for confirmation before overwriting security-critical configurations like dmPolicy during OpenClaw upgrades.

Guidance

  • Identify and isolate security-critical configurations (e.g., dmPolicy, allowFrom) to prevent them from being overwritten during upgrades.
  • Consider adding a prompt or warning to the wizard configure process to inform users before making changes to these critical settings.
  • Review the upgrade process to determine if it's possible to skip resetting security settings altogether, instead of relying on user intervention.
  • Evaluate the feasibility of introducing a separate, optional configuration step for security settings that are not overwritten during upgrades.

Example

// Example openclaw.json with dmPolicy set to allowlist
{
  "dmPolicy": "allowlist",
  // other configurations...
}

Notes

The exact implementation details of preserving security configurations during upgrades may depend on the specific requirements and constraints of the OpenClaw system. It's essential to balance security needs with the usability and simplicity of the upgrade process.

Recommendation

Apply a workaround by modifying the wizard configure process to preserve security-critical configurations, as upgrading to a fixed version is not mentioned as an option in the issue. This approach addresses the immediate security concern while allowing for further evaluation of a permanent solution.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#vector store#embedding generation#cache error#pipeline error#runtime error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Security Bug] Upgrade wizard resets allowlist to open/pairing [1 pull requests, 1 participants]