OpenClaw 4.2 Task Flows Go Live, Exec Preflight Gets Hardened, and the Security Sweep Continues

Release

OpenClaw 2026.4.2: Task Flows Now Durable, Android Gets Google Assistant, HTTP Security Overhauled

Task Flows are the biggest architectural change here: background jobs now persist across restarts with clean cancel propagation and a new plugin API for orchestrating multi-step workflows. The centralized HTTP security overhaul is equally important for anyone running OpenClaw on shared or public infrastructure.

OpenClaw 2026.4.1 Release Notes: Voice Wake, /tasks Chat Board, and Cron Tool Allowlists

The cron tool allowlist flag is the practical security win here: you can now scope each scheduled job to only the tools it actually needs, which meaningfully limits blast radius if a job goes sideways. Voice Wake on macOS is a quality-of-life addition, but least-privilege cron is the feature worth acting on.

Security

Merged: Fix Fail-Open Bypass in Exec Script Preflight (PR #59398)

The old exec preflight silently skipped validation for piped, shell-wrapped, and process-substitution command forms, which let an attacker route injection payloads straight through. The fix adds a fail-closed guard that throws instead of returning quietly, covering the quoted-path bypass too.

CVE-2026-33579 Deep Dive: Why the OpenClaw Pairing Subsystem Keeps Producing Auth Failures

Six pairing-related CVEs in six weeks points to structural architectural debt, not bad luck. With 63% of 135K+ exposed instances running without any authentication, the official CVSS rating of 'low privileges required' dramatically understates real-world risk.