OpenClaw and Hermes add-on CVEs, October 2026: plugins, skills, routers

Most agent security writing in 2026 has been about the agents themselves: OpenClaw's CVE-2026-25253 early in the year, then a long run of fixes in the core (NVD's keyword search returns more than 680 OpenClaw CVEs this week). The core is not where the October records are. They are in the add-ons people install around their agent: channel plugins, skills, model routers, memory layers. Each one is small, recent and reviewed by almost nobody, and each one runs with the agent's reach.

A plugin that listens on every interface

CVE-2026-108757, published 11 October, CVSS 3.1 6.5. The pinclaw OpenClaw channel plugin from Nexting, through version 0.3.0, skipped its auth token check on POST /pinclaw/send. Its server listens on port 18790 on all interfaces by default, so anyone who can reach that port can inject instructions into the user's main OpenClaw session, where they arrive as if the user had typed them.

That is prompt injection without the indirection: no poisoned web page or document needed, just an HTTP request. What it can do depends on what the agent can do, which for an OpenClaw install is usually a lot. Sources: VulnCheck advisory, researcher write-up.

A skill whose uninstall deletes your home directory

CVE-2026-108156, published 9 October, CVSS 3.1 7.1. LobsterAI, an agent app from NetEase Youdao that installs OpenClaw-style skills, from 2026.5.27 through 2026.9.23: the handler that uninstalls a skill trusted the openclawSourceDir value from the skill's own _meta.json. A crafted skill can point it at any directory the user can write, including the home directory, and uninstalling the skill deletes it recursively. The record notes that the app's skill security scanner never inspected _meta.json (issue, fix commit).

The point generalises: a skill scanner that checks the code but not the metadata the installer trusts is checking the wrong file.

A router that writes the agent's config

CVE-2026-108593, published 10 October, CVSS 3.1 6.4. 9router, an LLM router with a settings page for Hermes Agent, versions 0.4.1 through 0.5.99: the POST /api/cli-tools/hermes-settings endpoint wrote a user-supplied baseUrl into Hermes Agent's config.yaml without escaping. A value with quotes and newlines adds new keys, including hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes then runs after each LLM call without asking (VulnCheck advisory). It needs a dashboard account, so the risk is anyone who has, or can get, access to the router UI.

Hermes did what its config told it to. The bug is that a second tool had write access to that config and no idea what it was writing.

The memory layer and the MCP wrapper

Two more records from the summer complete the picture:

• CVE-2026-59706 (CVSS 3.1 9.3, 7 July): the mem0 memory server exposed unauthenticated config endpoints that returned stored LLM API keys in plaintext and accepted an attacker-chosen ollama_base_url, which turns the server into an SSRF probe toward cloud metadata (issue #6081).
• CVE-2026-19334 (CVSS 3.1 5.3, 9 August): command injection in the community Ollama-mcp server through model and file name arguments, local attack only. The record says the maintainer had not responded and, being a rolling release, there is no fixed version.

A 15-minute audit for your agent host

1. List listening ports (ss -ltnp on Linux) and match every one to a component you chose to install. Anything bound to 0.0.0.0 that is not your reverse proxy needs a reason.
2. Find who can write the agent's config. For Hermes Agent that is config.yaml, for OpenClaw its config directory. Only the agent's own user should, and no web UI should write it for you.
3. Read the metadata of every skill or plugin, not only its code: install and uninstall hooks, paths it declares, permissions it asks for. Remove what you do not use.
4. Keep API keys out of add-ons that do not need them, and give each add-on its own key with a spend limit so a leak is contained.
5. Upgrade or remove the affected versions above: pinclaw after 0.3.0, LobsterAI after 2026.9.23, 9router after 0.5.99, and a current mem0.

Keep watching

We track CVEs for the agents themselves on OpenClaw CVEs and the agents tracker, and the October core fixes for the servers under them in Ollama /api/pull CVEs and Open WebUI 0.11.4. To check the versions in your own docker-compose.yml or package.json, use the stack scanner.