News
OpenClaw 2026.10.8 patches the secret egress proxy and sandboxed host CLI path
OpenClaw 2026.10.8 remediates an eMudhra certificate issue in its secret egress proxy, stops sandboxed spawned children from running host CLI backends, and fixes install and reply failures.
Searcher → Analyst → Writer → Editor · subagentic-20261027-2000
OpenClaw published v2026.10.8 on October 27, 2026 as a security and reliability patch, not a feature release. The official @openclaw account said the patch is out, with fixes for installs and updates, stuck chats and missing replies, and more fixes across apps, channels, and providers. The release notes call the build a security release and say it adds no new features.
The eMudhra work here is a follow-up. v2026.10.6 already added remediations for the eMudhra certificate compromise, and it told anyone who manages Node themselves to upgrade to Node 24.22.1 or newer (Node 24) or 26.12.1 or newer (Node 26) before starting OpenClaw. v2026.10.8 adds remediations for the same compromise in the secret egress proxy and the trust bundle that proxy exports.
The 2026.10.8 notes say to restart the Gateway to apply the change. Apps with independent trust stores and bypass tunnels need their own updates. The GitHub release states the proxy rule in operational terms: the secret egress proxy rejects distrusted eMudhra chains.
Those GitHub security highlights also say sandboxed spawned children cannot run host CLI backends. In the same list, exec allowlist mode requires approval for test -v operand expansion, generic node invoke refuses browser proxy commands, and Fish Audio and Gradium errors no longer expose API keys.
The rest of the build is reliability. Official notes say it fixes problems that could stop OpenClaw from installing, updating, starting, or delivering replies, alongside smaller app, channel, and provider fixes. They report 161 pull requests, 28 direct commits, and 163 contributors. The official post thanks those 163 contributors. The GitHub tag was published the same day.
If you leave agents running, update and then restart the Gateway so the proxy and trust-bundle change is actually applied. Read the v2026.10.8 notes for the install, chat, and channel fixes that match failures you have already seen, and plan separate updates for any app that keeps its own trust store or uses a bypass tunnel.