OpenClaw v2026.10.10 is out, and upgrading from 2026.10.7 passes two security releases

OpenClaw published v2026.10.10 on 3 November 2026, and the GitHub releases page marks it Latest, so openclaw update on the stable channel is what takes you to it. The reason to run it is mostly not in this release. If you are on 2026.10.7, which is the last version we covered, the upgrade also carries the two releases in between, and the documentation pages for both 2026.10.8 and 2026.10.9 have a Security and Privacy section. Take the update, and restart the Gateway afterwards if you are coming from below 2026.10.8.

#What is actually in v2026.10.10?

Three features the notes give their own headings, and a long tail of quality-of-life work.

The Chat Details panel gathers session information and task progress beside the conversation. On wide panes it opens next to the chat, it hides automatically when an auto-opened panel's pane narrows, and a Details button toggles it.

The Advisor is experimental and off by default. You enable it in Settings, System, Labs, and it checks work in progress and may suggest a correction when it sees a clear wrong turn. The notes are unusually direct about the cost and the limits: it uses extra model calls, and it "can miss a problem or suggest an unnecessary change." That is a feature to turn on deliberately rather than one to leave running.

Split speech voice mode is an optional mode for browser Talk that uses the chat model for replies while transcription and speech are configured separately. The notes say it has no realtime voice switching and no camera input, and that you configure speech output and transcription before using it.

Beyond those three the page runs a long Quality-of-life improvements group, with subsections for conversations and navigation, performance and diagnostics, cloud workspaces, setup, updates and documentation, models, voice and media, and skills, plugins and automations. Nothing on the page is labelled a breaking change.

For verification, the GitHub release entry publishes a release SHA of 7dc3350cb9f08fcf9a0af5c4845a20d5b2f1a8be and an npm package version of 2026.10.10, and its contribution record reads "4,825 commits · 3,028 pull requests · 454 contributors". The Android APK was skipped for this release: the entry notes that apps/android/version.json is 2026.8.2 against a 2026.10.10 release train, with pnpm android:version:pin -- --from-gateway to run before the next tag.

#Why does the upgrade matter more than the release?

Because the security work is in 2026.10.8 and 2026.10.9, and those are the two versions a reader on 2026.10.7 skipped. Neither has been covered here before. The Security and Privacy section of each page lists seven entries, and the 2026.10.9 page says only "Update OpenClaw to receive these fixes" as the action required.

Both counts are what those Security and Privacy sections showed us. They are not a claim about everything either release changed: these are long pages, and our reads of them were truncated.

#What did 2026.10.8 and 2026.10.9 fix?

In 2026.10.8, the entries that change what an agent can reach are the ones to read first. Two are containment failures. One reads "Fixes sandboxed child agents being able to launch a CLI model outside their sandbox", and the notes add that you should "Use an API-backed child model, or explicitly change the sandbox policy if you need a host CLI." The other reads "Fixes agents bypassing browser-tool restrictions by invoking the paired node's browser proxy through the generic Nodes tool." If you have been relying on browser-tool restrictions or on a sandbox boundary to limit a child agent, those are the two lines that say the boundary was not holding.

The same release adds the certificate work: "Adds remediations for the eMudhra certificate compromise in the secret egress proxy and its exported trust bundle." It tells you to restart the Gateway to apply it, and warns that connections relying only on the excluded root will fail and that apps with independent trust stores and bypass tunnels need their own updates. Our post on v2026.10.6 covers the Node requirement that earlier release introduced for the same compromise. We did not re-verify those version numbers for this article, so read that page and the 2026.10.6 notes before upgrading from below it.

Two more in 2026.10.8 are disclosure fixes: "Fixes Fish Audio and Gradium errors exposing an active API key when the provider echoes it back", and "Fixes some cases where a model's thinking appeared in streamed answers despite reasoning visibility being turned off."

In 2026.10.9 the pattern is dependency upgrades and output masking. The parsing entries are "MCP tools now reject malformed addresses in their input definitions and follow valid relative links correctly", attributed on the page to a fast-uri upgrade, and a fix for "IMAP sender checks accepting a spoofed message when a trusted address is hidden inside nested comments in its From header", attributed to a Nodemailer update. The page also records a library flaw affecting Microsoft Teams and Azure sign-ins "that could send application credentials to the wrong destination."

Then two that matter if you share a workspace or read logs: "Workspace-only restrictions now apply to Gateway-built delegation and media tools, so restricted setting changes require approval and media reads stay within the allowed folders", and "MCP command-line inspection now hides recognized credentials instead of exposing them in terminal output and captured transcripts." A third adds that "Google sign-in client secrets are now masked in console and log-tail output."

One caution on the parsing work rather than a breaking label: the fast-uri entry notes that malformed schema identifiers previously accepted "may now fail validation", so a configuration that worked on 2026.10.8 can be rejected on 2026.10.9.

If you want the standing version of this argument rather than one release's worth, our OpenClaw security hardening guide covers the permission surfaces an agent exposes.

#Which version should you be running?

On the stable channel, 2026.10.10. The releases page still does not sort the way version numbers do, and the two parts of the project still disagree about what is current.

Two things on that table are worth saying plainly. The first is the documentation lag, which is now a pattern rather than an incident: the GitHub page marks 2026.10.10 Latest while https://docs.openclaw.ai/releases labels 2026.10.9 as latest. We follow the GitHub entry because it is dated and carries full notes, and we noted the same disagreement, one release behind, when we wrote up v2026.10.7.

The second is a correction to a reasonable assumption. That earlier article noted that 2026.10.10-beta.3 was a pre-release carrying a higher number than stable. Stable has now reached that number, so 2026.10.10 without a suffix is the stable release and 2026.10.10-beta.5 is still a pre-release beside it. The version number alone no longer tells you which line you are looking at; the Latest badge and the pre-release label do.

#How do you upgrade?

The documented path is the built-in updater, and the reference page's usage block includes a preview flag worth taking first:

openclaw update --dry-run
openclaw update

The options table describes --dry-run as "Preview planned actions (channel/tag/target/restart flow) without writing config, installing, syncing plugins, or restarting." The same usage block lists openclaw update status and openclaw update repair, but that page documents them by name and cross-reference rather than describing what they do, so we are not characterising either here beyond what it says: update status --json reports channel, availability and the latest durable update report.

Channel switching remains an explicit flag rather than something that happens by accident:

openclaw update --channel extended-stable

#What do you need to do by hand?

More than usual, and most of it is conditional. From 2026.10.8, restart the Gateway to apply the certificate change, and expect to add an allowlist entry or grant approval where POSIX exec allowlists "no longer automatically trust test -v or [ -v predicates." From 2026.10.10's own notes, the ones most likely to catch you out:

• Personal navigation shortcuts do not carry over. Re-add them.
• Check your Gemini default. Google API-key setup now selects Gemini 4 Argon as the primary model.
• Existing setupEnv profiles. Run openclaw doctor --fix and bind stored secrets to destinations before new provisioning.
• External HTTP hooks. Supply the secret to the Gateway service and reload or restart, or disable the hooks.
• MCP events. Forward only /plugins/mcp-events/callback/ to the Gateway, not the rest of OpenClaw.
• Before downgrading. Remove event jobs and check database compatibility; older versions also will not enforce conversation communication preferences.
• Content tracing. Review the settings before upgrading, because traces can include additional redacted conversation data.

If the upgrade leaves you worse off, the troubleshooting guide is the place to start and the migration guide covers version moves that change configuration.

#What we could not confirm

Any CVE or GHSA identifier for the 2026.10.8 and 2026.10.9 remediations. None of the release pages we read names one. We did not search OpenClaw's advisory list for this article, so this is a statement about the release notes and not about whether advisories exist.

Whether the Security and Privacy lists are complete. Both documentation pages are long and our reads of them were truncated partway through. The seven entries per release are what those sections showed us, and we have not read either page end to end.

A severity rating for any of the fixes. The notes rate none of them, so none is given here. Calling a sandbox escape critical would be our judgement presented as the vendor's.

The exact publication time zone. The GitHub releases page shows timestamps like "03 Nov 03:22" with no year and no time zone. The year comes from the calendar version tag and from the release carrying the Latest badge today.

#Where to go next

If you are on 2026.10.7 or below, preview the update, take it, and restart the Gateway. Then check the two things 2026.10.8 says were not holding: whether you depend on a child-agent sandbox boundary, and whether you depend on browser-tool restrictions.

The OpenClaw platform hub tracks the setup and hardening guides, and what OpenClaw is is the place to start if you have arrived here without one installed.