OpenClaw's Exec Approval Fix, Stale Task Cleanup, and the CVE-33579 Blast Radius by the Numbers
Security
PR #60310 Merged: Exec Approvals Now Authoritative, Stale Cron Tasks Get Properly Cleaned Up
Two real bugs closed in one PR: the gateway exec path now treats exec-approvals.json as the final word on security policy instead of silently downgrading it, and stale cron/CLI tasks backed by persistent chat sessions no longer linger as false positives in the task registry. Both fixes are backward-compatible and covered by regression tests, so upgrading is low-risk.
CVE-2026-33579 Deep Dive: 63% of 135K Exposed Instances Run With No Auth At All
The 'low privileges required' CVSS rating on this privilege escalation bug is basically fiction for most real deployments. When nearly two-thirds of publicly exposed instances have zero authentication, this is an unauthenticated remote admin takeover for the majority of affected users. If your instance was ever public-facing without auth, treat it as compromised and audit everything it touched.
Release
Task Flows now persist across restarts with durable state, revision tracking, and clean cancel propagation for child tasks. The security overhaul centralizes TLS, proxy, and auth handling across every HTTP path and blocks insecure TLS overrides, which meaningfully hardens production VPS deployments. Two breaking config changes for xAI and Firecrawl users require running openclaw doctor --fix after upgrading.
OpenClaw 2026.4.1 Recap: Cron Tool Allowlists Are the Underrated Security Win in This Release
Voice Wake and the /tasks board get the headlines but the --tools flag for cron jobs is the most tactically useful addition here for anyone running autonomous scheduled workflows. Locking each cron to only the tools it actually needs bounds the blast radius if a scheduled job misbehaves, which is exactly the kind of least-privilege control production deployments need.
Analysis
Stack Observer Breakdown: What 2026.4.2 Task Flow Restoration Means for Production Automation
Good technical read on why the managed-vs-mirrored sync split matters for teams running OpenClaw alongside external orchestrators. The plugin config migration to namespace-owned paths is the right architectural move for long-term maintainability even if it creates short-term migration work.
Stay Ahead
Delivered each morning.