OpenClaw 2026.11.3: Isolated Plugin API Keys and Private Subagent Results, but DOMPurify 3.4.16 Stays

OpenClaw 2026.11.3 shipped on 10 November 2026 as a stable security and reliability release. It binds plugin APIAPIThe official door 2 systems use to exchange data, without anybody copying it by hand.Open the glossary keys to their destination, keeps private subagent results out of chat, and reports failed tools, but the Control UI still ships DOMPurify 3.4.16.

OpenClaw is a self-hosted AI agentAI agentAn AI program that performs work steps by itself, for example reading a message, drafting a reply, and recording the result.Open the glossary gateway. The gateway runs agents on your server and connects them to Telegram, Discord, WhatsApp, and the Control UI in the browser. A subagent is a second agent that the main agent starts for 1 task. The subagent result goes back to the main agent.

This article continues our OpenClaw 2026.11.1 review. We read the release notes, checked GitHub issues, and opened the 2026.11.3 npm package on 11 November 2026 at 09:30 WIB.

What changed in OpenClaw 2026.11.3?

OpenClaw 2026.11.3 contains 34 PRs on top of 2026.11.2 and adds no new features or configuration options.

The npm package openclaw@2026.11.3 was published on 10 November 2026 at 17:59 UTC and became the latest channel. The table shows the 7 main changes from the OpenClaw 2026.11.3 GitHub release page.

Area	Change	Who notices it
Private subagent results	Private subagent results no longer go into streamed chat replies (PR #188490).	Teams that use subagents for internal data
Tool failures	Unanswered tool failures are now reported. Before, such a turn could end as a success (PR #182458).	All chat and automation users
Child-task handoff	A parent agent can hand off to replacement work after it cancels a child task (PR #178893).	Multi-agent workflows
Provider authentication	Stalled authentication stops at the run deadline (PR #189144).	Servers with many model providers
Images in the sandbox	Image previews stay in allowed folders, also in Full Access mode (PR #176203).	Servers with a required sandbox
Workspace connections	Saved node certificate pins stay. Certificates are checked before credentials are sent (PR #125646, #190002).	Teams with more than 1 node
Gateway startup	Startup loads fewer module files. Abort-command detection does not stall on long punctuation runs (PR #192217, #184433).	Small servers and VPS

Which security fixes in 2026.11.3 matter most?

The most important fix is credential isolation: the API key of 1 plugin or 1 service no longer goes to a different destination.

• Plugin credential isolation. Reused and cached plugin results stay bound to their connection credentials. Transport hooks of other plugins stay on the provider origin (PR #178444, #177974, #189423).
• Search and memory keys. Firecrawl keys stay with the Firecrawl endpoint. Embedding credentials stay with the embedding destination (PR #190706, #184966).
• Credential redaction. Configuration reads hide inline environment credentials. Exa errors no longer reflect search credentials (PR #190618, #178745).
• Child-process environments. Signal daemons and bundled language servers no longer inherit unrelated Gateway secrets (PR #179198, #179415).
• Authentication errors. A failed credential read now shows as an error, not as a missing credential. Auth profiles from an incompatible provider are now rejected (PR #173970, #181597).

The release notes give no CVE or GHSA for these fixes. Thus, there is no public evidence that attackers used these gaps. The main risk is that an API key goes to the wrong service and stays in that service's logs.

What does 2026.11.2 add if your server is still on 2026.11.1?

A server on 2026.11.1 also gets the 113 fix PRs of 2026.11.2, which shipped on 8 November 2026.

The official OpenClaw 2026.11.2 release notes say that this release also adds no new features. These 5 fixes matter most on production servers:

• Scheduled reminders no longer disappear when their text mentions heartbeat, poll, or wake (#129650).
• Automations no longer delete their own schedule when the job owner is not clear (#167857).
• WhatsApp direct messages are no longer lost when a number mapping arrives late (#193052).
• Codex sessions read changed AGENTS.md instructions (#191439).
• Logs no longer record assistant replies, LINE postback data, Matrix verification details, or detailed Codex tool errors (#172963, #173422, #174526, #174544).

2026.11.2 also contains PR #180492. This PR fixes claude-cli automations that fail with "no recorded inference account". Old jobs still need 1 manual step, as issue #195887 shows.

What is still not fixed in OpenClaw 2026.11.3?

4 problems are still open in 2026.11.3, and we checked 1 of them directly in the npm package.

Problem	Status on 11 November 2026	Evidence	Temporary step
DOMPurify 3.4.16 in the Control UI	Not fixed in a stable release	Issue #196925 says that 2026.11.2 and 2026.11.3 use DOMPurify 3.4.16. This version is under GHSA-cg2g-xh64-v4q7 (critical) and GHSA-mrv2-3pqr-j5jr (high). The main branch already uses 3.4.17.	Open the Control UI only through localhost, a VPN, or Tailscale.
ClaudeClaude ProThe paid subscription for the Claude AI assistant from Anthropic. It unlocks connectors to outside tools.Open the glossary Fable 5.2	Fix on main, not in a release	Issue #196248: setup-token requests to Fable 5.2 fail with error 400, because OpenClaw sends the Claude Code 2.1.280 identity. PR #196693 and #196459 merged on main on 10 November, but they are not in the 34 PRs of 2026.11.3.	Use the workaround in the issue, or stay on Fable 5.1.
exec fails on old glibc	Still present	Issue #191841 is still open. The 2026.11.3 package still uses @openclaw/proc-safe 0.4.2. The fix for glibc 2.28 was still waiting for a maintainer on 9 November.	Stay on 2026.10.9 on RHEL 8 and other old glibc systems.
Updates on macOS 27.2	Still present	Issue #196897: the Darwin argv fallback is in beta and main, but not in 2026.11.2 or 2026.11.3. Each update leaves 1 more copy of the updater runtime.	Monitor Mac disk space after each update.

The 2 DOMPurify advisories apply only to specific modes: SAFE_FOR_TEMPLATES with DOM output, and IN_PLACE mode. The automatic review in issue #196925 says that exploitation through OpenClaw is not proven.

We downloaded the openclaw@2026.11.3 package on our test server on 11 November 2026. The package is 113 MB with 15,207 files, and its sha512 hash matches the release notes. The Control UI assets in dist/control-ui/assets contain the string "DOMPurify 3.4.16".

Status of the 5 regressions from 2026.10.10 that we track since 4 November:

• #191818 and #192327, automations without an inference account: fix #180492 is in 2026.11.2. The Doctor warning for old jobs (PR #195905) is only on main.
• #191841, exec fails on old glibc: still present in 2026.11.3.
• #191847, SQLite worker dies on large sessions: issue still open.
• #191783, memory reindex hangs: issue still open, with no new production repro on 10 November.
• #191948, Windows update fails: issue still open.

Issue #193962, the update timeout from 2026.10.10, was closed as "not planned" on 10 November. The installed 2026.10.10 updater still runs the old check. A maintainer wrote that the problem does not occur when the update starts from 2026.11.3.

How does OpenClaw 2026.11.3 feel in daily use?

In daily use, the most visible change is that a failed turn now looks like a failure, not a false success.

Before PR #182458, a user turn could end as a success even when 1 tool in it failed without an answer. The user got an incomplete reply with no error sign. In 2026.11.3, that tool failure is reported, so the operator knows when to try again.

3 smaller changes are also visible:

• The Gateway no longer stops when cron queue storage fails (PR #175678). The Telegram bot stays online.
• The terminal /reset soft command now goes to the Gateway and does not hard-reset the session (PR #172431).
• Anthropic usage-limit errors are recognized earlier, so the rate-limit retry budget is not wasted (PR #176186).

Users also reported problems on 2026.11.2, which is the base of 2026.11.3. The 2026.11.3 release notes do not mention fixes for these problems:

• #196820: the Control UI locks at about 100% CPU after a few minutes, in the macOS app and in Microsoft Edge. Maintainers could not reproduce it on 10 November.
• #195266: a subagent spawn to an agent on the Codex harness always fails with "Session capability metadata requires worker preparation", 3 of 3 attempts.
• #196958: the ChatGPT sign-in is lost when a token refresh runs while the network is down. The user must sign in again. A fix PR is open.
• Automatic update failure reports continued on 10 and 11 November, with package-update and invalid-config types, for example #196969 and #196860.

This release suits business owners and marketers who use agents in chat, because the changes are behind the scenes. Developers who use the Codex harness, Fable 5.2, or old Linux must read the open-problem table first.

Example: a small agency with a Telegram agent and a research subagent

This example uses a 5-person agency that runs OpenClaw on a VPS to answer client Telegram groups.

The main agent answers client questions. For campaign data, the main agent starts a subagent that reads ad reports with an ads API key and a Firecrawl key.

1. On 2026.11.2, private subagent results can show in the streamed chat reply. Clients in the group can see internal data.
2. If the Firecrawl tool fails without an answer, the turn can end as a success with an incomplete reply.
3. On 2026.11.3, private subagent results stay inside, the Firecrawl key stays with the Firecrawl endpoint, and the tool failure is visible.
4. The team still keeps the Control UI behind Tailscale, because DOMPurify 3.4.16 is still present.

This scenario is an illustration. We built it from the release notes, not from client data.

Do you need to upgrade to OpenClaw 2026.11.3 now?

Servers on 2026.11.1 or 2026.11.2 should upgrade to 2026.11.3 this week, because credential isolation applies to all plugins.

Server condition	Decision	Reason
2026.11.1 or 2026.11.2 on modern Linux	Upgrade this week	Credential isolation, log redaction, and safer update recovery
2026.10.10	Upgrade, with manual steps ready	The 2026.10.10 updater can time out on large state folders (#193962)
2026.10.9 because of old glibc	Stay on 2026.10.9	#191841 is still present in 2026.11.3
Claude Fable 5.2 through setup-token	Upgrade is possible, with the workaround	The Fable 5.2 fixes are not in a release
Subagents on the Codex harness	Test on a test server first	#195266 has no fix yet
Need the fewest changes	Use extended-stable 2026.9.37	Released on 10 November 2026 with security fixes for the September branch

We read the npm channels on 11 November 2026: latest 2026.11.3, beta 2026.11.5-beta.1, and extended-stable 2026.9.37.

How do you upgrade to OpenClaw 2026.11.3 safely?

A safe upgrade has 8 steps: check the version, make a restore point, update, repair jobs, and test each channel.

1. Check the installed version with openclaw --version. Compare it with npm view openclaw dist-tags.
2. Make a server snapshot or a backup of the OpenClaw state folder before the update.
3. Check the glibc version with ldd --version. If the server uses RHEL 8 or another old glibc, read issue #191841 first.
4. Run openclaw update. For the fewest changes, run openclaw update --channel extended-stable.
5. Run openclaw doctor --fix, then openclaw gateway status --deep.
6. For old claude-cli automation jobs, run openclaw automations edit <jobId> --model <provider/model>@<profile>. Doctor in 2026.11.3 does not flag these jobs yet.
7. Send 1 test message to each channel, then run 1 automation manually. Make sure that a failed tool shows as an error.
8. Keep the Control UI on localhost, a VPN, or Tailscale until a stable release uses DOMPurify 3.4.17.

Operational conclusion

Upgrade servers on 2026.11.1 and 2026.11.2 to 2026.11.3 this week. Keep the Control UI off the public internet until DOMPurify 3.4.17 is in a stable release. Servers with old glibc stay on 2026.10.9.

Do you need help to install or upgrade OpenClaw on a business server? See our AI Agent Ops Install service. For the regression history, also read our OpenClaw 2026.10.10 review.

Questions and answers

Does OpenClaw 2026.11.3 add new features?

No. The release notes say that 2026.11.3 adds no new configuration options or features. The release contains 34 security and reliability fix PRs.

Is DOMPurify 3.4.16 in the Control UI dangerous for my server?

The risk is not proven. The 2 advisories apply only to specific DOMPurify modes, and nobody has reproduced an exploit through OpenClaw. Still keep the Control UI on localhost, a VPN, or Tailscale.

Does OpenClaw 2026.11.3 fully support Claude Fable 5.2?

Not fully. The online model catalog already lists Fable 5.2, but the Claude Code identity and thinking prefix fixes are only on main. Use the workaround in issue #196248 until the next release.

Can a 2026.10.9 server with old glibc upgrade to 2026.11.3?

Not yet. The 2026.11.3 package still uses @openclaw/proc-safe 0.4.2, and issue #191841 is still open. Stay on 2026.10.9 until the proc-safe fix is in a release.

Which channel suits me if I want the fewest changes?

Use the extended-stable channel. Version 2026.9.37 shipped on 10 November 2026 with security and reliability fixes on top of the September branch.