What's New in 2026.2.12

OpenClaw 2026.2.12 is a security-focused release that addresses multiple vulnerabilities and improves system reliability. Whether you're running OpenClaw on a laptop, VPS, or Raspberry Pi, this update is essential.

🔒 Security Fixes

• Webhook Security: Fixed unauthenticated Nostr profile API config tampering and removed bundled soul-evil hook
• Session Hardening: Transcripts now stay within session directories—no more path traversal risks
• SSRF Protection: URL-based file/image handling now uses explicit deny policies, hostname allowlists, and audit logging
• Browser Control: Loopback routes now require authentication; auto-generates auth tokens when missing
• Skill Sandboxing: Mirrored skill sync destinations confined to sandbox root—no more filesystem path exploits

⚡ Stability & Performance

• Gateway Restarts: Drains active turns before restart to prevent message loss
• Cron Reliability: Multiple scheduler fixes prevent skipped jobs, duplicate fires, and execution stalls
• WebSocket Buffers: Raised limits so 5MB image attachments work reliably
• Telegram Improvements: Native blockquote rendering, better thread handling, and fixed model picker crashes

🔧 Breaking Changes

Webhook Sessions: POST /hooks/agent now rejects payload sessionKey overrides by default. If you need fixed hook context, set hooks.defaultSessionKey (recommended with hooks.allowedSessionKeyPrefixes: ["hook:"]).

How to Install OpenClaw

Prerequisites

You need Node.js 22+ installed. Check your version:

node --version

If you don't have Node 22, install it from nodejs.org or use a version manager like nvm.

Fresh Install

Install OpenClaw globally via npm:

npm install -g openclaw

Run the onboarding wizard to set up your first agent:

openclaw onboard

Follow the prompts to:

• Choose your AI provider (Anthropic, OpenAI, etc.)
• Configure channels (Telegram, WhatsApp, Discord, etc.)
• Set up your workspace and agent identity

Upgrade Existing Installation

Already running OpenClaw? Update to 2026.2.12:

npm install -g openclaw@latest

Restart the gateway to apply changes:

openclaw gateway restart

Verify Installation

Check your OpenClaw version:

openclaw --version

You should see 2026.2.12 or higher.

Quick Start After Install

Once installed, start the gateway:

openclaw gateway start

Then open the web UI in your browser:

openclaw web

Or chat directly from the terminal:

openclaw chat

Why This Release Matters

OpenClaw is getting more secure and stable with every release. The 2026.2.12 update addresses real-world security vulnerabilities reported by the community—many with CVE-style IDs and public disclosures.

If you're running OpenClaw in production (home automation, work tools, public bots), upgrade immediately. The webhook and session hardening alone are worth it.

Resources

• OpenClaw GitHub Repository
• Full Release Notes (2026.2.12)
• Official Documentation
• OpenClaw Community Discord