OpenClaw October 2026 Security Patch (v2026.10.9)
v2026.10.9 is a security and recovery patch, not a feature drop. Official notes: 38 pull requests, 8 direct commits, 22 contributors. Read the raw notes on docs.openclaw.ai/releases/2026.10.9.
Upgrade with a backup. If the Gateway is already down, recover first.
What broke on older builds
| Area | Old behavior | After 10.9 |
|---|---|---|
| MCP tools | Malformed addresses in tool input definitions could be accepted (URI-parser issues in the dependency tree). | fast-uri 4.2.3. Malformed schema identifiers that used to pass may now fail validation. Relative links that are valid still resolve. |
| Microsoft Teams / Azure sign-in | A library flaw could send application credentials to the wrong destination. | MSAL Node 7.1.1 scoped to affected Teams apps and Azure Identity versions, included in managed plugin installs and upgrades. |
| IMAP sender checks | A spoofed message could pass when a trusted address was hidden inside nested comments in the From header. | Address parsers use Nodemailer 10.1.4. This matters when IMAP uses a token tied to a particular sender. |
| Workspace-only mode | Gateway-built delegation and media tools did not always honor folder limits. | Restrictions apply to those tools. Restricted setting changes need approval. Media reads stay in allowed folders. |
What you should expect after upgrading
- MCP skills that passed odd URIs may start erroring. Fix the skill input, do not disable validation.
- Teams or Azure plugins that have not been upgraded through the managed path may still carry the old MSAL. Upgrade the plugin, not only the core.
- Mail-triggered agents may reject messages they used to accept. That is the point of the IMAP fix. Confirm the real From address, not a comment.
- Agents in workspace-only mode may refuse media or delegation that pointed outside the allowed tree. Widen the allowlist on purpose, or keep the refusal.
Not covered here
10.9 also repairs Doctor migrations, SQLite indexes, Git/Windows rollbacks, and disk-full writes. Those are operational, not new attack surface. See update recovery. Broader hardening remains on best practices and known vulnerabilities.