Skip to content

Commit 89a6591

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-74wf-h43j-vvmj GHSA-844j-xrrq-wgh4 GHSA-8883-9w57-vwv6 GHSA-cfp9-w5v9-3q4h GHSA-j4c9-w69r-cw33 GHSA-x2cm-hg9c-mf5w
1 parent 01336b3 commit 89a6591

6 files changed

Lines changed: 125 additions & 20 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-74wf-h43j-vvmj/GHSA-74wf-h43j-vvmj.json‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-74wf-h43j-vvmj",
4-
"modified": "2026-04-10T17:25:27Z",
4+
"modified": "2026-04-10T19:42:11Z",
55
"published": "2026-03-26T21:46:42Z",
66
"aliases": [
77
"CVE-2026-35655"
88
],
99
"summary": "OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting",
1010
"details": "## Summary\nACP permission resolution trusted conflicting tool identity hints from rawInput and metadata, which could suppress dangerous-tool prompting.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: < 2026.3.22\n- Fixed: >= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `e4c61723cd2d530680cc61789311d464ab8cdf60`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/acp/client.ts now fails closed when meta, rawInput, and title tool identities conflict instead of trusting spoofable raw input.\n- src/acp/client.test.ts ships regressions for conflicting tool identity hints and dangerous-tool prompting.\n\nOpenClaw thanks @zpbrent for reporting.",
1111
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
15+
},
1216
{
1317
"type": "CVSS_V4",
14-
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
1519
}
1620
],
1721
"affected": [
@@ -40,23 +44,35 @@
4044
"type": "WEB",
4145
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-74wf-h43j-vvmj"
4246
},
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35655"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"
54+
},
4355
{
4456
"type": "WEB",
4557
"url": "https://github.com/openclaw/openclaw/commit/e4c61723cd2d530680cc61789311d464ab8cdf60"
4658
},
4759
{
4860
"type": "PACKAGE",
4961
"url": "https://github.com/openclaw/openclaw"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://www.vulncheck.com/advisories/openclaw-identity-spoofing-via-rawinput-tool-in-acp-permission-resolution"
5066
}
5167
],
5268
"database_specific": {
5369
"cwe_ids": [
5470
"CWE-807",
5571
"CWE-863"
5672
],
57-
"severity": "HIGH",
73+
"severity": "MODERATE",
5874
"github_reviewed": true,
5975
"github_reviewed_at": "2026-03-26T21:46:42Z",
60-
"nvd_published_at": null
76+
"nvd_published_at": "2026-04-10T17:17:06Z"
6177
}
6278
}

‎advisories/github-reviewed/2026/03/GHSA-844j-xrrq-wgh4/GHSA-844j-xrrq-wgh4.json‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-844j-xrrq-wgh4",
4-
"modified": "2026-04-10T17:25:44Z",
4+
"modified": "2026-04-10T19:43:21Z",
55
"published": "2026-03-26T21:42:30Z",
66
"aliases": [
77
"CVE-2026-35656"
88
],
99
"summary": "OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection",
1010
"details": "## Summary\nWhen gateway.trustedProxies was configured, spoofed loopback hops in forwarding headers could be accepted as the client origin and weaken downstream auth and rate-limit decisions.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: < 2026.3.22\n- Fixed: >= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `fc2d29ea926f47c428c556e92ec981441228d2a4`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/gateway/net.ts now ignores loopback forwarded hops before trusted-proxy client resolution.\n- That shipped origin fix is the one consumed by canvas auth and gateway auth-rate-limit paths that rely on resolved client identity.\n\nOpenClaw thanks @lintsinghua for reporting.",
1111
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
15+
},
1216
{
1317
"type": "CVSS_V4",
14-
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
1519
}
1620
],
1721
"affected": [
@@ -40,13 +44,25 @@
4044
"type": "WEB",
4145
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-844j-xrrq-wgh4"
4246
},
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35656"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"
54+
},
4355
{
4456
"type": "WEB",
4557
"url": "https://github.com/openclaw/openclaw/commit/fc2d29ea926f47c428c556e92ec981441228d2a4"
4658
},
4759
{
4860
"type": "PACKAGE",
4961
"url": "https://github.com/openclaw/openclaw"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://www.vulncheck.com/advisories/openclaw-xff-loopback-spoofing-bypass-in-canvas-authentication-and-rate-limiter"
5066
}
5167
],
5268
"database_specific": {
@@ -56,6 +72,6 @@
5672
"severity": "MODERATE",
5773
"github_reviewed": true,
5874
"github_reviewed_at": "2026-03-26T21:42:30Z",
59-
"nvd_published_at": null
75+
"nvd_published_at": "2026-04-10T17:17:06Z"
6076
}
6177
}

‎advisories/github-reviewed/2026/03/GHSA-8883-9w57-vwv6/GHSA-8883-9w57-vwv6.json‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8883-9w57-vwv6",
4-
"modified": "2026-04-10T17:23:59Z",
4+
"modified": "2026-04-10T19:41:54Z",
55
"published": "2026-03-26T21:23:04Z",
66
"aliases": [
77
"CVE-2026-35652"
88
],
99
"summary": "OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions",
1010
"details": "## Summary\nMattermost interactive callback dispatch could run action handlers before normal sender authorization checks completed.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: < 2026.3.22\n- Fixed: >= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- extensions/mattermost/src/mattermost/interactions.ts now requires callback authorization before dispatching actions.\n- extensions/mattermost/src/mattermost/monitor.ts routes callback authorization through the same sender and allowlist policy used for normal ingress.\n\nOpenClaw thanks @zpbrent for reporting.",
1111
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
15+
},
1216
{
1317
"type": "CVSS_V4",
14-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
1519
}
1620
],
1721
"affected": [
@@ -40,23 +44,36 @@
4044
"type": "WEB",
4145
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-8883-9w57-vwv6"
4246
},
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35652"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"
54+
},
4355
{
4456
"type": "WEB",
4557
"url": "https://github.com/openclaw/openclaw/commit/a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66"
4658
},
4759
{
4860
"type": "PACKAGE",
4961
"url": "https://github.com/openclaw/openclaw"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://www.vulncheck.com/advisories/openclaw-unauthorized-action-execution-via-callback-dispatch"
5066
}
5167
],
5268
"database_specific": {
5369
"cwe_ids": [
5470
"CWE-285",
71+
"CWE-696",
5572
"CWE-863"
5673
],
5774
"severity": "MODERATE",
5875
"github_reviewed": true,
5976
"github_reviewed_at": "2026-03-26T21:23:04Z",
60-
"nvd_published_at": null
77+
"nvd_published_at": "2026-04-10T17:17:05Z"
6178
}
6279
}

‎advisories/github-reviewed/2026/03/GHSA-cfp9-w5v9-3q4h/GHSA-cfp9-w5v9-3q4h.json‎

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cfp9-w5v9-3q4h",
4-
"modified": "2026-04-10T17:26:28Z",
4+
"modified": "2026-04-10T19:43:38Z",
55
"published": "2026-03-26T21:48:06Z",
66
"aliases": [
77
"CVE-2026-35658"
88
],
99
"summary": "OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts",
1010
"details": "## Summary\nThe `image` tool did not fully honor the `tools.fs.workspaceOnly` filesystem boundary. In affected releases, image-path resolution could still traverse sandbox bridge mounts outside the workspace and read files from mounted directories that the other file tools would reject.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `< 2026.3.2`\n- Fixed: `>= 2026.3.2`\n- Latest released tags checked: `v2026.3.23` (`ccfeecb6887cd97937e33a71877ad512741e82b2`) and `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53`\n- `14baadda2c456f3cf749f1f97e8678746a34a7f4`\n\n## Release Status\nThe complete fix shipped in `v2026.3.2` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- `src/agents/openclaw-tools.ts` now passes `fsPolicy` into `createImageTool`, so the image tool receives the same workspace-only policy input as the other filesystem tools.\n- `src/agents/tools/image-tool.ts`, `src/agents/tools/media-tool-shared.ts`, and `src/agents/sandbox-media-paths.ts` now restrict local roots and sandbox-bridge resolution to the workspace when `tools.fs.workspaceOnly` is enabled.\n\nOpenClaw thanks @YLChen-007 for reporting.",
1111
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
15+
},
1216
{
1317
"type": "CVSS_V4",
14-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
1519
}
1620
],
1721
"affected": [
@@ -40,26 +44,43 @@
4044
"type": "WEB",
4145
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-cfp9-w5v9-3q4h"
4246
},
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35658"
50+
},
4351
{
4452
"type": "WEB",
4553
"url": "https://github.com/openclaw/openclaw/commit/14baadda2c456f3cf749f1f97e8678746a34a7f4"
4654
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/openclaw/openclaw/commit/ccfeecb6887cd97937e33a71877ad512741e82b2"
62+
},
4763
{
4864
"type": "WEB",
4965
"url": "https://github.com/openclaw/openclaw/commit/dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53"
5066
},
5167
{
5268
"type": "PACKAGE",
5369
"url": "https://github.com/openclaw/openclaw"
70+
},
71+
{
72+
"type": "WEB",
73+
"url": "https://www.vulncheck.com/advisories/openclaw-filesystem-boundary-bypass-in-image-tool"
5474
}
5575
],
5676
"database_specific": {
5777
"cwe_ids": [
78+
"CWE-668",
5879
"CWE-863"
5980
],
6081
"severity": "MODERATE",
6182
"github_reviewed": true,
6283
"github_reviewed_at": "2026-03-26T21:48:06Z",
63-
"nvd_published_at": null
84+
"nvd_published_at": "2026-04-10T17:17:07Z"
6485
}
6586
}

‎advisories/github-reviewed/2026/03/GHSA-j4c9-w69r-cw33/GHSA-j4c9-w69r-cw33.json‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,23 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j4c9-w69r-cw33",
4-
"modified": "2026-04-10T17:27:24Z",
4+
"modified": "2026-04-10T19:43:56Z",
55
"published": "2026-03-29T15:50:23Z",
66
"aliases": [
77
"CVE-2026-35661"
88
],
99
"summary": "OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State",
1010
"details": "## Summary\n\nTelegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `<= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nTelegram callback queries from direct messages previously used weaker callback-only authorization and could mutate session state without satisfying normal DM pairing. Commit `269282ac69ab6030d5f30d04822668f607f13065` enforces DM authorization for callbacks.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `269282ac69ab6030d5f30d04822668f607f13065`.\n\n## Fix Commit(s)\n\n- `269282ac69ab6030d5f30d04822668f607f13065`",
11-
"severity": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
15+
},
16+
{
17+
"type": "CVSS_V4",
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
19+
}
20+
],
1221
"affected": [
1322
{
1423
"package": {
@@ -38,23 +47,32 @@
3847
"type": "WEB",
3948
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c9-w69r-cw33"
4049
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35661"
53+
},
4154
{
4255
"type": "WEB",
4356
"url": "https://github.com/openclaw/openclaw/commit/269282ac69ab6030d5f30d04822668f607f13065"
4457
},
4558
{
4659
"type": "PACKAGE",
4760
"url": "https://github.com/openclaw/openclaw"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://www.vulncheck.com/advisories/openclaw-telegram-dm-scoped-inline-button-callback-authorization-bypass"
4865
}
4966
],
5067
"database_specific": {
5168
"cwe_ids": [
5269
"CWE-285",
70+
"CWE-288",
5371
"CWE-863"
5472
],
5573
"severity": "MODERATE",
5674
"github_reviewed": true,
5775
"github_reviewed_at": "2026-03-29T15:50:23Z",
58-
"nvd_published_at": null
76+
"nvd_published_at": "2026-04-10T17:17:07Z"
5977
}
6078
}

‎advisories/github-reviewed/2026/03/GHSA-x2cm-hg9c-mf5w/GHSA-x2cm-hg9c-mf5w.json‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-x2cm-hg9c-mf5w",
4-
"modified": "2026-04-10T17:27:44Z",
4+
"modified": "2026-04-10T19:42:27Z",
55
"published": "2026-03-26T21:44:41Z",
66
"aliases": [
77
"CVE-2026-35662"
88
],
99
"summary": "OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions",
1010
"details": "## Summary\nLeaf subagents could still use the send action to message controlled child sessions even when their controlScope was narrower than children.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: < 2026.3.22\n- Fixed: >= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `7679eb375294941b02214c234aff3948796969d0`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/auto-reply/reply/commands-subagents/action-send.ts now threads controller context through the send path.\n- src/agents/subagent-control.ts now blocks send attempts unless the requester owns the target and has controlScope=\"children\".\n\nOpenClaw thanks @space08 for reporting.",
1111
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
15+
},
1216
{
1317
"type": "CVSS_V4",
14-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
1519
}
1620
],
1721
"affected": [
@@ -40,22 +44,35 @@
4044
"type": "WEB",
4145
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-x2cm-hg9c-mf5w"
4246
},
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35662"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"
54+
},
4355
{
4456
"type": "WEB",
4557
"url": "https://github.com/openclaw/openclaw/commit/7679eb375294941b02214c234aff3948796969d0"
4658
},
4759
{
4860
"type": "PACKAGE",
4961
"url": "https://github.com/openclaw/openclaw"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://www.vulncheck.com/advisories/openclaw-missing-controlscope-enforcement-in-send-action"
5066
}
5167
],
5268
"database_specific": {
5369
"cwe_ids": [
54-
"CWE-285"
70+
"CWE-285",
71+
"CWE-862"
5572
],
5673
"severity": "MODERATE",
5774
"github_reviewed": true,
5875
"github_reviewed_at": "2026-03-26T21:44:41Z",
59-
"nvd_published_at": null
76+
"nvd_published_at": "2026-04-10T17:17:07Z"
6077
}
6178
}

0 commit comments

Comments
 (0)