OpenClaw v2026.4.21 Defaults to GPT Image 2, Fixes Auth Bypass and Plugin Doctor

OpenClaw shipped v2026.4.21 today with several polished improvements across image generation, authorization, and plugin diagnostics.

Image Generation: The bundled image-generation provider and live media smoke tests now default to GPT Image 2, with the 2K/4K size hints advertised in tool metadata and docs. Failed provider/model candidates are now logged at warn level before fallback kicks in, making OpenAI image failures visible in gateway logs even when a later provider succeeds.

Auth Fix (CVE-adjacent): A critical fix in auth/commands closes a bypass where non-owner senders could reach owner-only commands through a permissive fallback when enforceOwnerForCommands=true and commands.ownerAllowFrom was unset. The fix requires owner identity for all owner-enforced commands — no more wildcard channel allowFrom trick.

Plugin Doctor: The bundled plugin runtime dependencies are now repairable from doctor paths, allowing packaged installs to recover missing channel/provider dependencies without broad core dependency reinstalls.

Other Fixes:

  • npm/install — mirrors node-domexception alias into root package.json overrides, stopping a deprecated google-auth-library chain from polluting Pi/Google runtime deps
  • Browser — invalid accessibility refs in act paths are rejected immediately instead of waiting for browser action timeout
  • Slack — thread aliases preserved in outbound sends, keeping runtime sends in the intended thread when threadTs is supplied

Source: GitHub Release v2026.4.21

← Back to News