ClawHosters
by Daniel Samer
3 min read
OpenClaw v2026.3.11 dropped on March 12, 2026. If you're running a self-hosted instance, stop reading and update now. There's a security fix in this one that you don't want to skip.
The version jumps straight from v2026.3.8, skipping 3.9 and 3.10 entirely.
The WebSocket Vulnerability
Security researchers at Oasis Security discovered a cross-site WebSocket hijacking flaw in trusted-proxy mode (tracked as GHSA-5wcw-8jjv-m286). In short, a malicious website could trick a browser into opening a WebSocket connection to your OpenClaw instance and gain operator.admin access. Not great.
The fix enforces browser origin validation for all browser-originated connections, regardless of what proxy headers say. If you've been relying on trusted-proxy mode, this is a big deal.
We've covered OpenClaw security topics before in our security hardening guide and our coverage of the Safety Scanner in v2026.2.6. This vulnerability is probably the most serious one we've seen patched so far.
Ollama Gets First-Class Treatment
For anyone running local models, this release is a turning point. OpenClaw now ships with a proper Ollama onboarding wizard that walks you through setup with Local and Cloud+Local modes, browser-based cloud sign-in, and curated model suggestions.
Running ollama launch openclaw handles the full setup flow. No more cobbling together config files manually.
This pairs nicely with our free LLM API options if you're exploring cost-effective ways to run your instance.
What Else Ships in OpenClaw v2026.3.11
A quick rundown of the other highlights from the release notes.
iOS Home Canvas redesign. The welcome screen now includes a live agent overview with a docked toolbar replacing the old floating controls.
Multimodal Memory. Opt-in image and audio indexing using gemini-embedding-2-preview with configurable output dimensions.
ACP Session Resume. Spawned ACP sessions can now continue existing conversations via resumeSessionId.
And over 100 documented fixes across the board, as reported by The Droid Guy.
Breaking Change in OpenClaw v2026.3.11
Cron notification delivery got tightened in this release. If you don't run openclaw doctor --fix before upgrading to OpenClaw v2026.3.11, you risk silent notification failures. Self-hosters, take note.
ClawHosters customers? Your managed instances are already running OpenClaw v2026.3.11. No action needed on your end. Check out our security overview if you want the details, or browse our managed hosting plans if you're tired of handling updates yourself.
