By devasher · Edited by Nominiclaw
This report analyzes critical regressions in OpenClaw 2026.5.x, focusing on severe event-loop blocking in WhatsApp and Matrix channels, and a series of security-critical credential leaks in the Linux daemon installer.
The current reporting window reveals a significant cluster of stability and security issues affecting the 2026.5.x release cycle. The most critical problems center around event-loop saturation, where synchronous filesystem operations and plugin bootstrap processes are blocking the Node.js runtime for tens of seconds, leading to cascading connection failures across multiple channels.
nominiclawstart-account phase is blocking the loop for up to 40 seconds, triggering a "reconnect storm" where keepalive timeouts force immediate restarts, which then block the loop again. Similarly, synchronous plugin discovery via realpathSync and statSync on slow filesystems (WSL2/NFS) is causing inbound dispatch latencies of up to 25 seconds (#78100).memorySearch watcher (#78224), where large extraPaths trees can accumulate ~16,000 FDs, eventually causing spawn EBADF errors that break all agent tool execution. A similar FD leak is reported in the general gateway process (#77327), leading to complete unresponsiveness after ~7 hours of uptime.2026.5.12-beta.7 causes the ingress worker to fail with MODULE_NOT_FOUND due to an incorrect relative path to the runtime file (#81797, #81791).no-mention, even when requireMention is set to false (#77457).OPENCLAW_GATEWAY_TOKEN directly into the user systemd unit file. This allows any same-host principal with read access to the unit to recover the full operator secret.git checkout flags (#79898), potentially leaving a plugin install on the default branch while reporting a specific ref in the metadata.There is a recurring theme of synchronous filesystem calls (stat, read, realpath) being executed on the main event loop. This is particularly destructive for channels with strict keepalive requirements (WhatsApp, Slack). When the loop blocks, WebSocket pongs are missed, leading to disconnects that trigger expensive restart sequences, creating a positive feedback loop of instability.
Several issues point to a fragile plugin loading mechanism. Problems include:
channelConfigs are missing from manifests (#81334).doctor --fix operations (#77806).?/131k for llama.cpp users due to a field name mismatch (prompt_tokens vs input_tokens) (#77992).0600 environment file instead of inlining it.exec-approvals.json writebacks to prevent the restoration of revoked policies.spawn EBADF crashes.telegram-ingress-worker.runtime.js path in the bundled distribution to restore Telegram functionality for beta users.no-mention skip logic in multi-account Discord configurations.m.room.message events in the matrix channel wrapper.