OpenClaw 2026.10.9 shipped on October 29, 2026 as a maintenance release with 48 pull requests. It patches vulnerable dependencies, closes a gap in tools.fs.workspaceOnly, hides credentials in MCPMCPA standard that lets an AI program use your tools and data under clear permissions.Open the glossary inspection, and keeps failed update rollbacks safe. Upgrade this week if your Gateway uses MCP, Microsoft Teams, an IMAP inbox, or workspace limits.
This release adds no new features. The official release notes give 4 areas: dependency security patches, recovery, data preservation, and reliability (OpenClaw GitHub Releases, October 29, 2026).
What are OpenClaw, the Gateway, and the extended-stable line?
OpenClaw is an open-source AI agentAI agentAn AI program that performs work steps by itself, for example reading a message, drafting a reply, and recording the result.Open the glossary that runs on your own server, VPS, or laptop. The Gateway is the OpenClaw service process. It receives messages from channels such as Slack, Microsoft Teams, Telegram, and email, and then runs the agent and its tools.
OpenClaw has 2 stable release lines on npm. The latest line now holds 2026.10.9. The extended-stable line is the LTS equivalent and now holds 2026.9.36, a Gateway-only release from the same day (2026.9.36 release notes).
What changed in OpenClaw 2026.10.9?
OpenClaw 2026.10.9 changes 4 areas: vulnerable dependencies, tool access limits, credential secrecy, and update recovery. This table summarizes the official release notes.
| Area | Change | Impact for operators |
|---|---|---|
| Microsoft Teams | MSAL Node moves to 7.1.1 | Closes CVE-2026-109461 (high) in the MSAL Node authorization code flow |
| MCP schemaSchemaExtra description inside page code that tells a search engine what the page is, for example an article, a service, or a question and answer.Open the glossary validation | fast-uri 4.2.3 rejects malformed URI schemes and hosts | Malformed URIs in an MCP schema no longer pass validation |
| IMAP email inbox | Sender parsing uses nodemailer 10.1.4 | Spoofed senders no longer pass the sender token gate |
| A2UI and Discord | Oversized Zod collections are rejected early | Large input no longer forces unbounded work |
| Workspace limit | tools.fs.workspaceOnly applies to Gateway-built tools | Delegate changes require approval again |
| Credentials | MCP CLI inspection hides credentials. Google OAuth client secrets are masked in logs. | Keys no longer appear in the terminal, transcripts, or logs |
| Update rollback | Git rollbacks keep operator edits. Windows npm rollbacks retry and report the recovery step. | A failed update no longer deletes local edits or leaves an install that cannot start |
| Agent data | Agent databases and full-text indexes recover after SQLite tokenizer changes | Agent history and search stay intact after an update |
| Full disk | Agents recover when disk space is available again | You do not need to restart the Gateway after you clear the disk |
Which gaps does it close, and how serious are they?
The most important gap is in tools.fs.workspaceOnly, because the setting did not apply on 2 tool construction paths. Pull request #185094 merged into main on October 27, 2026 and describes the problem.
- Gateway loopback and skill dispatch built tools without a filesystem policy.
- Without that policy, the
openclawdelegate got Full Access. Persistent configuration changes then ran without approval. - Media tools could also read default folders outside the workspace.
The second problem is in MCP inspection. According to PR #180321, openclaw mcp list --json and mcp show printed usable credentials, including values from environment variables. Now headers, environment values, and sensitive arguments show as __OPENCLAW_REDACTED__.
For MSAL Node, advisory GHSA-xcx6-jx8p-x3h5 was published on October 23, 2026 with high severity. The OpenClaw team calls this patch a remediation of an affected dependency, not proof of a full exploit in OpenClaw.
How does it feel for daily operators?
Operators feel the largest change when an update fails, not when the agent works normally. Before this release, a rollback of a Git install could reset the checkout. Local operator edits to source files were lost.
Release 2026.10.9 also removes some manual restarts. Agents recover after you clear a full disk. Large transcript archives also migrate without exceeding Node.js string limits.
Example scenario (illustration): a small agency runs 1 OpenClaw Gateway on a VPS. The agent reads order email through IMAP and sends a summary to a Microsoft Teams channel. On the old version, email from a spoofed sender could pass the sender token gate, and Teams sign-in used an affected MSAL Node version. After the upgrade, both paths use patched dependencies.
What do users report after the release?
User reports from October 30, 2026 show that the update is not always smooth. These 3 reports were still open on GitHub when this article was published.
- The macOS Gateway disappears from launchd. On macOS 26.5.2, the Gateway disappeared from the launchd domain after an auto-update from 2026.10.8 to 2026.10.9. The user recovered it with
launchctl bootstrap(issue #188303). A maintainer said 2 fixes are on main but not in a release yet. - Hot reload stalls the Gateway. On a large install with about 40 channel connectors, a change to
agents.defaults.models.*reloaded all plugins. The Gateway stalled for about 19 seconds (issue #188275). - An update from 2026.9.4 fails in validation. Report #188829 records the code
node-runtime-preflight. A maintainer confirmed that Node 26.13.0 meets the version range, so the root cause is not known yet.
Do you need to upgrade now?
Yes, upgrade this week if your Gateway uses one of the patched features. Use this table to set the priority.
| Your Gateway | Priority | Reason |
|---|---|---|
| Microsoft Teams channel is active | This week | MSAL Node 7.1.1 closes CVE-2026-109461 |
tools.fs.workspaceOnly: true | This week | The workspace limit now applies to Gateway-built tools |
| MCP servers with secret headers or tokens | This week | MCP inspection no longer prints credentials |
| Email inbox through IMAP | This week | The sender token gate rejects spoofed senders |
| extended-stable line | This week, to 2026.9.36 | This LTS release carries the workspace, Teams, and untrusted input patches |
| macOS with unattended auto-update | Manual update when you can monitor it | Report #188303 is still open |
How do you upgrade to OpenClaw 2026.10.9 safely?
A safe upgrade has 8 steps: check Node.js, back up, update, verify, and prepare recovery. Do these steps during a quiet hour.
- Run
node -v. The npm package 2026.10.9 requires Node.js>=24.22.1 <25or>=26.12.1(npm openclaw 2026.10.9). - Back up the OpenClaw state folder (
$OPENCLAW_STATE_DIR) before the update. - Run
openclaw update. - Run
openclaw update statusandopenclaw gateway status --deep. - Send 1 test message to each active channel. Make sure the agent replies.
- Run
openclaw mcp list --json. Make sure credentials show as__OPENCLAW_REDACTED__. - Replace APIAPIThe official door 2 systems use to exchange data, without anybody copying it by hand.Open the glossary keys that appeared in MCP inspection output, agent transcripts, tickets, or logs.
- If the macOS Gateway disappears, run
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.gateway.plist, and thenopenclaw doctor --fix.
If the update fails, open the openclaw-update-failure-*.json file in $OPENCLAW_STATE_DIR/logs/support/. The file records the failed step and the reason that recovery was refused.
What are the limits of this release?
Release 2026.10.9 does not close all macOS update problems. Note these 3 limits before you upgrade.
- The fix for a Gateway that disappears from launchd is not in 2026.10.9 or 2026.10.8.
- The Android APK is not part of this release. The release notes say the Android app version is still 2026.8.2.
- The MSAL patch is a dependency remediation. The OpenClaw team does not claim a real exploit in OpenClaw.
Conclusion: what is your next step?
Schedule the upgrade to 2026.10.9, or to 2026.9.36 on the extended-stable line, this week. Replace credentials that appeared in MCP inspection output, and test each channel after the update.
Read our review of OpenClaw 2026.10.5 on update recovery and restarts for the previous release. If your team needs an agent with limited access and a tested upgrade procedure, see the AI Agent Ops Install service. For MCP servers with safe credentials, see MCP Server Development.
Questions and answers
Does OpenClaw 2026.10.9 add new features?
No. The official release notes call 2026.10.9 a maintenance release for dependency security patches, recovery, data preservation, and reliability.
What is the difference between OpenClaw 2026.10.9 and 2026.9.36?
2026.10.9 is on the latest line. 2026.9.36 is on the extended-stable line, the LTS equivalent, and is Gateway-only. Both shipped on October 29, 2026 with the workspace and Teams patches.
Which Node.js version does OpenClaw 2026.10.9 need?
The npm package 2026.10.9 requires Node.js 24.22.1 or later on the 24 line, or Node.js 26.12.1 or later. Check with node -v before you update.
What do I do if the macOS Gateway stops after the update?
Run launchctl bootstrap for the ai.openclaw.gateway.plist file, then openclaw doctor --fix and openclaw update status. A maintainer gave these steps in issue #188303.
Did my API keys leak before this release?
The old MCP inspection printed credentials to the terminal and to retained tool transcripts. If you or an agent ran openclaw mcp list --json or mcp show, replace the credentials that appeared.
