OpenClaw v2026.5.7: Active Memory Security Fix, Discord Routing, and Channels CLI Overhaul

OpenClaw released v2026.5.7 on May 7, delivering a mix of security hardening, CLI improvements, and quality-of-life fixes across channels, plugins, and cron tooling.

Security: Active Memory Admin Scope Fix

The headline change is a security fix for Active Memory: global memory toggles now require admin scope, closing an authorization gap where non-admin users could potentially modify memory state. This follows the pattern of recent hardening across the platform.

Discord: Channel Routing Fix

A significant bug in Discord message dispatch has been patched. Provider-prefixed targets like discord:channel: were being misparsed as legacy DM targets, causing message(action="send") calls to misroute channel IDs into misleading “Unknown Channel” failures. Cross-channel agent messaging should now work correctly.

Channels CLI Redesign

The openclaw channels list command has been reworked:

  • Channel-only by default — lists only configured channels
  • --all flag — includes bundled and catalog channels
  • New state rendering — shows installed/configured/enabled state clearly
  • Model auth/usage moved — now accessible via openclaw models auth list, openclaw status, and openclaw models list

Other Notable Fixes

  • Tavily credentials: API keys backed by SecretRef now resolve correctly at runtime instead of arriving unresolved to the tools
  • Plugin install PATH: npm lifecycle shell now uses absolute POSIX paths, preventing restricted shells from breaking cleanup during plugin uninstall
  • Discord provider-prefixed targets: cross-channel agent sends no longer misroute
  • Compaction token clamping: high-context compaction no longer requests invalid max_tokens values by clamping to model output limits
  • Sessions/Context Engine: cached context views invalidate when history shrinks, preventing stale pre-reset history from being reused

New This Release

  • openai/chat-latest is now a valid direct API-key model override for the moving ChatGPT Instant API alias
  • Cron CLI now includes computed status in cron list --json and cron show --json output for external tooling
  • /btw now shows proper missing-question placeholder with visible brackets

Full changelog: github.com/openclaw/openclaw/releases

← Back to News