[{"ghsa_id":"GHSA-rx8p-qcpv-c7vr","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-rx8p-qcpv-c7vr","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rx8p-qcpv-c7vr","summary":"Prometheus diagnostics could omit operator.read enforcement","description":"### Summary\n\nThe OpenClaw Prometheus diagnostics plugin did not enforce `operator.read` for its authenticated metrics endpoint. An identity-bearing Gateway caller whose effective role had no read scope could retrieve the diagnostics document even though ordinary read methods rejected the same identity.\n\n### Impact\n\nDeployments using the Prometheus plugin with trusted-proxy or another identity-bearing authentication mode could expose operational metrics to an authenticated profile that was intentionally limited below read access. Shared-secret Gateway callers already have the documented full operator scope set and do not create this condition.\n\n### Patched Versions\n\nThe first stable patched version is `2026.9.3`.\n\n### Mitigations\n\nUpgrade the `@openclaw/diagnostics-prometheus` plugin to `2026.9.3` or later. Until upgraded, disable the Prometheus endpoint or ensure every identity allowed to reach it is intended to hold `operator.read`.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-rx8p-qcpv-c7vr","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:45Z","published_at":"2026-09-11T00:58:45Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/diagnostics-prometheus"},"vulnerable_version_range":"< 2026.9.3","patched_versions":"2026.9.3","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-862"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3}},{"ghsa_id":"GHSA-xvwp-wmh2-fq48","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-xvwp-wmh2-fq48","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xvwp-wmh2-fq48","summary":"Discord asset uploads could skip sender media policy","description":"### Summary\n\nDiscord emoji and sticker upload actions could lose the sender-scoped media policy before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same sender's configured media roots would otherwise reject.\n\n### Impact\n\nAffected Discord deployments could place bytes from an out-of-policy local file into an outbound emoji or sticker upload. Exploitation requires access to the guild asset action and knowledge or derivation of a useful local path. The issue did not provide unrestricted filesystem browsing or code execution.\n\n### Patched Versions\n\nThe first stable patched version is `2026.9.3`.\n\n### Mitigations\n\nUpgrade `@openclaw/discord` to `2026.9.3` or later. Until upgraded, deny Discord emoji and sticker upload actions to lower-trust senders and keep their media roots limited to directories that contain no sensitive files.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-xvwp-wmh2-fq48","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:55Z","published_at":"2026-09-11T00:58:55Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/discord"},"vulnerable_version_range":"< 2026.9.3","patched_versions":"2026.9.3","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-862"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.3}},{"ghsa_id":"GHSA-5j57-84cx-r295","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-5j57-84cx-r295","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295","summary":"iOS deep-link logs could expose unattended credentials","description":"### Summary\n\nOpenClaw for iOS logged the complete unattended-agent deep-link URL as public diagnostic data. The URL could contain a persistent bearer key together with message and delivery parameters, leaving the credential available in copied unified logs or diagnostic archives.\n\n### Impact\n\nA party that obtained affected logs could reuse an unrotated key in a forged deep link to submit attacker-chosen agent requests without the normal local confirmation. Exploitation also required a legitimate keyed link to have been processed and a way to invoke the custom URL scheme on the connected device. Invalid or absent keys still required confirmation.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.11`.\n\n### Mitigations\n\nUpgrade OpenClaw for iOS to `2026.8.11` or later. Rotate unattended deep-link keys that may appear in affected diagnostics, remove retained diagnostic archives containing those links, and avoid sharing device logs from affected versions.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-5j57-84cx-r295","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:28Z","published_at":"2026-09-11T00:57:28Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"other","name":"OpenClaw iOS"},"vulnerable_version_range":"< 2026.8.11","patched_versions":"2026.8.11","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"cwe_ids":["CWE-532"],"credits":[{"login":"jason-allen-oneal","type":"reporter"}],"credits_detailed":[{"user":{"login":"jason-allen-oneal","id":8335428,"node_id":"MDQ6VXNlcjgzMzU0Mjg=","avatar_url":"https://avatars.githubusercontent.com/u/8335428?v=4","gravatar_id":"","url":"https://api.github.com/users/jason-allen-oneal","html_url":"https://github.com/jason-allen-oneal","followers_url":"https://api.github.com/users/jason-allen-oneal/followers","following_url":"https://api.github.com/users/jason-allen-oneal/following{/other_user}","gists_url":"https://api.github.com/users/jason-allen-oneal/gists{/gist_id}","starred_url":"https://api.github.com/users/jason-allen-oneal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jason-allen-oneal/subscriptions","organizations_url":"https://api.github.com/users/jason-allen-oneal/orgs","repos_url":"https://api.github.com/users/jason-allen-oneal/repos","events_url":"https://api.github.com/users/jason-allen-oneal/events{/privacy}","received_events_url":"https://api.github.com/users/jason-allen-oneal/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.3}},{"ghsa_id":"GHSA-m78m-7h3q-q938","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-m78m-7h3q-q938","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m78m-7h3q-q938","summary":"Browser relay authentication could exhaust shared pending capacity","description":"### Summary\n\nThe Browser extension relay reserved entries in a single global pending-authentication pool before a client proved possession of the relay key. An unauthenticated network source could hold every pending slot and prevent a paired extension from completing Browser Relay Authentication v2.\n\n### Impact\n\nOperators with a network-reachable Browser relay could experience denial of service for paired Chrome extensions while an attacker maintained enough silent WebSocket upgrades. The issue did not disclose the relay key, browser data, or authenticated relay capability.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.2`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.2` or later. Until upgraded, restrict network access to the Browser extension relay route, avoid exposing it to lower-trust networks, and restart the relay if its pending-authentication capacity becomes saturated.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-m78m-7h3q-q938","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:27Z","published_at":"2026-09-11T00:58:27Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.2","patched_versions":"2026.8.2","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"cwe_ids":["CWE-400"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3}},{"ghsa_id":"GHSA-vhpg-cq3w-v8p9","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-vhpg-cq3w-v8p9","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9","summary":"OpenAI-compatible transport could send provider credentials to the wrong endpoint","description":"### Summary\n\nOpenAI-compatible transport could send provider credentials to the wrong endpoint. In affected versions, a pinned third-party provider session whose model metadata lacked a concrete base URL could retain that provider's credential while the OpenAI SDK selected its default endpoint after a model hot reload.\n\n### Affected configurations\n\nThis affects configurations where a third-party provider uses an OpenAI-compatible API, the resolved model lacks an explicit provider endpoint, and an existing pinned session continues after model configuration is reloaded.\n\n### Impact\n\nA request could disclose the configured third-party provider credential to an unrelated provider endpoint and fail with a misleading authentication error. Operators who observed this condition should rotate the affected credential.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, configure explicit base URLs for third-party OpenAI-compatible providers and avoid continuing pinned sessions after changing model defaults.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-vhpg-cq3w-v8p9","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:48Z","published_at":"2026-09-11T00:58:47Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L","score":5.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"cwe_ids":["CWE-200"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L","score":5.4}},{"ghsa_id":"GHSA-7jfq-rmfm-29wp","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-7jfq-rmfm-29wp","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7jfq-rmfm-29wp","summary":"File-transfer approvals could widen durable authority","description":"### Summary\n\nFile-transfer `allow-always` approvals could preserve more authority than the operator reviewed. Literal path characters could later be interpreted as glob syntax, and node-specific grants could be reused by another node with the same display name.\n\n### Impact\n\nAfter an operator approved one file-transfer request, a later agent request could reuse that standing grant for a sibling path or a different node that was not shown in the approval. Depending on the original operation, this could broaden durable read or write access. Exploitation still required a prior operator approval and a matching widened target.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, avoid `allow-always` for file-transfer requests containing glob metacharacters and use unique node display names. Remove and recreate existing standing file-transfer grants after upgrading.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-7jfq-rmfm-29wp","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:46Z","published_at":"2026-09-11T00:57:46Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","score":6.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","score":6.4}},{"ghsa_id":"GHSA-3mq7-q27j-mq7q","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-3mq7-q27j-mq7q","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3mq7-q27j-mq7q","summary":"Exec approvals could outlive their reviewed working directory","description":"### Summary\n\nReusable exec approvals matched a command's arguments without binding the working directory. The same approved command could therefore run later in a different directory against files or repositories the operator had not reviewed.\n\n### Impact\n\nAn agent that obtained one `allow-always` approval could reuse it where the same command had materially different read or write effects. Impact depended on the approved command and contents of the second directory. The issue did not remove the need for the operator's initial approval.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` and any paired native execution clients to `2026.8.1` or later. Until upgraded, avoid reusable exec approvals for commands whose behavior depends on cwd. Review and remove existing standing approvals, then approve future commands separately in each intended directory.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-3mq7-q27j-mq7q","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:16Z","published_at":"2026-09-11T00:57:16Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","score":7.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","score":7.3}},{"ghsa_id":"GHSA-v7hh-7676-rg67","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-v7hh-7676-rg67","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hh-7676-rg67","summary":"Slack file downloads could miss conversation authorization","description":"### Summary\n\nSlack `download-file` authorization could fail open when a file lacked the share metadata used to prove that it belonged to the requested conversation. A caller limited to one conversation could retrieve a known file outside that scope when the expected relationship data was absent.\n\n### Impact\n\nAffected Slack deployments could disclose file contents across configured conversation boundaries to an authenticated caller who knew or obtained the file identifier. The issue did not permit listing arbitrary Slack files and did not bypass Slack authentication itself.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `@openclaw/slack` to `2026.8.1` or later. Until upgraded, deny `download-file` to lower-trust senders and avoid relying on conversation scoping for files whose Slack metadata is missing, incomplete, or imported from older records.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-v7hh-7676-rg67","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:46Z","published_at":"2026-09-11T00:58:46Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/slack"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-639","CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}},{"ghsa_id":"GHSA-9m4p-cqp4-jppq","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-9m4p-cqp4-jppq","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq","summary":"WhatsApp login tool could reach non-owner turns","description":"### Summary\n\nThe WhatsApp login tool could be exposed through the generic channel-tool path without preserving the originating sender's owner status. An admitted non-owner turn could request a forced login and receive a new QR code for a configured account.\n\n### Impact\n\nA non-owner sender able to steer the tool could disconnect or replace the Gateway's WhatsApp account, causing loss of availability and unauthorized account relinking. Successful takeover required scanning the returned QR code with another phone. The issue affected the owner-only tool boundary rather than WhatsApp transport authentication.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `@openclaw/whatsapp` to `2026.8.1` or later. Until upgraded, disable the WhatsApp login tool after setup, restrict agent access to owner-controlled conversations, and avoid exposing tool-capable agents to non-owner senders.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-9m4p-cqp4-jppq","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:53Z","published_at":"2026-09-11T00:57:53Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/whatsapp"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-862"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1}},{"ghsa_id":"GHSA-5rx7-34fw-64qg","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-5rx7-34fw-64qg","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5rx7-34fw-64qg","summary":"Unicode fallback could escape workspaceOnly roots","description":"### Summary\n\nWhen `tools.fs.workspaceOnly` was enabled, Unicode filename fallback could normalize already-validated parent directory components. On filesystems where canonically equivalent sibling directories coexist, a missing path inside the workspace could be retried against a sibling outside it.\n\n### Impact\n\nAn admitted requester could cause a tool-enabled agent to read a known file outside its configured workspace boundary. Exploitation required a filesystem layout with distinct canonically equivalent parent directory names and knowledge of a useful target path. It did not rely on symlinks or hardlinks.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, avoid workspace paths with canonically equivalent Unicode sibling names and deny filesystem read tools to lower-trust senders on affected hosts.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-5rx7-34fw-64qg","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:33Z","published_at":"2026-09-11T00:57:33Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"},{"cwe_id":"CWE-180","name":"Incorrect Behavior Order: Validate Before Canonicalize"}],"cwe_ids":["CWE-22","CWE-180"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.3}},{"ghsa_id":"GHSA-g24w-m94m-59qc","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-g24w-m94m-59qc","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g24w-m94m-59qc","summary":"Webhook TaskFlow cancellation could target unrelated sessions","description":"### Summary\n\nA webhook TaskFlow route could accept and store an arbitrary child session key, then use that key during cancellation without confirming that the child belonged to the route's configured parent session.\n\n### Impact\n\nA holder of one webhook route secret who knew another live child session key could stop unrelated ACP or subagent work outside that route's authority. The demonstrated effect was session cancellation and associated task-state change; it did not grant access to the cancelled session's content.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, disable webhook TaskFlow cancellation on routes available to lower-trust callers, rotate exposed route secrets, and avoid accepting remote child-session identifiers unless their ownership is independently verified.","severity":"low","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-g24w-m94m-59qc","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:09Z","published_at":"2026-09-11T00:58:09Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","score":3.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"},{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-639","CWE-862"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","score":3.1}},{"ghsa_id":"GHSA-62qm-6fjj-6g23","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-62qm-6fjj-6g23","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-62qm-6fjj-6g23","summary":"Dreaming could widen restricted sender authority","description":"### Summary\n\nSession-derived memory could lose the originating requester's restrictions before later dreaming runs processed it. Text from an admitted sender with limited tools could be persisted without its untrusted provenance, then supplied to an unattended agent with broader file and command capabilities.\n\n### Impact\n\nIn deployments with session-memory capture and dreaming enabled, a restricted external sender could place instructions that a later background model might follow with authority unavailable to the original turn. Successful exploitation required the content to be captured, selected for later processing, and followed by the model. Resulting actions could affect files, commands, or services available to the dreaming agent.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, disable dreaming for agents that accept restricted external senders, disable session-memory capture for those conversations, or run background memory processing without mutation and command tools.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-62qm-6fjj-6g23","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:36Z","published_at":"2026-09-11T00:57:36Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.4.5, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.5}},{"ghsa_id":"GHSA-fphf-69cp-h5xw","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-fphf-69cp-h5xw","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fphf-69cp-h5xw","summary":"Structured attachments could hide unvalidated host paths","description":"### Summary\n\nStructured message attachments accepted several equivalent source fields, but sandbox validation stopped after the first populated field. Telegram later processed every populated source, allowing an out-of-sandbox host path to be hidden behind an allowed attachment source.\n\n### Impact\n\nA sandboxed model could cause Telegram delivery to read and send a known host file that OpenClaw's sandbox media policy would reject on its own. Exploitation required a useful host path and an allowed Telegram delivery target. The issue bypassed path validation; it did not provide general filesystem listing.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, deny Telegram attachment actions to sandboxed or lower-trust agents and reject structured attachments containing more than one source field before delivery.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-fphf-69cp-h5xw","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:04Z","published_at":"2026-09-11T00:58:04Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"},{"cwe_id":"CWE-180","name":"Incorrect Behavior Order: Validate Before Canonicalize"}],"cwe_ids":["CWE-22","CWE-180"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}},{"ghsa_id":"GHSA-wjfv-5qch-m5vj","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-wjfv-5qch-m5vj","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wjfv-5qch-m5vj","summary":"Active Memory recall could ignore requester policy","description":"### Summary\n\nActive Memory automatic recall could omit the originating requester's effective tool policy. Deterministic and hidden recall paths could retrieve and inject durable memory even when `toolsBySender` explicitly denied that requester access to memory tools.\n\n### Impact\n\nIn deployments using Active Memory and requester-specific tool rules, an admitted sender denied `memory_search` and `memory_get` could receive information derived from durable memory in the agent's response. The issue was a deterministic policy omission in context assembly and did not depend on the sender directly invoking a hidden tool.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, disable Active Memory for conversations containing requesters who are denied memory access, or isolate those conversations in an agent and workspace without sensitive durable memory.","severity":"low","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-wjfv-5qch-m5vj","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:50Z","published_at":"2026-09-11T00:58:50Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-862"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.1}},{"ghsa_id":"GHSA-w5x7-c87m-3jpc","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-w5x7-c87m-3jpc","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w5x7-c87m-3jpc","summary":"Outbound attachments could ignore requester read denials","description":"### Summary\n\nOutbound attachment handling could read a local path without applying the originating sender's global or per-agent `toolsBySender` policy. A sender explicitly denied filesystem reads could still cause a known host file to be returned through a final-response media directive or message attachment.\n\n### Impact\n\nAffected deployments could disclose local file contents to an admitted requester whose normal agent turn did not include the `read` tool. Exploitation required knowledge or derivation of a useful path and a delivery flow that accepted local attachments.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, disable local outbound attachments for agents serving restricted senders, keep generated artifacts in dedicated non-sensitive directories, and avoid treating `toolsBySender` read denial alone as an attachment boundary.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-w5x7-c87m-3jpc","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:49Z","published_at":"2026-09-11T00:58:49Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}},{"ghsa_id":"GHSA-chr6-w4m5-57fv","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-chr6-w4m5-57fv","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-chr6-w4m5-57fv","summary":"Memory tools could retain revoked access","description":"### Summary\n\nExisting `memory_search` and `memory_get` tools could continue using an enabled configuration captured at creation after an operator hot-disabled memory. The execution-time resolver treated explicit disablement like an unavailable snapshot and restored stale authority.\n\n### Impact\n\nDuring an already-running agent turn, the model could continue searching or reading durable memory after the operator revoked that access. The exposure lasted for the remainder of the affected run and required memory to be disabled while a previously created tool remained active.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, restart active agent runs after disabling memory, and stop or restart the Gateway when immediate revocation is required rather than relying only on hot configuration reload.","severity":"low","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-chr6-w4m5-57fv","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:00Z","published_at":"2026-09-11T00:58:00Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","score":2.6},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","score":2.6}},{"ghsa_id":"GHSA-h2qg-fxpv-82v6","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-h2qg-fxpv-82v6","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h2qg-fxpv-82v6","summary":"Feishu tools could use disabled default accounts","description":"### Summary\n\nFeishu model tools could select a configured default account without checking whether that account was disabled. In a multi-account setup, an enabled sibling could keep a tool family available while an invocation used the disabled default account's retained credentials.\n\n### Impact\n\nA model tool call could read or modify Feishu resources through an identity the operator intended to revoke. The available actions depended on the disabled app's scopes and enabled tool families. Exploitation required the specific disabled-default and enabled-sibling configuration.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `@openclaw/feishu` to `2026.8.1` or later. Until upgraded, remove credentials from disabled accounts, change `defaultAccount` to an enabled eligible account, and restart OpenClaw after disabling a Feishu identity.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-h2qg-fxpv-82v6","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:16Z","published_at":"2026-09-11T00:58:16Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/feishu"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":6.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":6.8}},{"ghsa_id":"GHSA-hgv5-f2r3-6v9r","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-hgv5-f2r3-6v9r","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hgv5-f2r3-6v9r","summary":"Matrix authorization could conflate case-distinct user IDs","description":"### Summary\n\nMatrix authorization lowercased complete user IDs, including historical localparts and the case-sensitive server-name portion. Distinct authenticated Matrix accounts could therefore normalize to the same OpenClaw authorization identity.\n\n### Impact\n\nA Matrix participant with a colliding account identifier could inherit allowlist, owner-command, exec-approval, or plugin-approval authority configured for another account. Exploitation required a protocol-valid pair of identifiers that differed only by characters OpenClaw folded. Display-name matching was not required.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `@openclaw/matrix` to `2026.8.1` or later. Until upgraded, avoid authorization entries whose complete Matrix IDs differ only by case or Unicode folding, and review configured allowlists and approver identities for possible collisions.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-hgv5-f2r3-6v9r","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:19Z","published_at":"2026-09-11T00:58:19Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/matrix"},"vulnerable_version_range":">= 2026.2.2, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-178","name":"Improper Handling of Case Sensitivity"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-178","CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.5}},{"ghsa_id":"GHSA-6xpv-wwr5-265h","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-6xpv-wwr5-265h","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6xpv-wwr5-265h","summary":"Truncated tar listings could bypass extraction limits","description":"### Summary\n\nThe `tar.bz2` skill installer treated bounded command-output suffixes as complete archive listings. A crafted archive could push prohibited entries out of both retained listings, pass entry and size checks, and then be extracted in full.\n\n### Impact\n\nAfter an operator approved installation of a malicious or compromised skill archive, over-limit files or entry counts could be persisted in the skill tools directory and consume disk space or inodes. The demonstrated issue bypassed OpenClaw's explicit extraction budgets; it did not execute archive contents by itself.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, avoid installing `.tar.bz2` or `.tbz2` skills from untrusted sources and inspect or extract such archives with an independently bounded tool before installation.","severity":"low","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-6xpv-wwr5-265h","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:39Z","published_at":"2026-09-11T00:57:39Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.5.28, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","score":3.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"cwe_ids":["CWE-400"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","score":3.1}},{"ghsa_id":"GHSA-qgj5-6x35-9g6f","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-qgj5-6x35-9g6f","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qgj5-6x35-9g6f","summary":"Config revision hashes could expose password verifiers","description":"### Summary\n\nRedacted configuration responses could include deterministic hashes computed over the original unredacted configuration. When a Gateway password had low entropy and the rest of the configuration was reconstructable, those values acted as offline password verifiers.\n\n### Impact\n\nA caller able to obtain the redacted configuration could test password candidates without reaching the rate-limited Gateway authentication path. Recovering the password could grant the documented shared-secret operator authority. Practical exploitation depended on a weak password and sufficient knowledge of every other hashed configuration value. Secret references were not affected in the same way.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, use a high-entropy Gateway token or password, prefer secret references over inline low-entropy values, and restrict `config.get` to trusted operators.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-qgj5-6x35-9g6f","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:37Z","published_at":"2026-09-11T00:58:37Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"cwe_ids":["CWE-200"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.5}},{"ghsa_id":"GHSA-rrxp-5mx8-mvhh","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-rrxp-5mx8-mvhh","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rrxp-5mx8-mvhh","summary":"Inbound voice calls could inherit owner tool authority","description":"### Summary\n\nClassic inbound voice calls could launch the configured agent without carrying the caller's identity or non-owner status. Owner-only filtering could therefore fail open and expose the agent's normal tool authority to an admitted remote caller.\n\n### Impact\n\nA caller who passed the configured inbound-call policy could steer tools intended for the trusted owner, potentially reading data, modifying files, executing commands, or controlling connected services according to the agent's configuration. Inbound calling had to be enabled, and the caller still had to pass its open, pairing, or allowlist admission policy.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `@openclaw/voice-call` to `2026.8.1` or later. Until upgraded, disable classic inbound calling or assign inbound calls to an agent with a strict read-only tool policy and no owner-only capabilities.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-rrxp-5mx8-mvhh","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:43Z","published_at":"2026-09-11T00:58:43Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/voice-call"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-862"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-5fwv-rrvp-8xvr","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-5fwv-rrvp-8xvr","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5fwv-rrvp-8xvr","summary":"Session filename generation could regain denied tools","description":"### Summary\n\nSession filename generation could regain denied tools. In affected versions, session-memory filename generation created an embedded helper with tools that the originating sender's policy had removed.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen session-memory filename generation was enabled for an agent reachable by lower-trust senders, model-mediated instructions could invoke tools outside that sender's effective policy. Demonstrated impact included creating persistent scheduled work. Practical impact depended on the model following the injected instruction and on which tools the helper exposed.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, disable session-memory filename generation for agents reachable by lower-trust senders.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-5fwv-rrvp-8xvr","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:25Z","published_at":"2026-09-11T00:57:25Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","score":5.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","score":5.3}},{"ghsa_id":"GHSA-5x6q-wg56-rxg8","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-5x6q-wg56-rxg8","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5x6q-wg56-rxg8","summary":"Discord realtime transcripts could inherit another speaker's owner status","description":"### Summary\n\nDiscord realtime transcripts could inherit another speaker's owner status. In affected versions, concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nIn Discord `agent-proxy` voice sessions using the affected realtime control path, a non-owner utterance could reach the downstream agent boundary marked as owner. This could apply owner-sensitive behavior to the wrong speaker. Practical impact depended on concurrent transcript timing and the tools and commands available to that agent.\n\n### Patched Versions\n\nThe first stable patched version is `2026.9.2`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.9.2` or later. Before upgrading, disable Discord realtime voice for agents that distinguish owner and non-owner senders.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-5x6q-wg56-rxg8","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:34Z","published_at":"2026-09-11T00:57:34Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.7.2, < 2026.9.2","patched_versions":"2026.9.2","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","score":6.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-362","CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","score":6.4}},{"ghsa_id":"GHSA-356g-m7rx-7pm3","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-356g-m7rx-7pm3","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-356g-m7rx-7pm3","summary":"ACP file URLs could skip out-of-cwd read approval","description":"### Summary\n\nACP file URLs could skip out-of-cwd read approval. In affected versions, alternate but valid `file:` URL spellings were treated as relative paths and incorrectly classified as reads scoped to the session working directory.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen an operator connected `openclaw acp client` to an untrusted or compromised ACP peer, the peer could request a read outside the session working directory without showing the approval prompt required for that path. The demonstrated impact was file confidentiality; mutating and command-capable tool classes were not included.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, connect the ACP client only to trusted peers and avoid granting it access to sensitive host files.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-356g-m7rx-7pm3","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:12Z","published_at":"2026-09-11T00:57:12Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"= 2026.7.1-2","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","score":5.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-180","name":"Incorrect Behavior Order: Validate Before Canonicalize"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-180","CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","score":5.5}},{"ghsa_id":"GHSA-66hm-hxq3-5pfh","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-66hm-hxq3-5pfh","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-66hm-hxq3-5pfh","summary":"Embedding fallback could forward a provider key across vendors","description":"### Summary\n\nEmbedding fallback could forward a provider key across vendors. In affected versions, memory embedding failover could reuse the primary provider's configured API key while sending the request to a different fallback provider.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen remote embedding fallback was configured and the primary provider failed, a credential intended for one vendor could be sent as a bearer token to another vendor. Practical impact depended on the configured providers, whether failover occurred, and the privileges attached to the primary provider key.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, disable cross-provider embedding fallback or configure providers with separate narrowly scoped credentials.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-66hm-hxq3-5pfh","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:37Z","published_at":"2026-09-11T00:57:37Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.3.28, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","score":5.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"cwe_ids":["CWE-200"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","score":5.3}},{"ghsa_id":"GHSA-rm45-4jx5-2927","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-rm45-4jx5-2927","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rm45-4jx5-2927","summary":"QQBot voice filenames could escape the staging directory","description":"### Summary\n\nQQBot voice filenames could escape the staging directory. In affected versions, voice attachment filenames were decoded twice, allowing encoded traversal segments to reappear after filename sanitization.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen a remote QQ sender supplied an attachment that the agent forwarded as voice, attacker-supplied bytes could be written outside the intended voice staging directory to another process-writable location. Generated filename material limited targeted overwrite, but the staging path boundary was not enforced.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, disable QQBot voice forwarding for lower-trust senders and remove unexpected staged media files.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-rm45-4jx5-2927","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:42Z","published_at":"2026-09-11T00:58:42Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","score":5.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}],"cwe_ids":["CWE-22"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","score":5.4}},{"ghsa_id":"GHSA-8938-r7c6-54vq","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-8938-r7c6-54vq","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8938-r7c6-54vq","summary":"Microsoft Teams access-group failures could admit unlisted senders","description":"### Summary\n\nMicrosoft Teams access-group failures could admit unlisted senders. In affected versions, missing or unsupported configured access groups produced denied results that were not rejected by the final message-admission check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen `groupPolicy` was set to `allowlist` with an affected access-group entry, an unlisted Teams member could trigger the configured agent despite the administrator's group boundary. Practical impact depended on the conversations, tools, and data available to that agent.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, avoid unresolved access-group entries and use explicit supported sender or conversation allowlists.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-8938-r7c6-54vq","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:47Z","published_at":"2026-09-11T00:57:47Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4}},{"ghsa_id":"GHSA-jjpc-p3xf-8g7p","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-jjpc-p3xf-8g7p","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jjpc-p3xf-8g7p","summary":"iOS Control UI did not enforce saved Gateway TLS pins","description":"### Summary\n\nThe iOS Control UI did not enforce saved Gateway TLS pins. In affected versions, authenticated Terminal and session Dashboard WebViews omitted the saved Gateway fingerprint even though native connections enforced it.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen an iOS user had accepted a Gateway fingerprint, an attacker who could redirect the same host and port and present a different certificate accepted by iOS system trust could serve a replacement Control UI page. Opening Terminal or a session Dashboard allowed that page to read the injected Gateway token or password. The credential could provide operator access, including reading sensitive Gateway state and invoking host-capable tools.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.11`.\n\n### Mitigations\n\nUpgrade OpenClaw for iOS to `2026.8.11` or later. Before upgrading, avoid the in-app Terminal and session Dashboard for pinned Gateways when network routing or installed certificate authorities are not fully trusted.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-jjpc-p3xf-8g7p","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:25Z","published_at":"2026-09-11T00:58:25Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"other","name":"OpenClaw iOS"},"vulnerable_version_range":">= 2026.7.1, < 2026.8.11","patched_versions":"2026.8.11","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","score":8.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-295","name":"Improper Certificate Validation"}],"cwe_ids":["CWE-295"],"credits":[{"login":"0xca1x","type":"reporter"},{"login":"migraine-sudo","type":"analyst"}],"credits_detailed":[{"user":{"login":"0xca1x","id":265192039,"node_id":"U_kgDOD86CZw","avatar_url":"https://avatars.githubusercontent.com/u/265192039?v=4","gravatar_id":"","url":"https://api.github.com/users/0xca1x","html_url":"https://github.com/0xca1x","followers_url":"https://api.github.com/users/0xca1x/followers","following_url":"https://api.github.com/users/0xca1x/following{/other_user}","gists_url":"https://api.github.com/users/0xca1x/gists{/gist_id}","starred_url":"https://api.github.com/users/0xca1x/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0xca1x/subscriptions","organizations_url":"https://api.github.com/users/0xca1x/orgs","repos_url":"https://api.github.com/users/0xca1x/repos","events_url":"https://api.github.com/users/0xca1x/events{/privacy}","received_events_url":"https://api.github.com/users/0xca1x/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"},{"user":{"login":"migraine-sudo","id":46891747,"node_id":"MDQ6VXNlcjQ2ODkxNzQ3","avatar_url":"https://avatars.githubusercontent.com/u/46891747?v=4","gravatar_id":"","url":"https://api.github.com/users/migraine-sudo","html_url":"https://github.com/migraine-sudo","followers_url":"https://api.github.com/users/migraine-sudo/followers","following_url":"https://api.github.com/users/migraine-sudo/following{/other_user}","gists_url":"https://api.github.com/users/migraine-sudo/gists{/gist_id}","starred_url":"https://api.github.com/users/migraine-sudo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/migraine-sudo/subscriptions","organizations_url":"https://api.github.com/users/migraine-sudo/orgs","repos_url":"https://api.github.com/users/migraine-sudo/repos","events_url":"https://api.github.com/users/migraine-sudo/events{/privacy}","received_events_url":"https://api.github.com/users/migraine-sudo/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"analyst","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","score":8.3}},{"ghsa_id":"GHSA-wwcw-jfpp-gpxw","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-wwcw-jfpp-gpxw","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wwcw-jfpp-gpxw","summary":"Codex native tools could ignore per-chat policy","description":"### Summary\n\nCodex native tools could ignore per-chat policy. In affected versions, a conversation-level `tools.allow` rule filtered OpenClaw tools but did not restrict shell, process, file, and patch tools owned by the Codex app-server runtime.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen a lower-trust conversation was assigned to a Codex runtime and restricted with a per-chat tool allowlist, a participant who could trigger that agent could still reach native command and file tools. Practical impact depended on the runtime's host permissions and sandbox configuration.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, route restricted chats to an agent runtime without native host tools or disable those tools at the agent boundary.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-wwcw-jfpp-gpxw","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:52Z","published_at":"2026-09-11T00:58:52Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":0,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-h9jh-75j7-7hhx","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-h9jh-75j7-7hhx","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h9jh-75j7-7hhx","summary":"Feishu unpin could miss cross-context policy","description":"### Summary\n\nFeishu unpin could miss cross-context policy. In affected versions, the native `chatId` parameter was not declared as a delivery target, so `unpin` could avoid the shared same-provider target check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen `tools.message.crossContext.allowWithinProvider` was disabled, an admitted sender could remove a pin from another Feishu group that the sender and configured account were otherwise permitted to access. Feishu membership and group authorization still applied, and the demonstrated issue was limited to message mutation policy.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, disable Feishu pin-management actions for lower-trust senders.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-h9jh-75j7-7hhx","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:17Z","published_at":"2026-09-11T00:58:17Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.6.9, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"andrewCantina","type":"reporter"}],"credits_detailed":[{"user":{"login":"andrewCantina","id":288528146,"node_id":"U_kgDOETKXEg","avatar_url":"https://avatars.githubusercontent.com/u/288528146?v=4","gravatar_id":"","url":"https://api.github.com/users/andrewCantina","html_url":"https://github.com/andrewCantina","followers_url":"https://api.github.com/users/andrewCantina/followers","following_url":"https://api.github.com/users/andrewCantina/following{/other_user}","gists_url":"https://api.github.com/users/andrewCantina/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewCantina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewCantina/subscriptions","organizations_url":"https://api.github.com/users/andrewCantina/orgs","repos_url":"https://api.github.com/users/andrewCantina/repos","events_url":"https://api.github.com/users/andrewCantina/events{/privacy}","received_events_url":"https://api.github.com/users/andrewCantina/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3}},{"ghsa_id":"GHSA-g697-vv6h-r8hv","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-g697-vv6h-r8hv","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g697-vv6h-r8hv","summary":"Revoked Canvas capability could remain active during disconnect","description":"### Summary\n\nRevoked Canvas capability could remain active during disconnect. In affected versions, node revocation invalidated the WebSocket client but Canvas HTTP authorization continued accepting and renewing its capability until close cleanup finished.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nA revoked paired node could continue using its previously granted Canvas capability during the WebSocket close grace period. Practical impact was limited to the capability's configured routes and the short interval before connection cleanup, but revocation did not take effect at the owner-held invalidation point.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, restart the Gateway after revoking a node with Canvas access.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-g697-vv6h-r8hv","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:10Z","published_at":"2026-09-11T00:58:10Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.5.12, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","score":4.2},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-613","name":"Insufficient Session Expiration"}],"cwe_ids":["CWE-613"],"credits":[{"login":"andrewCantina","type":"reporter"}],"credits_detailed":[{"user":{"login":"andrewCantina","id":288528146,"node_id":"U_kgDOETKXEg","avatar_url":"https://avatars.githubusercontent.com/u/288528146?v=4","gravatar_id":"","url":"https://api.github.com/users/andrewCantina","html_url":"https://github.com/andrewCantina","followers_url":"https://api.github.com/users/andrewCantina/followers","following_url":"https://api.github.com/users/andrewCantina/following{/other_user}","gists_url":"https://api.github.com/users/andrewCantina/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewCantina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewCantina/subscriptions","organizations_url":"https://api.github.com/users/andrewCantina/orgs","repos_url":"https://api.github.com/users/andrewCantina/repos","events_url":"https://api.github.com/users/andrewCantina/events{/privacy}","received_events_url":"https://api.github.com/users/andrewCantina/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","score":4.2}},{"ghsa_id":"GHSA-cf95-m4jv-59rc","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-cf95-m4jv-59rc","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cf95-m4jv-59rc","summary":"Synology file delivery could lose DNS pinning","description":"### Summary\n\nSynology file delivery could lose DNS pinning. In affected versions, the Gateway validated one DNS result for a file URL but passed the original hostname to the NAS, where it could resolve to a different destination.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen Synology Chat attachment delivery accepted a remotely influenced hostname, DNS rebinding could make the NAS fetch a private or otherwise policy-denied resource and return it to the addressed conversation. Practical impact depended on NAS routing, resolver behavior, and the response available at the private destination.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, disable remote URL attachment forwarding in Synology Chat.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-cf95-m4jv-59rc","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:58Z","published_at":"2026-09-11T00:57:58Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.7.1, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","score":7.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-918","name":"Server-Side Request Forgery (SSRF)"}],"cwe_ids":["CWE-918"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","score":7.1}},{"ghsa_id":"GHSA-mm7m-wcgh-8mfq","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-mm7m-wcgh-8mfq","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mm7m-wcgh-8mfq","summary":"WhatsApp session resets could bypass command authorization","description":"### Summary\n\nWhatsApp session resets could bypass command authorization. In affected versions, a group sender admitted for ordinary messages could use `/new <model>` to reset the shared group session and persist a provider and model override even when canonical command policy denied that sender.\n\nThis advisory is scoped to WhatsApp group senders who pass ordinary message admission but fail `commands.allowFrom` or owner command authorization. The failed boundary is the configured distinction between message admission and command authorization.\n\n### Impact\n\nA command-denied group member could select a provider and model already allowed by the operator for later turns in the shared group session. This could change provider routing, cost, data flow, or availability. It does not add a provider or grant host execution.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, ensure WhatsApp group admission and `commands.allowFrom` contain the same trusted senders, and reset affected group sessions after unauthorized `/new` attempts.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-mm7m-wcgh-8mfq","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:28Z","published_at":"2026-09-11T00:58:28Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.5.2, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"andrewCantina","type":"reporter"}],"credits_detailed":[{"user":{"login":"andrewCantina","id":288528146,"node_id":"U_kgDOETKXEg","avatar_url":"https://avatars.githubusercontent.com/u/288528146?v=4","gravatar_id":"","url":"https://api.github.com/users/andrewCantina","html_url":"https://github.com/andrewCantina","followers_url":"https://api.github.com/users/andrewCantina/followers","following_url":"https://api.github.com/users/andrewCantina/following{/other_user}","gists_url":"https://api.github.com/users/andrewCantina/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewCantina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewCantina/subscriptions","organizations_url":"https://api.github.com/users/andrewCantina/orgs","repos_url":"https://api.github.com/users/andrewCantina/repos","events_url":"https://api.github.com/users/andrewCantina/events{/privacy}","received_events_url":"https://api.github.com/users/andrewCantina/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3}},{"ghsa_id":"GHSA-7cp7-87pj-p32v","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-7cp7-87pj-p32v","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7cp7-87pj-p32v","summary":"Skill tool dispatch could skip owner-only policy","description":"### Summary\n\nSkill tool dispatch could skip owner-only policy. In affected versions, an allowlisted non-owner invoking a skill-backed command could reach owner-only tools because the dispatch path did not carry the sender's owner status or apply the owner-only tool filter.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nA non-owner sender authorized to invoke the affected skill command could access tools backed by server credentials and capabilities that OpenClaw reserves for owners. Practical impact depended on which owner-only command tool the installed skill exposed.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, disable skill tool dispatch for non-owner senders and audit skills that map commands to owner-only tools.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-7cp7-87pj-p32v","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:44Z","published_at":"2026-09-11T00:57:44Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"SEORY0","type":"reporter"}],"credits_detailed":[{"user":{"login":"SEORY0","id":93699099,"node_id":"U_kgDOBZW8Gw","avatar_url":"https://avatars.githubusercontent.com/u/93699099?v=4","gravatar_id":"","url":"https://api.github.com/users/SEORY0","html_url":"https://github.com/SEORY0","followers_url":"https://api.github.com/users/SEORY0/followers","following_url":"https://api.github.com/users/SEORY0/following{/other_user}","gists_url":"https://api.github.com/users/SEORY0/gists{/gist_id}","starred_url":"https://api.github.com/users/SEORY0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SEORY0/subscriptions","organizations_url":"https://api.github.com/users/SEORY0/orgs","repos_url":"https://api.github.com/users/SEORY0/repos","events_url":"https://api.github.com/users/SEORY0/events{/privacy}","received_events_url":"https://api.github.com/users/SEORY0/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3}},{"ghsa_id":"GHSA-4r25-35qc-fr6j","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-4r25-35qc-fr6j","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4r25-35qc-fr6j","summary":"Gateway upgrade-like requests could retain unauthenticated sockets","description":"### Summary\n\nGateway upgrade-like requests could retain unauthenticated sockets. In affected versions, an HTTP request carrying a WebSocket upgrade header without the matching connection semantics was routed to the ordinary handler, which returned without ending the response.\n\nThis advisory is scoped to the named Gateway listener. It does not change OpenClaw's trusted-operator model or recommend exposing the Gateway publicly; the issue affected any lower-trust client that could reach the configured listener.\n\n### Impact\n\nAn unauthenticated client could hold response sockets and associated request state open without consuming the WebSocket pre-auth connection budget. Repeated requests could exhaust listener resources. Confidentiality and integrity were not affected, and practical impact depended on listener reachability and host limits.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, keep the Gateway loopback-only or behind a proxy that rejects malformed upgrade requests and enforces connection limits.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-4r25-35qc-fr6j","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:21Z","published_at":"2026-09-11T00:57:21Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-400","name":"Uncontrolled Resource Consumption"},{"cwe_id":"CWE-404","name":"Improper Resource Shutdown or Release"}],"cwe_ids":["CWE-400","CWE-404"],"credits":[{"login":"BrandonChoKR","type":"reporter"}],"credits_detailed":[{"user":{"login":"BrandonChoKR","id":129963104,"node_id":"U_kgDOB78UYA","avatar_url":"https://avatars.githubusercontent.com/u/129963104?v=4","gravatar_id":"","url":"https://api.github.com/users/BrandonChoKR","html_url":"https://github.com/BrandonChoKR","followers_url":"https://api.github.com/users/BrandonChoKR/followers","following_url":"https://api.github.com/users/BrandonChoKR/following{/other_user}","gists_url":"https://api.github.com/users/BrandonChoKR/gists{/gist_id}","starred_url":"https://api.github.com/users/BrandonChoKR/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BrandonChoKR/subscriptions","organizations_url":"https://api.github.com/users/BrandonChoKR/orgs","repos_url":"https://api.github.com/users/BrandonChoKR/repos","events_url":"https://api.github.com/users/BrandonChoKR/events{/privacy}","received_events_url":"https://api.github.com/users/BrandonChoKR/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":5,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}},{"ghsa_id":"GHSA-9f86-pvv5-rxfw","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-9f86-pvv5-rxfw","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9f86-pvv5-rxfw","summary":"Escaped newlines could confuse exec allowlist parsing","description":"### Summary\n\nEscaped newlines could confuse exec allowlist parsing. In affected versions, the command parser could describe and authorize one visible shell word sequence while execution included an additional command hidden by newline parsing.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen exec allowlist or approval policy trusted the parsed command, lower-trust model input could cause an additional command to execute without the expected prompt. Practical impact depended on the exec host, sandbox mode, process permissions, and the commands available to the agent.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, disable exec for lower-trust agents or require review outside the affected parser path for every command.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-9f86-pvv5-rxfw","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:52Z","published_at":"2026-09-11T00:57:52Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8.0},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-78","CWE-863"],"credits":[{"login":"tdjackey","type":"reporter"}],"credits_detailed":[{"user":{"login":"tdjackey","id":6791132,"node_id":"MDQ6VXNlcjY3OTExMzI=","avatar_url":"https://avatars.githubusercontent.com/u/6791132?v=4","gravatar_id":"","url":"https://api.github.com/users/tdjackey","html_url":"https://github.com/tdjackey","followers_url":"https://api.github.com/users/tdjackey/followers","following_url":"https://api.github.com/users/tdjackey/following{/other_user}","gists_url":"https://api.github.com/users/tdjackey/gists{/gist_id}","starred_url":"https://api.github.com/users/tdjackey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tdjackey/subscriptions","organizations_url":"https://api.github.com/users/tdjackey/orgs","repos_url":"https://api.github.com/users/tdjackey/repos","events_url":"https://api.github.com/users/tdjackey/events{/privacy}","received_events_url":"https://api.github.com/users/tdjackey/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8.0}},{"ghsa_id":"GHSA-74gc-hg2m-79p9","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-74gc-hg2m-79p9","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-74gc-hg2m-79p9","summary":"Reusable exec approvals could authorize changed arguments","description":"### Summary\n\nReusable exec approvals could authorize changed arguments. In affected versions on macOS and Linux, selecting Allow Always for one exact command persisted a path-only grant. Later uses of the same executable with different arguments could therefore run without a new prompt.\n\nThis advisory is scoped to generated Allow Always entries. It does not treat operator-authored path-only allowlist rules as exact-argument grants; the failed boundary was OpenClaw broadening an exact command approved by the operator when it persisted that grant.\n\n### Impact\n\nAfter an operator approved a benign command, later untrusted content that influenced the agent could reuse its executable with different target or output arguments. Depending on the tool, this could send local files, overwrite user-writable files, or reach internal services without showing another approval prompt. Exploitation requires a prior persistent approval for the same executable.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, use one-time approval for commands whose arguments select network targets, input files, or output paths, and remove generated broad Allow Always entries.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-74gc-hg2m-79p9","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:43Z","published_at":"2026-09-11T00:57:42Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"anagnorisis2peripeteia","type":"reporter"}],"credits_detailed":[{"user":{"login":"anagnorisis2peripeteia","id":129746152,"node_id":"U_kgDOB7vE6A","avatar_url":"https://avatars.githubusercontent.com/u/129746152?v=4","gravatar_id":"","url":"https://api.github.com/users/anagnorisis2peripeteia","html_url":"https://github.com/anagnorisis2peripeteia","followers_url":"https://api.github.com/users/anagnorisis2peripeteia/followers","following_url":"https://api.github.com/users/anagnorisis2peripeteia/following{/other_user}","gists_url":"https://api.github.com/users/anagnorisis2peripeteia/gists{/gist_id}","starred_url":"https://api.github.com/users/anagnorisis2peripeteia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anagnorisis2peripeteia/subscriptions","organizations_url":"https://api.github.com/users/anagnorisis2peripeteia/orgs","repos_url":"https://api.github.com/users/anagnorisis2peripeteia/repos","events_url":"https://api.github.com/users/anagnorisis2peripeteia/events{/privacy}","received_events_url":"https://api.github.com/users/anagnorisis2peripeteia/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.5}},{"ghsa_id":"GHSA-ghpx-6xwq-2w4w","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-ghpx-6xwq-2w4w","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ghpx-6xwq-2w4w","summary":"Exec wrapper allowlists could trust arbitrary inner commands","description":"### Summary\n\nExec approval policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign wrapper invocation, a later agent turn could substitute an arbitrary inner command without another prompt.\n\n### Impact\n\nAffected deployments could execute commands with the OpenClaw process's host privileges outside the operator's reviewed approval. Exploitation required the relevant wrapper to resolve on the host and a prior operator decision allowing that wrapper. Transparent shell carriers and opaque utilities such as process monitors or tracing wrappers were affected through related trust-resolution gaps.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade `openclaw` to `2026.8.1` or later. Until upgraded, remove standing approvals for command-running wrappers, avoid allowlisting wrapper executables for arbitrary arguments, and require per-invocation approval for commands using shell carriers, monitors, tracers, namespace tools, or proxy wrappers.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-ghpx-6xwq-2w4w","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:15Z","published_at":"2026-09-11T00:58:15Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.3.22, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8.0},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-88","name":"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-88","CWE-863"],"credits":[{"login":"anagnorisis2peripeteia","type":"reporter"}],"credits_detailed":[{"user":{"login":"anagnorisis2peripeteia","id":129746152,"node_id":"U_kgDOB7vE6A","avatar_url":"https://avatars.githubusercontent.com/u/129746152?v=4","gravatar_id":"","url":"https://api.github.com/users/anagnorisis2peripeteia","html_url":"https://github.com/anagnorisis2peripeteia","followers_url":"https://api.github.com/users/anagnorisis2peripeteia/followers","following_url":"https://api.github.com/users/anagnorisis2peripeteia/following{/other_user}","gists_url":"https://api.github.com/users/anagnorisis2peripeteia/gists{/gist_id}","starred_url":"https://api.github.com/users/anagnorisis2peripeteia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anagnorisis2peripeteia/subscriptions","organizations_url":"https://api.github.com/users/anagnorisis2peripeteia/orgs","repos_url":"https://api.github.com/users/anagnorisis2peripeteia/repos","events_url":"https://api.github.com/users/anagnorisis2peripeteia/events{/privacy}","received_events_url":"https://api.github.com/users/anagnorisis2peripeteia/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":3,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8.0}},{"ghsa_id":"GHSA-j4mm-p864-vx7f","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-j4mm-p864-vx7f","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j4mm-p864-vx7f","summary":"sessions.create could miss admin scope for keyed reconfiguration","description":"### Summary\n\n`sessions.create` could miss admin scope for keyed reconfiguration. In affected versions, an `operator.write` caller could target an existing session key while supplying model or thinking changes that `sessions.patch` reserved for `operator.admin`.\n\nThis advisory is scoped to the Gateway operator-scope boundary. It does not create isolation between mutually untrusted users on one Gateway; it enforces the documented distinction between issued write and admin credentials.\n\n### Impact\n\nA write-scoped operator client could change an existing session's model, provider, thinking level, and configured auth-profile selection. Impact was limited to models and credentials already configured by the operator, but the mutation bypassed the explicit admin gate and could redirect later session traffic.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, do not issue write-only Gateway credentials to clients that can call keyed `sessions.create`.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-j4mm-p864-vx7f","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:22Z","published_at":"2026-09-11T00:58:22Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"anagnorisis2peripeteia","type":"reporter"}],"credits_detailed":[{"user":{"login":"anagnorisis2peripeteia","id":129746152,"node_id":"U_kgDOB7vE6A","avatar_url":"https://avatars.githubusercontent.com/u/129746152?v=4","gravatar_id":"","url":"https://api.github.com/users/anagnorisis2peripeteia","html_url":"https://github.com/anagnorisis2peripeteia","followers_url":"https://api.github.com/users/anagnorisis2peripeteia/followers","following_url":"https://api.github.com/users/anagnorisis2peripeteia/following{/other_user}","gists_url":"https://api.github.com/users/anagnorisis2peripeteia/gists{/gist_id}","starred_url":"https://api.github.com/users/anagnorisis2peripeteia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anagnorisis2peripeteia/subscriptions","organizations_url":"https://api.github.com/users/anagnorisis2peripeteia/orgs","repos_url":"https://api.github.com/users/anagnorisis2peripeteia/repos","events_url":"https://api.github.com/users/anagnorisis2peripeteia/events{/privacy}","received_events_url":"https://api.github.com/users/anagnorisis2peripeteia/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4}},{"ghsa_id":"GHSA-xx9p-hc9w-6p5h","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-xx9p-hc9w-6p5h","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xx9p-hc9w-6p5h","summary":"Usage CSV export could interpret session labels as formulas","description":"### Summary\n\nUsage CSV export could interpret session labels as formulas. In affected versions, the Control UI quoted session labels as CSV text but did not neutralize leading characters that spreadsheet applications can interpret as formulas.\n\nThis advisory is scoped to the exported artifact and the spreadsheet application used to open it. OpenClaw did not evaluate the formula itself, and impact required an operator to open the export in software with formula evaluation enabled.\n\n### Impact\n\nA lower-trust participant who influenced a session label or first user message could place a formula-like cell in the Usage export. Opening that file in an affected spreadsheet could evaluate the cell with the spreadsheet user's permissions. Practical impact depended on spreadsheet security settings and formula support.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, import Usage exports as plain text or inspect formula-leading cells before opening them in a spreadsheet.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-xx9p-hc9w-6p5h","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:59Z","published_at":"2026-09-11T00:58:59Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-1236","name":"Improper Neutralization of Formula Elements in a CSV File"}],"cwe_ids":["CWE-1236"],"credits":[{"login":"anagnorisis2peripeteia","type":"reporter"}],"credits_detailed":[{"user":{"login":"anagnorisis2peripeteia","id":129746152,"node_id":"U_kgDOB7vE6A","avatar_url":"https://avatars.githubusercontent.com/u/129746152?v=4","gravatar_id":"","url":"https://api.github.com/users/anagnorisis2peripeteia","html_url":"https://github.com/anagnorisis2peripeteia","followers_url":"https://api.github.com/users/anagnorisis2peripeteia/followers","following_url":"https://api.github.com/users/anagnorisis2peripeteia/following{/other_user}","gists_url":"https://api.github.com/users/anagnorisis2peripeteia/gists{/gist_id}","starred_url":"https://api.github.com/users/anagnorisis2peripeteia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anagnorisis2peripeteia/subscriptions","organizations_url":"https://api.github.com/users/anagnorisis2peripeteia/orgs","repos_url":"https://api.github.com/users/anagnorisis2peripeteia/repos","events_url":"https://api.github.com/users/anagnorisis2peripeteia/events{/privacy}","received_events_url":"https://api.github.com/users/anagnorisis2peripeteia/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":3,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4}},{"ghsa_id":"GHSA-39hf-qg99-f4qv","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-39hf-qg99-f4qv","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-39hf-qg99-f4qv","summary":"Google Meet attendance CSV could interpret names as formulas","description":"### Summary\n\nGoogle Meet attendance CSV could interpret names as formulas. In affected versions, participant display names were quoted for CSV output but leading spreadsheet formula characters were not neutralized.\n\nThis advisory is scoped to the exported artifact and the spreadsheet application used to open it. OpenClaw did not evaluate the formula itself, and impact required an operator to open the attendance export in software with formula evaluation enabled.\n\n### Impact\n\nA meeting participant who controlled their display name could place a formula-like cell in `attendance.csv`. Opening that export in an affected spreadsheet could evaluate the cell with the spreadsheet user's permissions. Practical impact depended on spreadsheet security settings and supported formula behavior.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, import attendance exports as plain text or inspect formula-leading participant cells before opening them in a spreadsheet.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-39hf-qg99-f4qv","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:15Z","published_at":"2026-09-11T00:57:14Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-1236","name":"Improper Neutralization of Formula Elements in a CSV File"}],"cwe_ids":["CWE-1236"],"credits":[{"login":"anagnorisis2peripeteia","type":"reporter"}],"credits_detailed":[{"user":{"login":"anagnorisis2peripeteia","id":129746152,"node_id":"U_kgDOB7vE6A","avatar_url":"https://avatars.githubusercontent.com/u/129746152?v=4","gravatar_id":"","url":"https://api.github.com/users/anagnorisis2peripeteia","html_url":"https://github.com/anagnorisis2peripeteia","followers_url":"https://api.github.com/users/anagnorisis2peripeteia/followers","following_url":"https://api.github.com/users/anagnorisis2peripeteia/following{/other_user}","gists_url":"https://api.github.com/users/anagnorisis2peripeteia/gists{/gist_id}","starred_url":"https://api.github.com/users/anagnorisis2peripeteia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anagnorisis2peripeteia/subscriptions","organizations_url":"https://api.github.com/users/anagnorisis2peripeteia/orgs","repos_url":"https://api.github.com/users/anagnorisis2peripeteia/repos","events_url":"https://api.github.com/users/anagnorisis2peripeteia/events{/privacy}","received_events_url":"https://api.github.com/users/anagnorisis2peripeteia/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4}},{"ghsa_id":"GHSA-fgwg-c3wv-8f45","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-fgwg-c3wv-8f45","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fgwg-c3wv-8f45","summary":"LINE group allowlist could inherit DM access","description":"### Summary\n\nLINE group allowlist could inherit DM access. In affected versions, an account using `groupPolicy: \"allowlist\"` without `groupAllowFrom` silently reused the account's DM `allowFrom` values for group admission.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen DM access was broader than intended group access, including open DMs with `allowFrom: [\"*\"]`, a group participant could trigger the agent despite the configured group allowlist mode. Practical impact depended on the tools and conversation data exposed to that LINE account.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `@openclaw/line@2026.8.1` or later. Before upgrading, set an explicit finite `groupAllowFrom` for every account using group allowlist mode.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-fgwg-c3wv-8f45","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:03Z","published_at":"2026-09-11T00:58:03Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/line"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"edenfunf","type":"reporter"}],"credits_detailed":[{"user":{"login":"edenfunf","id":146086744,"node_id":"U_kgDOCLUbWA","avatar_url":"https://avatars.githubusercontent.com/u/146086744?v=4","gravatar_id":"","url":"https://api.github.com/users/edenfunf","html_url":"https://github.com/edenfunf","followers_url":"https://api.github.com/users/edenfunf/followers","following_url":"https://api.github.com/users/edenfunf/following{/other_user}","gists_url":"https://api.github.com/users/edenfunf/gists{/gist_id}","starred_url":"https://api.github.com/users/edenfunf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edenfunf/subscriptions","organizations_url":"https://api.github.com/users/edenfunf/orgs","repos_url":"https://api.github.com/users/edenfunf/repos","events_url":"https://api.github.com/users/edenfunf/events{/privacy}","received_events_url":"https://api.github.com/users/edenfunf/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5}},{"ghsa_id":"GHSA-p3h6-v2h4-36q2","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-p3h6-v2h4-36q2","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p3h6-v2h4-36q2","summary":"Browser CDP connections could discard DNS pinning","description":"### Summary\n\nBrowser CDP connections could discard DNS pinning. In affected versions, OpenClaw validated one DNS result for a configured CDP hostname but raw WebSocket and Playwright transports performed a later independent resolution.\n\nThis advisory is scoped to configured remote CDP endpoints. It does not treat intentional local browser control as a vulnerability; the failed boundary was the SSRF policy that approved one destination but connected to another.\n\n### Impact\n\nAn attacker who controlled an approved CDP hostname or its DNS answers could use rebinding to make the Gateway connect to a loopback, private, link-local, metadata, or other policy-denied address. Practical impact depended on remote CDP configuration, DNS timing, and services reachable from the Gateway host.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, disable hostname-based remote CDP endpoints or restrict them to trusted, stable infrastructure.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-p3h6-v2h4-36q2","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:30Z","published_at":"2026-09-11T00:58:30Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.4.5, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L","score":8.2},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-918","name":"Server-Side Request Forgery (SSRF)"}],"cwe_ids":["CWE-918"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":0,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L","score":8.2}},{"ghsa_id":"GHSA-hpg5-cq3m-phqp","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-hpg5-cq3m-phqp","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hpg5-cq3m-phqp","summary":"Agent cron tool could reach operator command jobs","description":"### Summary\n\nAgent cron tool could reach operator command jobs. In affected versions, a model-visible agent caller could read and force-run ownerless command cron jobs routed to the same agent even though command cron was reserved for operator administration.\n\nThis advisory is scoped to the model-tool versus operator-admin boundary. It does not claim arbitrary command construction: the affected caller could inspect or replay an existing operator-authored command job.\n\n### Impact\n\nA lower-trust message capable of steering an agent with the cron tool could read a matching command job's stored environment and force-run that job while disabled or before it was due. Practical impact depended on the secrets and commands the operator had placed in existing jobs.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, remove the cron tool from lower-trust agents and avoid storing sensitive environment values in ownerless command jobs.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-hpg5-cq3m-phqp","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:20Z","published_at":"2026-09-11T00:58:20Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-200","CWE-862"],"credits":[{"login":"whyiug","type":"reporter"}],"credits_detailed":[{"user":{"login":"whyiug","id":6668626,"node_id":"MDQ6VXNlcjY2Njg2MjY=","avatar_url":"https://avatars.githubusercontent.com/u/6668626?v=4","gravatar_id":"","url":"https://api.github.com/users/whyiug","html_url":"https://github.com/whyiug","followers_url":"https://api.github.com/users/whyiug/followers","following_url":"https://api.github.com/users/whyiug/following{/other_user}","gists_url":"https://api.github.com/users/whyiug/gists{/gist_id}","starred_url":"https://api.github.com/users/whyiug/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whyiug/subscriptions","organizations_url":"https://api.github.com/users/whyiug/orgs","repos_url":"https://api.github.com/users/whyiug/repos","events_url":"https://api.github.com/users/whyiug/events{/privacy}","received_events_url":"https://api.github.com/users/whyiug/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3}},{"ghsa_id":"GHSA-pfrw-r5vr-89hw","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-pfrw-r5vr-89hw","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pfrw-r5vr-89hw","summary":"Workspace endpoint override could expose Azure Speech credentials","description":"### Summary\n\nA workspace endpoint override could expose Azure Speech credentials. In affected versions, an untrusted workspace `.env` could set `AZURE_SPEECH_ENDPOINT` because the workspace filter did not block the `_ENDPOINT` suffix. Azure Speech preferred that value over its configured region.\n\nThis advisory is scoped to operators who started OpenClaw in attacker-controlled workspace content, configured Azure Speech with a key and region, and had not set a trusted endpoint override.\n\n### Impact\n\nWhen Azure Speech made a synthesis or voice-list request, the attacker-selected endpoint received the operator's Azure Speech key in the request header. The exposed key could then be used against the operator's Azure Speech resource.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, run OpenClaw only from trusted workspaces or set `AZURE_SPEECH_ENDPOINT` through a trusted process or global runtime environment.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-pfrw-r5vr-89hw","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:33Z","published_at":"2026-09-11T00:58:33Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.4.25, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","score":5.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-522","name":"Insufficiently Protected Credentials"},{"cwe_id":"CWE-610","name":"Externally Controlled Reference to a Resource in Another Sphere"}],"cwe_ids":["CWE-522","CWE-610"],"credits":[{"login":"qc9c","type":"reporter"}],"credits_detailed":[{"user":{"login":"qc9c","id":136676372,"node_id":"U_kgDOCCWEFA","avatar_url":"https://avatars.githubusercontent.com/u/136676372?v=4","gravatar_id":"","url":"https://api.github.com/users/qc9c","html_url":"https://github.com/qc9c","followers_url":"https://api.github.com/users/qc9c/followers","following_url":"https://api.github.com/users/qc9c/following{/other_user}","gists_url":"https://api.github.com/users/qc9c/gists{/gist_id}","starred_url":"https://api.github.com/users/qc9c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qc9c/subscriptions","organizations_url":"https://api.github.com/users/qc9c/orgs","repos_url":"https://api.github.com/users/qc9c/repos","events_url":"https://api.github.com/users/qc9c/events{/privacy}","received_events_url":"https://api.github.com/users/qc9c/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","score":5.5}},{"ghsa_id":"GHSA-5mrc-77hj-xjxv","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-5mrc-77hj-xjxv","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5mrc-77hj-xjxv","summary":"Workspace Cloud SDK arguments could execute code during Gmail setup","description":"### Summary\n\nWorkspace Cloud SDK arguments could execute code during Gmail setup. In affected versions, an untrusted workspace `.env` could set `CLOUDSDK_PYTHON_ARGS`. Gmail setup inherited that value when starting `gcloud`, whose launcher passed it as arguments to Python.\n\nThis advisory is scoped to operators who started OpenClaw in attacker-controlled workspace content and then invoked the Gmail setup flow.\n\n### Impact\n\nA crafted `CLOUDSDK_PYTHON_ARGS` value could make the trusted Python interpreter execute attacker-supplied code when Gmail setup ran `gcloud`. The code ran with the OpenClaw host user's permissions and could read credentials, modify files, or start other processes.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, run Gmail setup only from trusted workspaces and clear inherited `CLOUDSDK_*` variables before invoking it.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-5mrc-77hj-xjxv","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:31Z","published_at":"2026-09-11T00:57:31Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.3.28, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-88","name":"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"},{"cwe_id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')"}],"cwe_ids":["CWE-88","CWE-94"],"credits":[{"login":"qc9c","type":"reporter"}],"credits_detailed":[{"user":{"login":"qc9c","id":136676372,"node_id":"U_kgDOCCWEFA","avatar_url":"https://avatars.githubusercontent.com/u/136676372?v=4","gravatar_id":"","url":"https://api.github.com/users/qc9c","html_url":"https://github.com/qc9c","followers_url":"https://api.github.com/users/qc9c/followers","following_url":"https://api.github.com/users/qc9c/following{/other_user}","gists_url":"https://api.github.com/users/qc9c/gists{/gist_id}","starred_url":"https://api.github.com/users/qc9c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qc9c/subscriptions","organizations_url":"https://api.github.com/users/qc9c/orgs","repos_url":"https://api.github.com/users/qc9c/repos","events_url":"https://api.github.com/users/qc9c/events{/privacy}","received_events_url":"https://api.github.com/users/qc9c/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8}},{"ghsa_id":"GHSA-xw48-j584-r73h","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-xw48-j584-r73h","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xw48-j584-r73h","summary":"Twilio pre-auth limits could lock out valid webhooks","description":"### Summary\n\nTwilio pre-auth limits could lock out valid webhooks. In affected versions, the SMS webhook applied its invalid-request rate limit before signature verification and identified clients only by the raw proxy socket address.\n\n### Affected configurations\n\nThis affected SMS/Twilio webhooks behind a trusted reverse proxy or tunnel where multiple external clients shared one socket address at OpenClaw.\n\n### Impact\n\nAn unauthenticated sender could consume the shared pre-auth budget with invalid requests and cause later correctly signed Twilio callbacks to receive HTTP 429. The attacker could not forge a callback or access message data; impact was temporary inbound SMS loss while the shared window remained exhausted.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, avoid placing untrusted traffic and Twilio callbacks behind the same proxy source address, or enforce per-client limits at the proxy.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-xw48-j584-r73h","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:56Z","published_at":"2026-09-11T00:58:56Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.6.6, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"cwe_ids":["CWE-400"],"credits":[{"login":"harjothkhara","type":"reporter"}],"credits_detailed":[{"user":{"login":"harjothkhara","id":48686985,"node_id":"MDQ6VXNlcjQ4Njg2OTg1","avatar_url":"https://avatars.githubusercontent.com/u/48686985?v=4","gravatar_id":"","url":"https://api.github.com/users/harjothkhara","html_url":"https://github.com/harjothkhara","followers_url":"https://api.github.com/users/harjothkhara/followers","following_url":"https://api.github.com/users/harjothkhara/following{/other_user}","gists_url":"https://api.github.com/users/harjothkhara/gists{/gist_id}","starred_url":"https://api.github.com/users/harjothkhara/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/harjothkhara/subscriptions","organizations_url":"https://api.github.com/users/harjothkhara/orgs","repos_url":"https://api.github.com/users/harjothkhara/repos","events_url":"https://api.github.com/users/harjothkhara/events{/privacy}","received_events_url":"https://api.github.com/users/harjothkhara/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3}},{"ghsa_id":"GHSA-fw6q-2frm-jxxr","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-fw6q-2frm-jxxr","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fw6q-2frm-jxxr","summary":"Synology pre-auth limits could lock out valid webhooks","description":"### Summary\n\nSynology pre-auth limits could lock out valid webhooks. In affected versions, invalid-token throttling ran before authentication and identified requests by the raw proxy socket address.\n\n### Affected configurations\n\nThis affected Synology Chat webhooks behind a trusted reverse proxy or tunnel where multiple external clients shared one socket address at OpenClaw.\n\n### Impact\n\nAn unauthenticated sender could consume the shared invalid-token budget and cause later valid Synology Chat callbacks to be rejected until the rate-limit window cleared. The attacker could not obtain a valid token or access message data; impact was temporary channel availability loss.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.8.1` or later. Before upgrading, avoid placing untrusted traffic and Synology callbacks behind the same proxy source address, or enforce per-client limits at the proxy.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-fw6q-2frm-jxxr","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:07Z","published_at":"2026-09-11T00:58:07Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.3.25, < 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"cwe_ids":["CWE-400"],"credits":[{"login":"harjothkhara","type":"reporter"}],"credits_detailed":[{"user":{"login":"harjothkhara","id":48686985,"node_id":"MDQ6VXNlcjQ4Njg2OTg1","avatar_url":"https://avatars.githubusercontent.com/u/48686985?v=4","gravatar_id":"","url":"https://api.github.com/users/harjothkhara","html_url":"https://github.com/harjothkhara","followers_url":"https://api.github.com/users/harjothkhara/followers","following_url":"https://api.github.com/users/harjothkhara/following{/other_user}","gists_url":"https://api.github.com/users/harjothkhara/gists{/gist_id}","starred_url":"https://api.github.com/users/harjothkhara/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/harjothkhara/subscriptions","organizations_url":"https://api.github.com/users/harjothkhara/orgs","repos_url":"https://api.github.com/users/harjothkhara/repos","events_url":"https://api.github.com/users/harjothkhara/events{/privacy}","received_events_url":"https://api.github.com/users/harjothkhara/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3}},{"ghsa_id":"GHSA-5m4g-88rg-69pj","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-5m4g-88rg-69pj","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5m4g-88rg-69pj","summary":"MCP loopback could omit sandbox tool deny policy","description":"### Summary\n\nMCP loopback could omit sandbox tool deny policy. In affected versions, a sandboxed coding-agent session could list and invoke tools explicitly denied by `sandbox.tools.deny`.\n\nThis advisory is scoped to the bundled MCP loopback used by sandboxed coding-agent sessions. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen MCP loopback is enabled for a sandboxed session, the session could reach a denied tool and access data or actions that the operator intended to exclude. Practical impact depends on the denied tools and their granted capabilities.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.8.1` or later. Until upgraded, disable MCP loopback for sandboxed coding agents or remove sensitive tools from the Gateway inventory.","severity":"low","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-5m4g-88rg-69pj","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:30Z","published_at":"2026-09-11T00:57:30Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"qc9c","type":"reporter"}],"credits_detailed":[{"user":{"login":"qc9c","id":136676372,"node_id":"U_kgDOCCWEFA","avatar_url":"https://avatars.githubusercontent.com/u/136676372?v=4","gravatar_id":"","url":"https://api.github.com/users/qc9c","html_url":"https://github.com/qc9c","followers_url":"https://api.github.com/users/qc9c/followers","following_url":"https://api.github.com/users/qc9c/following{/other_user}","gists_url":"https://api.github.com/users/qc9c/gists{/gist_id}","starred_url":"https://api.github.com/users/qc9c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qc9c/subscriptions","organizations_url":"https://api.github.com/users/qc9c/orgs","repos_url":"https://api.github.com/users/qc9c/repos","events_url":"https://api.github.com/users/qc9c/events{/privacy}","received_events_url":"https://api.github.com/users/qc9c/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.3}},{"ghsa_id":"GHSA-72p2-79fg-pvph","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-72p2-79fg-pvph","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-72p2-79fg-pvph","summary":"Trusted-host DNS checks could admit unspecified addresses","description":"### Summary\n\nTrusted-host DNS checks could admit unspecified addresses. In affected versions, a trusted hostname that resolved to `0.0.0.0` or `::` could connect to a loopback service despite OpenClaw's SSRF destination checks.\n\nThis advisory is scoped to fetches that use the trusted-host DNS recheck. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen an attacker could influence DNS for an allowed hostname, a guarded fetch could reach a service bound only to loopback and disclose its response. Practical impact depends on the reachable service and the data it returns.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.8.1` or later. Before upgrading, avoid trusting hostnames whose DNS answers are outside the operator's control.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-72p2-79fg-pvph","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:41Z","published_at":"2026-09-11T00:57:41Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-918","name":"Server-Side Request Forgery (SSRF)"}],"cwe_ids":["CWE-918"],"credits":[{"login":"qc9c","type":"reporter"}],"credits_detailed":[{"user":{"login":"qc9c","id":136676372,"node_id":"U_kgDOCCWEFA","avatar_url":"https://avatars.githubusercontent.com/u/136676372?v=4","gravatar_id":"","url":"https://api.github.com/users/qc9c","html_url":"https://github.com/qc9c","followers_url":"https://api.github.com/users/qc9c/followers","following_url":"https://api.github.com/users/qc9c/following{/other_user}","gists_url":"https://api.github.com/users/qc9c/gists{/gist_id}","starred_url":"https://api.github.com/users/qc9c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qc9c/subscriptions","organizations_url":"https://api.github.com/users/qc9c/orgs","repos_url":"https://api.github.com/users/qc9c/repos","events_url":"https://api.github.com/users/qc9c/events{/privacy}","received_events_url":"https://api.github.com/users/qc9c/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9}},{"ghsa_id":"GHSA-58qx-6m8p-wh2j","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-58qx-6m8p-wh2j","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-58qx-6m8p-wh2j","summary":"Slack group DMs could skip sender allowlists","description":"### Summary\n\nSlack group DMs could skip sender allowlists. In affected versions, a sender in a multi-person direct message could trigger an OpenClaw agent even when the configured Slack group sender policy did not allow that sender.\n\nThis advisory is scoped to Slack multi-person direct messages and their message, command, and interaction ingress. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen a Slack agent was present in a group DM, a disallowed participant could trigger the agent within the tools and data already granted to that agent. Practical impact depends on the agent's tool policy and channel configuration.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nupgrade to `@openclaw/slack@2026.8.1` or later. Until upgraded, do not add tool-enabled agents to multi-person direct messages containing untrusted participants.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-58qx-6m8p-wh2j","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:24Z","published_at":"2026-09-11T00:57:24Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/slack"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-4g58-43jr-6738","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-4g58-43jr-6738","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4g58-43jr-6738","summary":"Browser wait predicates could reach blocked destinations","description":"### Summary\n\nBrowser wait predicates could reach blocked destinations. In affected versions, `wait --fn` against an existing browser session could cause requests to loopback or private destinations without the navigation checks applied to other browser actions.\n\nThis advisory is scoped to predicate waits on an already-open browser session. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen lower-trust input could steer a browser-enabled agent and an existing session was available, the browser could request a destination that OpenClaw's browser SSRF policy would otherwise reject. Practical impact depends on the reachable service and browser state.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.8.1` or later. Before upgrading, disable browser predicate evaluation for sessions exposed to lower-trust content.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-4g58-43jr-6738","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:18Z","published_at":"2026-09-11T00:57:18Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-918","name":"Server-Side Request Forgery (SSRF)"}],"cwe_ids":["CWE-918"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4}},{"ghsa_id":"GHSA-fvxr-9g24-x3hf","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-fvxr-9g24-x3hf","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fvxr-9g24-x3hf","summary":"Video asset downloads could reach private destinations","description":"### Summary\n\nVideo asset downloads could reach private destinations. In affected versions, the OpenClaw CLI fetched a provider-returned video asset URL without applying the network destination checks used for untrusted remote URLs.\n\nThis advisory is scoped to video-generation providers that return a remote asset URL. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nA malicious or compromised provider could return a private or loopback URL after an operator requested video generation, causing the CLI to make a server-side request. Practical impact depends on the services reachable from the OpenClaw host.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.8.1` or later. Before upgrading, disable video generation from providers that are not fully trusted.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-fvxr-9g24-x3hf","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:06Z","published_at":"2026-09-11T00:58:06Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","score":6.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-918","name":"Server-Side Request Forgery (SSRF)"}],"cwe_ids":["CWE-918"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","score":6.3}},{"ghsa_id":"GHSA-qw7m-h363-33qw","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-qw7m-h363-33qw","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qw7m-h363-33qw","summary":"chat.send could expose owner-only infrastructure tools","description":"### Summary\n\n`chat.send` could expose owner-only infrastructure tools. In affected versions, a non-owner caller in an identity-bearing Gateway deployment could start a chat turn whose tool inventory included `gateway` and `cron`.\n\nThis advisory is scoped to Gateway authentication modes that honor caller identity and narrower operator scopes. Shared-secret token and password callers are full trusted operators under OpenClaw's security model.\n\n### Impact\n\nA write-scoped non-owner caller could cause an agent turn to invoke owner-only configuration or scheduling operations, including persistent state changes. Practical impact depends on the tools selected by the model and the caller's ability to steer the turn.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, restrict `chat.send` to administrators in identity-bearing deployments and remove `gateway` and `cron` from affected agent tool policies.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-qw7m-h363-33qw","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:38Z","published_at":"2026-09-11T00:58:38Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","score":7.6},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-269","name":"Improper Privilege Management"},{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-269","CWE-862"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","score":7.6}},{"ghsa_id":"GHSA-4wvr-f35r-f8w4","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-4wvr-f35r-f8w4","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4wvr-f35r-f8w4","summary":"message.action could trust spoofed requester provenance","description":"### Summary\n\n`message.action` could trust spoofed requester provenance. In affected versions, a write-scoped caller in an identity-bearing Gateway deployment could supply another sender's identifier to channel authorization checks.\n\nThis advisory is scoped to Gateway authentication modes that honor caller identity and narrower operator scopes. Shared-secret token and password callers are full trusted operators under OpenClaw's security model.\n\n### Impact\n\nA write-scoped caller could invoke a channel action under spoofed requester identity and reach operations that the channel adapter would have denied to the real caller. Practical impact depends on the enabled channel, action, and target account permissions.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, restrict `message.action` access to administrators in identity-bearing deployments and disable sensitive channel actions that rely on requester identity.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-4wvr-f35r-f8w4","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:22Z","published_at":"2026-09-11T00:57:22Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","score":7.6},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-639","CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","score":7.6}},{"ghsa_id":"GHSA-8xxh-v4vc-qvm4","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-8xxh-v4vc-qvm4","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8xxh-v4vc-qvm4","summary":"Cron tool could accept mixed-case command payloads","description":"### Summary\n\nCron tool could accept mixed-case command payloads. In affected versions, a mixed-case payload kind could pass the agent-facing shell-execution guard and later normalize into a command job.\n\nThis advisory is scoped to cron jobs created or edited through the model-facing `cron` tool. Direct CLI and authorized Gateway scheduling surfaces remain trusted operator controls.\n\n### Impact\n\nAn actor able to steer a tool-enabled agent could create a persistent cron job that executed attacker-selected commands with the OpenClaw process user's privileges. Practical impact includes access to host files, credentials, and scheduled service availability.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, remove the `cron` tool from agents exposed to lower-trust content and inspect scheduled jobs for command payloads.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-8xxh-v4vc-qvm4","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:50Z","published_at":"2026-09-11T00:57:50Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-178","name":"Improper Handling of Case Sensitivity"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-178","CWE-863"],"credits":[{"login":"shayd-versa","type":"reporter"}],"credits_detailed":[{"user":{"login":"shayd-versa","id":276232022,"node_id":"U_kgDOEHb3Vg","avatar_url":"https://avatars.githubusercontent.com/u/276232022?v=4","gravatar_id":"","url":"https://api.github.com/users/shayd-versa","html_url":"https://github.com/shayd-versa","followers_url":"https://api.github.com/users/shayd-versa/followers","following_url":"https://api.github.com/users/shayd-versa/following{/other_user}","gists_url":"https://api.github.com/users/shayd-versa/gists{/gist_id}","starred_url":"https://api.github.com/users/shayd-versa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shayd-versa/subscriptions","organizations_url":"https://api.github.com/users/shayd-versa/orgs","repos_url":"https://api.github.com/users/shayd-versa/repos","events_url":"https://api.github.com/users/shayd-versa/events{/privacy}","received_events_url":"https://api.github.com/users/shayd-versa/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":4,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-gcm4-fmcp-2f9r","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-gcm4-fmcp-2f9r","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gcm4-fmcp-2f9r","summary":"iOS Share Extension stored Gateway credentials outside Keychain","description":"### Summary\n\nThe iOS Share Extension stored Gateway credentials outside Keychain. In affected versions, the app stored the Share relay token and password as cleartext JSON in App Group UserDefaults. This created a second credential copy outside the device-bound Keychain storage used elsewhere in the app.\n\n### Affected configurations\n\nThis affects iOS installations with a configured Share relay when an attacker obtains an unencrypted Finder/iTunes backup or extracts the App Group container from a jailbroken or forensically imaged device.\n\n### Impact\n\nAn attacker with one of these artifacts could recover a still-valid Gateway token or password and authenticate with its operator authority. The issue required prior access to a backup or extracted device container; it did not expose credentials remotely from a healthy device.\n\n### Patched Versions\n\nThe first stable patched iOS version is `2026.8.11`.\n\n### Mitigations\n\nUpgrade OpenClaw for iOS to `2026.8.11` or later. Before upgrading, avoid unencrypted device backups and rotate Gateway credentials if an affected backup or device image may have left your control.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-gcm4-fmcp-2f9r","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:13Z","published_at":"2026-09-11T00:58:13Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"other","name":"OpenClaw iOS"},"vulnerable_version_range":"< 2026.8.11","patched_versions":"2026.8.11","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-312","name":"Cleartext Storage of Sensitive Information"},{"cwe_id":"CWE-522","name":"Insufficiently Protected Credentials"}],"cwe_ids":["CWE-312","CWE-522"],"credits":[{"login":"yetval","type":"reporter"}],"credits_detailed":[{"user":{"login":"yetval","id":102706514,"node_id":"U_kgDOBh8tUg","avatar_url":"https://avatars.githubusercontent.com/u/102706514?v=4","gravatar_id":"","url":"https://api.github.com/users/yetval","html_url":"https://github.com/yetval","followers_url":"https://api.github.com/users/yetval/followers","following_url":"https://api.github.com/users/yetval/following{/other_user}","gists_url":"https://api.github.com/users/yetval/gists{/gist_id}","starred_url":"https://api.github.com/users/yetval/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yetval/subscriptions","organizations_url":"https://api.github.com/users/yetval/orgs","repos_url":"https://api.github.com/users/yetval/repos","events_url":"https://api.github.com/users/yetval/events{/privacy}","received_events_url":"https://api.github.com/users/yetval/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5}},{"ghsa_id":"GHSA-g7fw-3gjp-g5hf","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-g7fw-3gjp-g5hf","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g7fw-3gjp-g5hf","summary":"Channel read actions could skip target allowlists","description":"### Summary\n\nChannel read actions could skip target allowlists. In affected versions, explicit read targets in Microsoft Teams, Feishu, Matrix, and Google Chat could reach channels or rooms outside the configured read policy.\n\nThis advisory is scoped to caller-supplied targets for message, reaction, pin, member, and related metadata reads in the named plugins. It does not change OpenClaw's trusted-operator model or create per-user isolation within one Gateway.\n\n### Impact\n\nA lower-trust sender or steered agent with access to a channel read action could retrieve content or metadata from a target excluded by the operator's channel allowlist. Practical impact depends on the bot account's platform permissions.\n\n### Patched Versions\n\nThe first stable patched version is `2026.8.1`.\n\n### Mitigations\n\nupgrade each affected channel plugin to `2026.8.1` or later. Before upgrading, disable explicit-target read actions or limit the connected bot account to allowed channels at the platform level.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-g7fw-3gjp-g5hf","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:12Z","published_at":"2026-09-11T00:58:12Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/msteams"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]},{"package":{"ecosystem":"npm","name":"@openclaw/feishu"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]},{"package":{"ecosystem":"npm","name":"@openclaw/matrix"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]},{"package":{"ecosystem":"npm","name":"@openclaw/googlechat"},"vulnerable_version_range":"< 2026.8.1","patched_versions":"2026.8.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"qc9c","type":"reporter"}],"credits_detailed":[{"user":{"login":"qc9c","id":136676372,"node_id":"U_kgDOCCWEFA","avatar_url":"https://avatars.githubusercontent.com/u/136676372?v=4","gravatar_id":"","url":"https://api.github.com/users/qc9c","html_url":"https://github.com/qc9c","followers_url":"https://api.github.com/users/qc9c/followers","following_url":"https://api.github.com/users/qc9c/following{/other_user}","gists_url":"https://api.github.com/users/qc9c/gists{/gist_id}","starred_url":"https://api.github.com/users/qc9c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qc9c/subscriptions","organizations_url":"https://api.github.com/users/qc9c/orgs","repos_url":"https://api.github.com/users/qc9c/repos","events_url":"https://api.github.com/users/qc9c/events{/privacy}","received_events_url":"https://api.github.com/users/qc9c/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}},{"ghsa_id":"GHSA-35wj-hm2r-ghgw","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-35wj-hm2r-ghgw","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-35wj-hm2r-ghgw","summary":"Discord guild reads could skip target allowlists","description":"### Summary\n\nDiscord guild reads could skip target allowlists. In affected versions, guild metadata actions could read information from a server or channel outside the configured Discord read-target policy.\n\nThis advisory is scoped to explicit guild metadata reads in the Discord plugin. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nA lower-trust sender or steered agent with access to Discord read actions could retrieve guild metadata excluded by the operator's channel allowlist. Practical impact depends on the Discord bot account's platform permissions and accessible servers.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `@openclaw/discord@2026.7.1` or later. Before upgrading, disable Discord guild metadata actions or restrict the bot account to allowed servers and channels.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-35wj-hm2r-ghgw","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:13Z","published_at":"2026-09-11T00:57:13Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/discord"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"qc9c","type":"reporter"}],"credits_detailed":[{"user":{"login":"qc9c","id":136676372,"node_id":"U_kgDOCCWEFA","avatar_url":"https://avatars.githubusercontent.com/u/136676372?v=4","gravatar_id":"","url":"https://api.github.com/users/qc9c","html_url":"https://github.com/qc9c","followers_url":"https://api.github.com/users/qc9c/followers","following_url":"https://api.github.com/users/qc9c/following{/other_user}","gists_url":"https://api.github.com/users/qc9c/gists{/gist_id}","starred_url":"https://api.github.com/users/qc9c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qc9c/subscriptions","organizations_url":"https://api.github.com/users/qc9c/orgs","repos_url":"https://api.github.com/users/qc9c/repos","events_url":"https://api.github.com/users/qc9c/events{/privacy}","received_events_url":"https://api.github.com/users/qc9c/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3}},{"ghsa_id":"GHSA-rgjw-6v73-php6","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-rgjw-6v73-php6","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rgjw-6v73-php6","summary":"Windows allowlist execution could use workspace shadows","description":"### Summary\n\nWindows allowlist execution could use workspace shadows. In affected versions, PowerShell command analysis could approve an exact executable from `PATH` but later run a same-named executable from the workspace directory.\n\nThis advisory is scoped to Windows hosts using exec allowlist mode with a PowerShell inner command and a workspace-controlled executable sharing the approved basename. It does not rely on replacement of the approved executable itself.\n\n### Impact\n\nIf lower-trust content could place an executable in the workspace and steer an approved PowerShell command, OpenClaw could execute the workspace file instead of the allowlisted path. The process would run with the Gateway or node-host user's privileges.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, avoid bare executable names inside approved PowerShell commands and keep executable files out of agent-writable workspaces.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-rgjw-6v73-php6","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:41Z","published_at":"2026-09-11T00:58:41Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.2.26 < 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","score":6.7},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-426","name":"Untrusted Search Path"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-426","CWE-863"],"credits":[{"login":"wwwvwwvwwwwwvwwvw","type":"reporter"}],"credits_detailed":[{"user":{"login":"wwwvwwvwwwwwvwwvw","id":121104713,"node_id":"U_kgDOBzfpSQ","avatar_url":"https://avatars.githubusercontent.com/u/121104713?v=4","gravatar_id":"","url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw","html_url":"https://github.com/wwwvwwvwwwwwvwwvw","followers_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/followers","following_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/following{/other_user}","gists_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/gists{/gist_id}","starred_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/subscriptions","organizations_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/orgs","repos_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/repos","events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/events{/privacy}","received_events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","score":6.7}},{"ghsa_id":"GHSA-p5g8-m35v-7m82","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-p5g8-m35v-7m82","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p5g8-m35v-7m82","summary":"Claude permission replies could omit owner authorization","description":"### Summary\n\nClaude permission replies could omit owner authorization. In affected versions, an authorized non-owner channel sender could approve or deny a pending Claude Code permission request through the MCP channel bridge.\n\nThis advisory is scoped to Claude permission prompts delivered through configured message channels. It does not change OpenClaw's shared-agent model; the failed boundary is the explicit owner requirement for resolving host permission requests.\n\n### Impact\n\nWhen a Claude Code run was waiting for permission, a non-owner sender with channel command access could approve an action intended for the owner. Practical impact depends on the pending action and the host capabilities requested by Claude Code.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, avoid delivering Claude permission prompts to channels with non-owner participants and cancel unattended pending requests.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-p5g8-m35v-7m82","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:31Z","published_at":"2026-09-11T00:58:31Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8.0},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"whyiug","type":"reporter"}],"credits_detailed":[{"user":{"login":"whyiug","id":6668626,"node_id":"MDQ6VXNlcjY2Njg2MjY=","avatar_url":"https://avatars.githubusercontent.com/u/6668626?v=4","gravatar_id":"","url":"https://api.github.com/users/whyiug","html_url":"https://github.com/whyiug","followers_url":"https://api.github.com/users/whyiug/followers","following_url":"https://api.github.com/users/whyiug/following{/other_user}","gists_url":"https://api.github.com/users/whyiug/gists{/gist_id}","starred_url":"https://api.github.com/users/whyiug/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whyiug/subscriptions","organizations_url":"https://api.github.com/users/whyiug/orgs","repos_url":"https://api.github.com/users/whyiug/repos","events_url":"https://api.github.com/users/whyiug/events{/privacy}","received_events_url":"https://api.github.com/users/whyiug/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8.0}},{"ghsa_id":"GHSA-9p6m-2872-xm7x","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-9p6m-2872-xm7x","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9p6m-2872-xm7x","summary":"Codex bind could omit owner authorization","description":"### Summary\n\nCodex bind could omit owner authorization. In affected versions, an authorized non-owner channel sender could create a native Codex conversation binding and start host-capable Codex turns.\n\nThis advisory is scoped to the Codex plugin's native binding controls. It does not change OpenClaw's trusted-plugin model: Codex remains trusted once an owner authorizes its use, while creating or changing a native binding requires owner or administrator authority.\n\n### Impact\n\nA non-owner sender with command access could bind a conversation to the native Codex runtime and reach the files, tools, and processes available to that runtime. Practical impact depends on the configured Codex permissions and host environment.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, disable Codex bind commands in channels with non-owner participants and remove unintended native bindings.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-9p6m-2872-xm7x","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:55Z","published_at":"2026-09-11T00:57:55Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-269","name":"Improper Privilege Management"},{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-269","CWE-862"],"credits":[{"login":"wwwvwwvwwwwwvwwvw","type":"reporter"}],"credits_detailed":[{"user":{"login":"wwwvwwvwwwwwvwwvw","id":121104713,"node_id":"U_kgDOBzfpSQ","avatar_url":"https://avatars.githubusercontent.com/u/121104713?v=4","gravatar_id":"","url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw","html_url":"https://github.com/wwwvwwvwwwwwvwwvw","followers_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/followers","following_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/following{/other_user}","gists_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/gists{/gist_id}","starred_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/subscriptions","organizations_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/orgs","repos_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/repos","events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/events{/privacy}","received_events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-pjjr-5qhr-5w6r","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-pjjr-5qhr-5w6r","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pjjr-5qhr-5w6r","summary":"Codex computer-use install could omit owner authorization","description":"### Summary\n\nCodex computer-use install could omit owner authorization. In affected versions, an authorized non-owner channel sender could install a Codex plugin and cause its configured MCP process to start on the OpenClaw host.\n\nThis advisory is scoped to the Codex computer-use installation command. Installed plugins remain trusted code under OpenClaw's security model; the failed boundary is authorization to install that code in the first place.\n\n### Impact\n\nA non-owner sender with command access could install attacker-selected plugin code and execute a host MCP process with the OpenClaw user's privileges. This could affect host confidentiality, integrity, and availability.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, disable Codex computer-use installation in message channels and review installed Codex plugins for unexpected entries.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-pjjr-5qhr-5w6r","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:34Z","published_at":"2026-09-11T00:58:34Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-862"],"credits":[{"login":"wwwvwwvwwwwwvwwvw","type":"reporter"}],"credits_detailed":[{"user":{"login":"wwwvwwvwwwwwvwwvw","id":121104713,"node_id":"U_kgDOBzfpSQ","avatar_url":"https://avatars.githubusercontent.com/u/121104713?v=4","gravatar_id":"","url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw","html_url":"https://github.com/wwwvwwvwwwwwvwwvw","followers_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/followers","following_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/following{/other_user}","gists_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/gists{/gist_id}","starred_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/subscriptions","organizations_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/orgs","repos_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/repos","events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/events{/privacy}","received_events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-jghr-xp78-995p","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-jghr-xp78-995p","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jghr-xp78-995p","summary":"Browser proxy could miss its admin scope","description":"### Summary\n\nBrowser proxy could miss its admin scope. In affected versions, a write-scoped caller in an identity-bearing Gateway deployment could reach browser control through `node.invoke` even though direct `browser.request` access required administrator scope.\n\nThis advisory is scoped to Gateway authentication modes that honor caller identity and narrower operator scopes. Shared-secret token and password callers are full trusted operators under OpenClaw's security model.\n\n### Impact\n\nA write-scoped caller with access to a connected browser-capable node could inspect pages, navigate tabs, or interact with browser-visible applications without the configured admin requirement. Practical impact depends on the browser profile and signed-in state.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, restrict `node.invoke` to administrators in identity-bearing deployments and disconnect sensitive browser nodes.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-jghr-xp78-995p","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:23Z","published_at":"2026-09-11T00:58:23Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"wwwvwwvwwwwwvwwvw","type":"reporter"}],"credits_detailed":[{"user":{"login":"wwwvwwvwwwwwvwwvw","id":121104713,"node_id":"U_kgDOBzfpSQ","avatar_url":"https://avatars.githubusercontent.com/u/121104713?v=4","gravatar_id":"","url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw","html_url":"https://github.com/wwwvwwvwwwwwvwwvw","followers_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/followers","following_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/following{/other_user}","gists_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/gists{/gist_id}","starred_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/subscriptions","organizations_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/orgs","repos_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/repos","events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/events{/privacy}","received_events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3}},{"ghsa_id":"GHSA-9x88-f7rh-4c83","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-9x88-f7rh-4c83","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9x88-f7rh-4c83","summary":"Browser node targets could bypass sandbox host control","description":"### Summary\n\nBrowser node targets could bypass sandbox host control. In affected versions, a sandboxed browser tool could select a paired node and reach host browser actions despite `allowHostControl=false`.\n\nThis advisory is scoped to sandboxed sessions using the browser tool with a node target. It does not change OpenClaw's trusted-node model; the failed boundary is the operator's explicit sandbox decision to deny host control from that session.\n\n### Impact\n\nA lower-trust input able to steer the sandboxed agent could inspect or manipulate a browser on a paired node. Practical impact depends on the connected browser profile, signed-in state, and actions exposed by the browser plugin.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, remove browser tools and paired-node targets from sandboxed agents configured with host control disabled.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-9x88-f7rh-4c83","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:57Z","published_at":"2026-09-11T00:57:57Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"wwwvwwvwwwwwvwwvw","type":"reporter"}],"credits_detailed":[{"user":{"login":"wwwvwwvwwwwwvwwvw","id":121104713,"node_id":"U_kgDOBzfpSQ","avatar_url":"https://avatars.githubusercontent.com/u/121104713?v=4","gravatar_id":"","url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw","html_url":"https://github.com/wwwvwwvwwwwwvwwvw","followers_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/followers","following_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/following{/other_user}","gists_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/gists{/gist_id}","starred_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/subscriptions","organizations_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/orgs","repos_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/repos","events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/events{/privacy}","received_events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3}},{"ghsa_id":"GHSA-5j27-v2pw-cj9m","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-5j27-v2pw-cj9m","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5j27-v2pw-cj9m","summary":"Talk Voice changes could omit admin authorization","description":"### Summary\n\nTalk Voice changes could omit admin authorization. In affected versions, an authorized non-owner external-channel sender could use `/voice set` to persist the Gateway's configured Talk voice.\n\nThis advisory is scoped to the mutating Talk Voice command. Read-only voice status remains available according to normal channel policy, while persistent Gateway configuration changes require owner or administrator authority.\n\n### Impact\n\nA non-owner sender with command access could change the voice used by Talk responses for the configured provider. This affects configuration integrity and future voice output but does not by itself expose credentials or grant additional host capabilities.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, disable `/voice set` in external channels or limit channel command access to owners.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-5j27-v2pw-cj9m","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:27Z","published_at":"2026-09-11T00:57:27Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3}},{"ghsa_id":"GHSA-xw9g-7xvv-gcjc","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-xw9g-7xvv-gcjc","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xw9g-7xvv-gcjc","summary":"Active Memory global toggles could omit owner checks","description":"### Summary\n\nActive Memory global toggles could omit owner checks. In affected versions, an authorized non-owner external-channel sender could enable or disable Active Memory for the Gateway.\n\nThis advisory is scoped to persistent global `on` and `off` mutations. Session-level controls and read-only status remain governed by their existing command policy, and OpenClaw does not treat one shared Gateway as adversarial multi-tenant isolation.\n\n### Impact\n\nA non-owner sender could disable memory recall for future sessions or re-enable global recall where the owner expected it to remain disabled. Practical confidentiality and availability impact depends on stored memories and subsequent conversations.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, disable global Active Memory commands in external channels or restrict command access to owners.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-xw9g-7xvv-gcjc","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:58Z","published_at":"2026-09-11T00:58:58Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3}},{"ghsa_id":"GHSA-22v4-33m3-8p7m","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-22v4-33m3-8p7m","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-22v4-33m3-8p7m","summary":"Memory dreaming changes could omit owner checks","description":"### Summary\n\nMemory dreaming changes could omit owner checks. In affected versions, an authorized non-owner external-channel sender could enable or disable the Gateway's persistent Memory Core dreaming behavior.\n\nThis advisory is scoped to persistent `/dreaming on` and `/dreaming off` mutations. Read-only status and help remain governed by normal command policy, and OpenClaw does not treat one shared Gateway as adversarial multi-tenant isolation.\n\n### Impact\n\nA non-owner sender could disable background memory processing or re-enable durable memory promotion where the owner expected it to remain disabled. Practical confidentiality, integrity, and availability impact depends on stored conversation material and subsequent memory use.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, disable dreaming commands in external channels or restrict channel command access to owners.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-22v4-33m3-8p7m","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:10Z","published_at":"2026-09-11T00:57:10Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.4.10 < 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3}},{"ghsa_id":"GHSA-q9j5-4xr6-xqqw","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-q9j5-4xr6-xqqw","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q9j5-4xr6-xqqw","summary":"Group activation changes could omit owner authorization","description":"### Summary\n\nGroup activation changes could omit owner authorization. In affected versions, an authorized non-owner channel sender could change whether a group required mention-based activation.\n\nThis advisory is scoped to persistent `/activation` policy changes. It does not make session presence or conversation ownership a security boundary; the failed control is the documented owner requirement for changing channel trigger policy.\n\n### Impact\n\nA non-owner sender could make the agent respond more broadly in a group or suppress expected activation behavior. This could expose responses to additional group traffic or reduce availability until an owner restored the intended setting.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, disable activation-setting commands in shared channels and verify group activation configuration after untrusted command activity.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-q9j5-4xr6-xqqw","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:35Z","published_at":"2026-09-11T00:58:35Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-862"],"credits":[{"login":"yetval","type":"reporter"}],"credits_detailed":[{"user":{"login":"yetval","id":102706514,"node_id":"U_kgDOBh8tUg","avatar_url":"https://avatars.githubusercontent.com/u/102706514?v=4","gravatar_id":"","url":"https://api.github.com/users/yetval","html_url":"https://github.com/yetval","followers_url":"https://api.github.com/users/yetval/followers","following_url":"https://api.github.com/users/yetval/following{/other_user}","gists_url":"https://api.github.com/users/yetval/gists{/gist_id}","starred_url":"https://api.github.com/users/yetval/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yetval/subscriptions","organizations_url":"https://api.github.com/users/yetval/orgs","repos_url":"https://api.github.com/users/yetval/repos","events_url":"https://api.github.com/users/yetval/events{/privacy}","received_events_url":"https://api.github.com/users/yetval/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4}},{"ghsa_id":"GHSA-89cw-7452-cfrf","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-89cw-7452-cfrf","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-89cw-7452-cfrf","summary":"Trajectory export could omit owner authorization","description":"### Summary\n\nTrajectory export could omit owner authorization. In affected versions, an authorized non-owner sender in a direct conversation could request, approve, and receive an owner-only trajectory bundle.\n\nThis advisory is scoped to `/export-trajectory`, which is documented as an owner command. It does not change the intentionally broader authorization contract of `/export-session` or create per-user isolation within a shared Gateway.\n\n### Impact\n\nA non-owner sender could receive prompts, model messages, tool schemas and results, runtime events, and local path metadata from the affected session. Practical impact depends on the contents recorded in that trajectory.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, disable trajectory export commands in channels with non-owner participants and remove unexpected exported bundles.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-89cw-7452-cfrf","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:49Z","published_at":"2026-09-11T00:57:49Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-200","CWE-862"],"credits":[{"login":"yetval","type":"reporter"}],"credits_detailed":[{"user":{"login":"yetval","id":102706514,"node_id":"U_kgDOBh8tUg","avatar_url":"https://avatars.githubusercontent.com/u/102706514?v=4","gravatar_id":"","url":"https://api.github.com/users/yetval","html_url":"https://github.com/yetval","followers_url":"https://api.github.com/users/yetval/followers","following_url":"https://api.github.com/users/yetval/following{/other_user}","gists_url":"https://api.github.com/users/yetval/gists{/gist_id}","starred_url":"https://api.github.com/users/yetval/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yetval/subscriptions","organizations_url":"https://api.github.com/users/yetval/orgs","repos_url":"https://api.github.com/users/yetval/repos","events_url":"https://api.github.com/users/yetval/events{/privacy}","received_events_url":"https://api.github.com/users/yetval/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}},{"ghsa_id":"GHSA-4hwv-rj92-h7rp","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-4hwv-rj92-h7rp","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4hwv-rj92-h7rp","summary":"Diagnostics export could omit owner authorization","description":"### Summary\n\nDiagnostics export could omit owner authorization. In affected versions, an authorized non-owner channel sender could request and receive an owner-only host diagnostics bundle.\n\nThis advisory is scoped to the `/diagnostics` command and the data intentionally collected by that export. It does not change OpenClaw's trusted-operator model or imply that ordinary authorized senders have a general host-file boundary.\n\n### Impact\n\nA non-owner sender could receive diagnostic details about the OpenClaw host, configuration, runtime, and connected services that were intended for the owner. Practical confidentiality impact depends on the enabled integrations and the contents captured in the bundle.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, disable diagnostics commands in channels with non-owner participants and delete any unexpectedly shared diagnostic bundles.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-4hwv-rj92-h7rp","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:57:19Z","published_at":"2026-09-11T00:57:19Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-200","CWE-862"],"credits":[{"login":"yetval","type":"reporter"}],"credits_detailed":[{"user":{"login":"yetval","id":102706514,"node_id":"U_kgDOBh8tUg","avatar_url":"https://avatars.githubusercontent.com/u/102706514?v=4","gravatar_id":"","url":"https://api.github.com/users/yetval","html_url":"https://github.com/yetval","followers_url":"https://api.github.com/users/yetval/followers","following_url":"https://api.github.com/users/yetval/following{/other_user}","gists_url":"https://api.github.com/users/yetval/gists{/gist_id}","starred_url":"https://api.github.com/users/yetval/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yetval/subscriptions","organizations_url":"https://api.github.com/users/yetval/orgs","repos_url":"https://api.github.com/users/yetval/repos","events_url":"https://api.github.com/users/yetval/events{/privacy}","received_events_url":"https://api.github.com/users/yetval/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}},{"ghsa_id":"GHSA-wwx7-573h-pqwc","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-wwx7-573h-pqwc","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wwx7-573h-pqwc","summary":"MCP configuration changes could omit owner authorization","description":"### Summary\n\nMCP configuration changes could omit owner authorization. In affected versions, an authorized non-owner external-channel sender could use `/mcp set` or `/mcp unset` to persist Gateway MCP server configuration.\n\nThis advisory is scoped to mutating MCP chat commands. Installed and owner-configured MCP servers remain trusted integrations; the failed boundary is authorization to add, replace, or remove their process configuration.\n\n### Impact\n\nA non-owner sender could persist an attacker-selected stdio MCP command that executed with the OpenClaw process user's privileges when MCP configuration loaded. This could affect host confidentiality, integrity, and availability.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, disable MCP chat commands in external channels and inspect configured MCP servers for unexpected entries.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-wwx7-573h-pqwc","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:53Z","published_at":"2026-09-11T00:58:53Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"},{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-78","CWE-862"],"credits":[{"login":"yetval","type":"reporter"}],"credits_detailed":[{"user":{"login":"yetval","id":102706514,"node_id":"U_kgDOBh8tUg","avatar_url":"https://avatars.githubusercontent.com/u/102706514?v=4","gravatar_id":"","url":"https://api.github.com/users/yetval","html_url":"https://github.com/yetval","followers_url":"https://api.github.com/users/yetval/followers","following_url":"https://api.github.com/users/yetval/following{/other_user}","gists_url":"https://api.github.com/users/yetval/gists{/gist_id}","starred_url":"https://api.github.com/users/yetval/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yetval/subscriptions","organizations_url":"https://api.github.com/users/yetval/orgs","repos_url":"https://api.github.com/users/yetval/repos","events_url":"https://api.github.com/users/yetval/events{/privacy}","received_events_url":"https://api.github.com/users/yetval/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-crg9-c62w-j2p5","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-crg9-c62w-j2p5","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-crg9-c62w-j2p5","summary":"OpenShell filesystem mutations could race path validation","description":"### Summary\n\nOpenShell filesystem mutations could race path validation. In affected versions, `remove`, `mkdir`, or `rename` could act on a different filesystem target after OpenClaw completed its sandbox path-safety check.\n\nThis advisory is scoped to OpenShell local mirror mutations during a concurrent path change. It does not rely on an operator intentionally granting host filesystem access outside the sandbox.\n\n### Impact\n\nAn attacker able to win the filesystem race could cause a sandboxed operation to mutate a host path outside the intended mirror root. Practical impact could include unauthorized deletion, directory creation, or rename operations with the OpenClaw process user's permissions.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, disable OpenShell filesystem mutation operations for lower-trust workloads and avoid concurrent changes to mirror paths.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-crg9-c62w-j2p5","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:01Z","published_at":"2026-09-11T00:58:01Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","score":7.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"cwe_ids":["CWE-367"],"credits":[{"login":"gal1ium","type":"reporter"},{"login":"chluo1997","type":"reporter"}],"credits_detailed":[{"user":{"login":"gal1ium","id":68998587,"node_id":"MDQ6VXNlcjY4OTk4NTg3","avatar_url":"https://avatars.githubusercontent.com/u/68998587?v=4","gravatar_id":"","url":"https://api.github.com/users/gal1ium","html_url":"https://github.com/gal1ium","followers_url":"https://api.github.com/users/gal1ium/followers","following_url":"https://api.github.com/users/gal1ium/following{/other_user}","gists_url":"https://api.github.com/users/gal1ium/gists{/gist_id}","starred_url":"https://api.github.com/users/gal1ium/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gal1ium/subscriptions","organizations_url":"https://api.github.com/users/gal1ium/orgs","repos_url":"https://api.github.com/users/gal1ium/repos","events_url":"https://api.github.com/users/gal1ium/events{/privacy}","received_events_url":"https://api.github.com/users/gal1ium/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"},{"user":{"login":"chluo1997","id":70422882,"node_id":"MDQ6VXNlcjcwNDIyODgy","avatar_url":"https://avatars.githubusercontent.com/u/70422882?v=4","gravatar_id":"","url":"https://api.github.com/users/chluo1997","html_url":"https://github.com/chluo1997","followers_url":"https://api.github.com/users/chluo1997/followers","following_url":"https://api.github.com/users/chluo1997/following{/other_user}","gists_url":"https://api.github.com/users/chluo1997/gists{/gist_id}","starred_url":"https://api.github.com/users/chluo1997/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chluo1997/subscriptions","organizations_url":"https://api.github.com/users/chluo1997/orgs","repos_url":"https://api.github.com/users/chluo1997/repos","events_url":"https://api.github.com/users/chluo1997/events{/privacy}","received_events_url":"https://api.github.com/users/chluo1997/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","score":7.8}},{"ghsa_id":"GHSA-jhfx-v2j8-x3m6","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-jhfx-v2j8-x3m6","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jhfx-v2j8-x3m6","summary":"OpenAI-compatible HTTP model overrides could miss admin authorization","description":"### Summary\n\nOpenAI-compatible HTTP model overrides could miss admin authorization. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.8`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-jhfx-v2j8-x3m6","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:36:01Z","published_at":"2026-06-30T00:36:01Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"<= 2026.6.6","patched_versions":"2026.6.8","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","score":7.6},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","score":7.6}},{"ghsa_id":"GHSA-r88x-r7jj-f2cf","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-r88x-r7jj-f2cf","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r88x-r7jj-f2cf","summary":"Signal reactions could bind to the wrong approval","description":"### Summary\n\nSignal reactions could bind to the wrong approval. In affected versions, an approval reaction could attach to ordinary outbound text instead of the structured approval request it was intended to resolve.\n\nThis advisory is scoped to Signal approval reactions when unrelated outbound messages and a pending approval were present in the same conversation. It does not change the authority of correctly identified approvers.\n\n### Impact\n\nA reaction to unrelated text could be interpreted as approving or denying a pending host action. Practical impact depends on the pending request, conversation timing, and actions available to the OpenClaw process.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, avoid reaction-based approvals in Signal, use another approval surface, and cancel pending requests when unrelated messages appear.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-r88x-r7jj-f2cf","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:58:39Z","published_at":"2026-09-11T00:58:39Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","score":7.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-346","name":"Origin Validation Error"},{"cwe_id":"CWE-451","name":"User Interface (UI) Misrepresentation of Critical Information"}],"cwe_ids":["CWE-346","CWE-451"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","score":7.1}},{"ghsa_id":"GHSA-2q7j-2vhx-56g8","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-2q7j-2vhx-56g8","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2q7j-2vhx-56g8","summary":"Feishu tools could ignore per-account disablement","description":"### Summary\n\nFeishu tools could ignore per-account disablement. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.9`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-2q7j-2vhx-56g8","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:36:15Z","published_at":"2026-06-30T00:36:15Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/feishu"},"vulnerable_version_range":"<= 2026.6.6","patched_versions":"2026.6.9","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1}},{"ghsa_id":"GHSA-w8wf-3qvj-6xqf","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-w8wf-3qvj-6xqf","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w8wf-3qvj-6xqf","summary":"Feishu permission tools could ignore per-account disablement","description":"### Summary\n\nFeishu permission tools could ignore per-account disablement. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.9`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-w8wf-3qvj-6xqf","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:36:22Z","published_at":"2026-06-30T00:36:22Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"@openclaw/feishu"},"vulnerable_version_range":"<= 2026.6.6","patched_versions":"2026.6.9","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1}},{"ghsa_id":"GHSA-m38g-vpwj-mpg9","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-m38g-vpwj-mpg9","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m38g-vpwj-mpg9","summary":"OpenShell mirror sync could follow remote symlink parents","description":"### Summary\n\nOpenShell mirror sync could follow remote symlink parents. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.9`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-m38g-vpwj-mpg9","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:36:38Z","published_at":"2026-06-30T00:36:38Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"<= 2026.6.6","patched_versions":"2026.6.9","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","score":8.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-59","name":"Improper Link Resolution Before File Access ('Link Following')"},{"cwe_id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"cwe_ids":["CWE-59","CWE-367"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","score":8.4}},{"ghsa_id":"GHSA-3fp5-v549-9v66","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-3fp5-v549-9v66","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3fp5-v549-9v66","summary":"flock wrapper could bypass durable exec approval binding","description":"### Summary\n\nflock wrapper could bypass durable exec approval binding. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.9`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-3fp5-v549-9v66","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:36:44Z","published_at":"2026-06-30T00:36:44Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"<= 2026.6.6","patched_versions":"2026.6.9","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-706","name":"Use of Incorrectly-Resolved Name or Reference"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-706","CWE-863"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-v7hx-r36p-f68m","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-v7hx-r36p-f68m","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hx-r36p-f68m","summary":"Message mutations could skip requester authorization","description":"### Summary\n\nMessage mutations could skip requester authorization. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.9`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-v7hx-r36p-f68m","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:36:52Z","published_at":"2026-06-30T00:36:52Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"= 2026.6.6","patched_versions":"2026.6.9","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","score":7.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","score":7.1}},{"ghsa_id":"GHSA-3pmr-x9g8-m55r","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-3pmr-x9g8-m55r","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3pmr-x9g8-m55r","summary":"Discord guild actions could skip cross-provider requester authorization","description":"### Summary\n\nDiscord guild actions could skip cross-provider requester authorization. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.9`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-3pmr-x9g8-m55r","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:36:57Z","published_at":"2026-06-30T00:36:57Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"= 2026.6.6","patched_versions":"2026.6.9","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1}},{"ghsa_id":"GHSA-wgq8-x5wm-g4rw","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-wgq8-x5wm-g4rw","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wgq8-x5wm-g4rw","summary":"Plugin install wrappers could skip install policy","description":"### Summary\n\nPlugin install wrappers could skip install policy. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.9`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-wgq8-x5wm-g4rw","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:37:07Z","published_at":"2026-06-30T00:37:07Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.6.5, < 2026.6.9","patched_versions":"2026.6.9","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","score":4.9},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","score":4.9}},{"ghsa_id":"GHSA-7vrr-rp4x-4g76","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-7vrr-rp4x-4g76","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7vrr-rp4x-4g76","summary":"Plugin install commands could allow non-owner persistence","description":"### Summary\n\nPlugin install commands could allow non-owner persistence. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.9`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-7vrr-rp4x-4g76","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:37:13Z","published_at":"2026-06-30T00:37:13Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.5.20, < 2026.6.9","patched_versions":"2026.6.9","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-269","name":"Improper Privilege Management"},{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-269","CWE-862"],"credits":[{"login":"rexpository","type":"reporter"}],"credits_detailed":[{"user":{"login":"rexpository","id":30176934,"node_id":"MDQ6VXNlcjMwMTc2OTM0","avatar_url":"https://avatars.githubusercontent.com/u/30176934?v=4","gravatar_id":"","url":"https://api.github.com/users/rexpository","html_url":"https://github.com/rexpository","followers_url":"https://api.github.com/users/rexpository/followers","following_url":"https://api.github.com/users/rexpository/following{/other_user}","gists_url":"https://api.github.com/users/rexpository/gists{/gist_id}","starred_url":"https://api.github.com/users/rexpository/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rexpository/subscriptions","organizations_url":"https://api.github.com/users/rexpository/orgs","repos_url":"https://api.github.com/users/rexpository/repos","events_url":"https://api.github.com/users/rexpository/events{/privacy}","received_events_url":"https://api.github.com/users/rexpository/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-52xj-c9p8-78cv","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-52xj-c9p8-78cv","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-52xj-c9p8-78cv","summary":"MCP loopback could expose owner-only tools to non-owner runs","description":"### Summary\n\nMCP loopback could expose owner-only tools to non-owner runs. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-52xj-c9p8-78cv","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:37:20Z","published_at":"2026-06-30T00:37:20Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.5.20, < 2026.6.6","patched_versions":"2026.6.6","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-269","name":"Improper Privilege Management"},{"cwe_id":"CWE-862","name":"Missing Authorization"}],"cwe_ids":["CWE-269","CWE-862"],"credits":[{"login":"YLChen-007","type":"reporter"}],"credits_detailed":[{"user":{"login":"YLChen-007","id":30854794,"node_id":"MDQ6VXNlcjMwODU0Nzk0","avatar_url":"https://avatars.githubusercontent.com/u/30854794?v=4","gravatar_id":"","url":"https://api.github.com/users/YLChen-007","html_url":"https://github.com/YLChen-007","followers_url":"https://api.github.com/users/YLChen-007/followers","following_url":"https://api.github.com/users/YLChen-007/following{/other_user}","gists_url":"https://api.github.com/users/YLChen-007/gists{/gist_id}","starred_url":"https://api.github.com/users/YLChen-007/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/YLChen-007/subscriptions","organizations_url":"https://api.github.com/users/YLChen-007/orgs","repos_url":"https://api.github.com/users/YLChen-007/repos","events_url":"https://api.github.com/users/YLChen-007/events{/privacy}","received_events_url":"https://api.github.com/users/YLChen-007/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3}},{"ghsa_id":"GHSA-fh38-965w-f6c3","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-fh38-965w-f6c3","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fh38-965w-f6c3","summary":"WhatsApp group IDs could satisfy elevated sender allowlists","description":"### Summary\n\nWhatsApp group IDs could satisfy elevated sender allowlists. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-fh38-965w-f6c3","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:38:06Z","published_at":"2026-06-30T00:38:06Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.3.22, < 2026.6.6","patched_versions":"2026.6.6","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-287","name":"Improper Authentication"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-287","CWE-863"],"credits":[{"login":"YLChen-007","type":"reporter"}],"credits_detailed":[{"user":{"login":"YLChen-007","id":30854794,"node_id":"MDQ6VXNlcjMwODU0Nzk0","avatar_url":"https://avatars.githubusercontent.com/u/30854794?v=4","gravatar_id":"","url":"https://api.github.com/users/YLChen-007","html_url":"https://github.com/YLChen-007","followers_url":"https://api.github.com/users/YLChen-007/followers","following_url":"https://api.github.com/users/YLChen-007/following{/other_user}","gists_url":"https://api.github.com/users/YLChen-007/gists{/gist_id}","starred_url":"https://api.github.com/users/YLChen-007/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/YLChen-007/subscriptions","organizations_url":"https://api.github.com/users/YLChen-007/orgs","repos_url":"https://api.github.com/users/YLChen-007/repos","events_url":"https://api.github.com/users/YLChen-007/events{/privacy}","received_events_url":"https://api.github.com/users/YLChen-007/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","score":8.3}},{"ghsa_id":"GHSA-3x84-qq85-fj65","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-3x84-qq85-fj65","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3x84-qq85-fj65","summary":"Browser CDP discovery could accept blocked WebSocket URLs","description":"### Summary\n\nBrowser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could reach network destinations that should have been blocked by OpenClaw policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-3x84-qq85-fj65","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:38:15Z","published_at":"2026-06-30T00:38:15Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.6.6","patched_versions":"2026.6.6","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":8.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-284","name":"Improper Access Control"},{"cwe_id":"CWE-918","name":"Server-Side Request Forgery (SSRF)"}],"cwe_ids":["CWE-284","CWE-918"],"credits":[{"login":"jason-allen-oneal","type":"reporter"}],"credits_detailed":[{"user":{"login":"jason-allen-oneal","id":8335428,"node_id":"MDQ6VXNlcjgzMzU0Mjg=","avatar_url":"https://avatars.githubusercontent.com/u/8335428?v=4","gravatar_id":"","url":"https://api.github.com/users/jason-allen-oneal","html_url":"https://github.com/jason-allen-oneal","followers_url":"https://api.github.com/users/jason-allen-oneal/followers","following_url":"https://api.github.com/users/jason-allen-oneal/following{/other_user}","gists_url":"https://api.github.com/users/jason-allen-oneal/gists{/gist_id}","starred_url":"https://api.github.com/users/jason-allen-oneal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jason-allen-oneal/subscriptions","organizations_url":"https://api.github.com/users/jason-allen-oneal/orgs","repos_url":"https://api.github.com/users/jason-allen-oneal/repos","events_url":"https://api.github.com/users/jason-allen-oneal/events{/privacy}","received_events_url":"https://api.github.com/users/jason-allen-oneal/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":3,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":8.5}},{"ghsa_id":"GHSA-v4f6-x5g5-2g4g","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-v4f6-x5g5-2g4g","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v4f6-x5g5-2g4g","summary":"Native web search could ignore OpenClaw tool policy","description":"### Summary\n\nNative web search could ignore OpenClaw tool policy. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-v4f6-x5g5-2g4g","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:38:21Z","published_at":"2026-06-30T00:38:21Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.5.28, < 2026.6.6","patched_versions":"2026.6.6","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-284","name":"Improper Access Control"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-284","CWE-863"],"credits":[],"credits_detailed":[],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3}},{"ghsa_id":"GHSA-hjr6-g723-hmfm","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-hjr6-g723-hmfm","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hjr6-g723-hmfm","summary":"Host exec environment filtering could miss interpreter startup variables","description":"### Summary\n\nHost exec environment filtering could miss interpreter startup variables. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-hjr6-g723-hmfm","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:38:25Z","published_at":"2026-06-30T00:38:25Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"<= 2026.6.1","patched_versions":"2026.6.6","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"},{"cwe_id":"CWE-184","name":"Incomplete List of Disallowed Inputs"}],"cwe_ids":["CWE-78","CWE-184"],"credits":[{"login":"nayakchinmohan","type":"reporter"}],"credits_detailed":[{"user":{"login":"nayakchinmohan","id":6557536,"node_id":"MDQ6VXNlcjY1NTc1MzY=","avatar_url":"https://avatars.githubusercontent.com/u/6557536?v=4","gravatar_id":"","url":"https://api.github.com/users/nayakchinmohan","html_url":"https://github.com/nayakchinmohan","followers_url":"https://api.github.com/users/nayakchinmohan/followers","following_url":"https://api.github.com/users/nayakchinmohan/following{/other_user}","gists_url":"https://api.github.com/users/nayakchinmohan/gists{/gist_id}","starred_url":"https://api.github.com/users/nayakchinmohan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nayakchinmohan/subscriptions","organizations_url":"https://api.github.com/users/nayakchinmohan/orgs","repos_url":"https://api.github.com/users/nayakchinmohan/repos","events_url":"https://api.github.com/users/nayakchinmohan/events{/privacy}","received_events_url":"https://api.github.com/users/nayakchinmohan/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-9969-8g9h-rxwm","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-9969-8g9h-rxwm","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9969-8g9h-rxwm","summary":"Host exec environment filtering could allow Git ext transport","description":"### Summary\n\nHost exec environment filtering could allow Git ext transport. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-9969-8g9h-rxwm","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:38:34Z","published_at":"2026-06-30T00:38:34Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"<= 2026.6.1","patched_versions":"2026.6.6","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"},{"cwe_id":"CWE-184","name":"Incomplete List of Disallowed Inputs"}],"cwe_ids":["CWE-78","CWE-184"],"credits":[{"login":"nayakchinmohan","type":"reporter"}],"credits_detailed":[{"user":{"login":"nayakchinmohan","id":6557536,"node_id":"MDQ6VXNlcjY1NTc1MzY=","avatar_url":"https://avatars.githubusercontent.com/u/6557536?v=4","gravatar_id":"","url":"https://api.github.com/users/nayakchinmohan","html_url":"https://github.com/nayakchinmohan","followers_url":"https://api.github.com/users/nayakchinmohan/followers","following_url":"https://api.github.com/users/nayakchinmohan/following{/other_user}","gists_url":"https://api.github.com/users/nayakchinmohan/gists{/gist_id}","starred_url":"https://api.github.com/users/nayakchinmohan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nayakchinmohan/subscriptions","organizations_url":"https://api.github.com/users/nayakchinmohan/orgs","repos_url":"https://api.github.com/users/nayakchinmohan/repos","events_url":"https://api.github.com/users/nayakchinmohan/events{/privacy}","received_events_url":"https://api.github.com/users/nayakchinmohan/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-mgvr-6gvw-3rgr","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-mgvr-6gvw-3rgr","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mgvr-6gvw-3rgr","summary":"Sandbox exec-server HTTP requests could reach internal networks","description":"### Summary\n\nSandbox exec-server HTTP requests could reach internal networks. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could reach network destinations that should have been blocked by OpenClaw policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-mgvr-6gvw-3rgr","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:38:40Z","published_at":"2026-06-30T00:38:40Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.6.6","patched_versions":"2026.6.6","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-918","name":"Server-Side Request Forgery (SSRF)"}],"cwe_ids":["CWE-918"],"credits":[{"login":"diedromeo","type":"reporter"}],"credits_detailed":[{"user":{"login":"diedromeo","id":119026435,"node_id":"U_kgDOBxgzAw","avatar_url":"https://avatars.githubusercontent.com/u/119026435?v=4","gravatar_id":"","url":"https://api.github.com/users/diedromeo","html_url":"https://github.com/diedromeo","followers_url":"https://api.github.com/users/diedromeo/followers","following_url":"https://api.github.com/users/diedromeo/following{/other_user}","gists_url":"https://api.github.com/users/diedromeo/gists{/gist_id}","starred_url":"https://api.github.com/users/diedromeo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diedromeo/subscriptions","organizations_url":"https://api.github.com/users/diedromeo/orgs","repos_url":"https://api.github.com/users/diedromeo/repos","events_url":"https://api.github.com/users/diedromeo/events{/privacy}","received_events_url":"https://api.github.com/users/diedromeo/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":4,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7}},{"ghsa_id":"GHSA-224w-vfr9-h35c","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-224w-vfr9-h35c","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-224w-vfr9-h35c","summary":"Google Meet node commands could skip exec approvals","description":"### Summary\n\nGoogle Meet node commands could skip exec approvals. In affected versions, `googlemeet.chrome` accepted caller-supplied audio command arrays and executed them on a paired node outside the normal `system.run` approval path.\n\nThis advisory is scoped to deployments with the Google Meet plugin enabled, a paired Chrome node, and the node command allowed. Pairing a node remains an operator-level trust decision; the failed boundary is the configured exec approval path for model-triggered commands.\n\n### Impact\n\nA tool-enabled agent able to invoke the allowed Google Meet node command could execute attacker-selected processes on the paired node. This could affect files, credentials, browser profiles, and availability on that node.\n\n### Patched Versions\n\nThe first stable patched version is `2026.7.1`.\n\n### Mitigations\n\nupgrade to `openclaw@2026.7.1` or later. Before upgrading, remove `googlemeet.chrome` from allowed node commands or disable the Google Meet plugin.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-224w-vfr9-h35c","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-09-11T00:56:59Z","published_at":"2026-09-11T00:56:59Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.5.1 < 2026.7.1","patched_versions":"2026.7.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"},{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-78","CWE-862","CWE-863"],"credits":[{"login":"wwwvwwvwwwwwvwwvw","type":"reporter"}],"credits_detailed":[{"user":{"login":"wwwvwwvwwwwwvwwvw","id":121104713,"node_id":"U_kgDOBzfpSQ","avatar_url":"https://avatars.githubusercontent.com/u/121104713?v=4","gravatar_id":"","url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw","html_url":"https://github.com/wwwvwwvwwwwwvwwvw","followers_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/followers","following_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/following{/other_user}","gists_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/gists{/gist_id}","starred_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/subscriptions","organizations_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/orgs","repos_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/repos","events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/events{/privacy}","received_events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-mm9g-83wh-mhwj","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-mm9g-83wh-mhwj","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mm9g-83wh-mhwj","summary":"Isolated cron jobs could regain denied exec tools","description":"### Summary\n\nIsolated cron jobs could regain denied exec tools. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.9`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-mm9g-83wh-mhwj","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:38:45Z","published_at":"2026-06-30T00:38:45Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.6.1, < 2026.6.9","patched_versions":"2026.6.9","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"wwwvwwvwwwwwvwwvw","type":"reporter"}],"credits_detailed":[{"user":{"login":"wwwvwwvwwwwwvwwvw","id":121104713,"node_id":"U_kgDOBzfpSQ","avatar_url":"https://avatars.githubusercontent.com/u/121104713?v=4","gravatar_id":"","url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw","html_url":"https://github.com/wwwvwwvwwwwwvwwvw","followers_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/followers","following_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/following{/other_user}","gists_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/gists{/gist_id}","starred_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/subscriptions","organizations_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/orgs","repos_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/repos","events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/events{/privacy}","received_events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-wxh3-g47h-q3mc","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-wxh3-g47h-q3mc","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wxh3-g47h-q3mc","summary":"Host exec environment filtering could miss rustup startup variables","description":"### Summary\n\nHost exec environment filtering could miss rustup startup variables. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-wxh3-g47h-q3mc","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:38:50Z","published_at":"2026-06-30T00:38:50Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"<= 2026.6.2","patched_versions":"2026.6.6","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')"},{"cwe_id":"CWE-184","name":"Incomplete List of Disallowed Inputs"},{"cwe_id":"CWE-426","name":"Untrusted Search Path"}],"cwe_ids":["CWE-94","CWE-184","CWE-426"],"credits":[{"login":"SEORY0","type":"reporter"}],"credits_detailed":[{"user":{"login":"SEORY0","id":93699099,"node_id":"U_kgDOBZW8Gw","avatar_url":"https://avatars.githubusercontent.com/u/93699099?v=4","gravatar_id":"","url":"https://api.github.com/users/SEORY0","html_url":"https://github.com/SEORY0","followers_url":"https://api.github.com/users/SEORY0/followers","following_url":"https://api.github.com/users/SEORY0/following{/other_user}","gists_url":"https://api.github.com/users/SEORY0/gists{/gist_id}","starred_url":"https://api.github.com/users/SEORY0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SEORY0/subscriptions","organizations_url":"https://api.github.com/users/SEORY0/orgs","repos_url":"https://api.github.com/users/SEORY0/repos","events_url":"https://api.github.com/users/SEORY0/events{/privacy}","received_events_url":"https://api.github.com/users/SEORY0/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-575v-8hfq-m3mc","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-575v-8hfq-m3mc","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-575v-8hfq-m3mc","summary":"Sandbox bind mounts could bypass parent-directory denylist checks","description":"### Summary\n\nSandbox bind mounts could bypass parent-directory denylist checks. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-575v-8hfq-m3mc","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:38:59Z","published_at":"2026-06-30T00:38:59Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.6.6","patched_versions":"2026.6.6","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":8.4},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"},{"cwe_id":"CWE-59","name":"Improper Link Resolution Before File Access ('Link Following')"}],"cwe_ids":["CWE-22","CWE-59"],"credits":[{"login":"nayakchinmohan","type":"reporter"}],"credits_detailed":[{"user":{"login":"nayakchinmohan","id":6557536,"node_id":"MDQ6VXNlcjY1NTc1MzY=","avatar_url":"https://avatars.githubusercontent.com/u/6557536?v=4","gravatar_id":"","url":"https://api.github.com/users/nayakchinmohan","html_url":"https://github.com/nayakchinmohan","followers_url":"https://api.github.com/users/nayakchinmohan/followers","following_url":"https://api.github.com/users/nayakchinmohan/following{/other_user}","gists_url":"https://api.github.com/users/nayakchinmohan/gists{/gist_id}","starred_url":"https://api.github.com/users/nayakchinmohan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nayakchinmohan/subscriptions","organizations_url":"https://api.github.com/users/nayakchinmohan/orgs","repos_url":"https://api.github.com/users/nayakchinmohan/repos","events_url":"https://api.github.com/users/nayakchinmohan/events{/privacy}","received_events_url":"https://api.github.com/users/nayakchinmohan/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":8.4}},{"ghsa_id":"GHSA-p5xh-frrh-cmgj","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-p5xh-frrh-cmgj","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p5xh-frrh-cmgj","summary":"MS Teams message actions could miss requester authorization","description":"### Summary\n\nMS Teams message actions could miss requester authorization. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-p5xh-frrh-cmgj","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:39:06Z","published_at":"2026-06-30T00:39:06Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.4.12-beta.1, < 2026.6.6","patched_versions":"2026.6.6","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","score":7.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"wwwvwwvwwwwwvwwvw","type":"reporter"}],"credits_detailed":[{"user":{"login":"wwwvwwvwwwwwvwwvw","id":121104713,"node_id":"U_kgDOBzfpSQ","avatar_url":"https://avatars.githubusercontent.com/u/121104713?v=4","gravatar_id":"","url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw","html_url":"https://github.com/wwwvwwvwwwwwvwwvw","followers_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/followers","following_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/following{/other_user}","gists_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/gists{/gist_id}","starred_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/subscriptions","organizations_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/orgs","repos_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/repos","events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/events{/privacy}","received_events_url":"https://api.github.com/users/wwwvwwvwwwwwvwwvw/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","score":7.1}},{"ghsa_id":"GHSA-f6p7-6326-vf7v","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-f6p7-6326-vf7v","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f6p7-6326-vf7v","summary":"Discord moderation actions could miss trusted requester checks","description":"### Summary\n\nDiscord moderation actions could miss trusted requester checks. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.9`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-f6p7-6326-vf7v","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:39:36Z","published_at":"2026-06-30T00:39:36Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.6.9","patched_versions":"2026.6.9","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","score":7.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"Hcamael","type":"reporter"}],"credits_detailed":[{"user":{"login":"Hcamael","id":10161996,"node_id":"MDQ6VXNlcjEwMTYxOTk2","avatar_url":"https://avatars.githubusercontent.com/u/10161996?v=4","gravatar_id":"","url":"https://api.github.com/users/Hcamael","html_url":"https://github.com/Hcamael","followers_url":"https://api.github.com/users/Hcamael/followers","following_url":"https://api.github.com/users/Hcamael/following{/other_user}","gists_url":"https://api.github.com/users/Hcamael/gists{/gist_id}","starred_url":"https://api.github.com/users/Hcamael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Hcamael/subscriptions","organizations_url":"https://api.github.com/users/Hcamael/orgs","repos_url":"https://api.github.com/users/Hcamael/repos","events_url":"https://api.github.com/users/Hcamael/events{/privacy}","received_events_url":"https://api.github.com/users/Hcamael/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","score":7.1}},{"ghsa_id":"GHSA-cf2p-f286-mphf","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-cf2p-f286-mphf","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cf2p-f286-mphf","summary":"Identity-bearing HTTP callers could reach admin-scoped tools","description":"### Summary\n\nIdentity-bearing HTTP callers could reach admin-scoped tools. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.5`.\n\n### Mitigations\n\nUpgrade to OpenClaw `2026.6.5` or later. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-cf2p-f286-mphf","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T01:10:36Z","published_at":"2026-06-30T01:10:36Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.6.5","patched_versions":"2026.6.5","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-862","name":"Missing Authorization"},{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-862","CWE-863"],"credits":[{"login":"sour-exploit","type":"reporter"}],"credits_detailed":[{"user":{"login":"sour-exploit","id":288231323,"node_id":"U_kgDOES4Pmw","avatar_url":"https://avatars.githubusercontent.com/u/288231323?v=4","gravatar_id":"","url":"https://api.github.com/users/sour-exploit","html_url":"https://github.com/sour-exploit","followers_url":"https://api.github.com/users/sour-exploit/followers","following_url":"https://api.github.com/users/sour-exploit/following{/other_user}","gists_url":"https://api.github.com/users/sour-exploit/gists{/gist_id}","starred_url":"https://api.github.com/users/sour-exploit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sour-exploit/subscriptions","organizations_url":"https://api.github.com/users/sour-exploit/orgs","repos_url":"https://api.github.com/users/sour-exploit/repos","events_url":"https://api.github.com/users/sour-exploit/events{/privacy}","received_events_url":"https://api.github.com/users/sour-exploit/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}},{"ghsa_id":"GHSA-9c3v-684m-579c","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-9c3v-684m-579c","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9c3v-684m-579c","summary":"MCP SSE redirects could forward Authorization headers","description":"### Summary\n\nMCP SSE redirects could forward Authorization headers. In affected versions, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could execute or persist actions beyond the caller's intended authorization. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.5`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-9c3v-684m-579c","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:39:42Z","published_at":"2026-06-30T00:39:42Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.6.5","patched_versions":"2026.6.5","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"cwe_id":"CWE-522","name":"Insufficiently Protected Credentials"},{"cwe_id":"CWE-601","name":"URL Redirection to Untrusted Site ('Open Redirect')"}],"cwe_ids":["CWE-200","CWE-522","CWE-601"],"credits":[{"login":"dingliweixlm-byte","type":"reporter"}],"credits_detailed":[{"user":{"login":"dingliweixlm-byte","id":269614575,"node_id":"U_kgDOEBH97w","avatar_url":"https://avatars.githubusercontent.com/u/269614575?v=4","gravatar_id":"","url":"https://api.github.com/users/dingliweixlm-byte","html_url":"https://github.com/dingliweixlm-byte","followers_url":"https://api.github.com/users/dingliweixlm-byte/followers","following_url":"https://api.github.com/users/dingliweixlm-byte/following{/other_user}","gists_url":"https://api.github.com/users/dingliweixlm-byte/gists{/gist_id}","starred_url":"https://api.github.com/users/dingliweixlm-byte/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dingliweixlm-byte/subscriptions","organizations_url":"https://api.github.com/users/dingliweixlm-byte/orgs","repos_url":"https://api.github.com/users/dingliweixlm-byte/repos","events_url":"https://api.github.com/users/dingliweixlm-byte/events{/privacy}","received_events_url":"https://api.github.com/users/dingliweixlm-byte/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}},{"ghsa_id":"GHSA-wp73-f3gg-w4vr","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-wp73-f3gg-w4vr","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wp73-f3gg-w4vr","summary":"ClickClack agent-mode dispatch could ignore toolsAllow","description":"### Summary\n\nClickClack agent-mode dispatch could ignore toolsAllow. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.5`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"high","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-wp73-f3gg-w4vr","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T00:39:50Z","published_at":"2026-06-30T00:39:50Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":">= 2026.5.10-beta.1, < 2026.6.5","patched_versions":"2026.6.5","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-863","name":"Incorrect Authorization"}],"cwe_ids":["CWE-863"],"credits":[{"login":"whyiug","type":"reporter"}],"credits_detailed":[{"user":{"login":"whyiug","id":6668626,"node_id":"MDQ6VXNlcjY2Njg2MjY=","avatar_url":"https://avatars.githubusercontent.com/u/6668626?v=4","gravatar_id":"","url":"https://api.github.com/users/whyiug","html_url":"https://github.com/whyiug","followers_url":"https://api.github.com/users/whyiug/followers","following_url":"https://api.github.com/users/whyiug/following{/other_user}","gists_url":"https://api.github.com/users/whyiug/gists{/gist_id}","starred_url":"https://api.github.com/users/whyiug/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whyiug/subscriptions","organizations_url":"https://api.github.com/users/whyiug/orgs","repos_url":"https://api.github.com/users/whyiug/repos","events_url":"https://api.github.com/users/whyiug/events{/privacy}","received_events_url":"https://api.github.com/users/whyiug/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":2,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1}},{"ghsa_id":"GHSA-4xwj-mcc7-x7x5","cve_id":null,"url":"https://api.github.com/repos/openclaw/openclaw/security-advisories/GHSA-4xwj-mcc7-x7x5","html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4xwj-mcc7-x7x5","summary":"Remote media URLs could slow-read exhaust tool workers","description":"### Summary\n\nRemote media URLs could slow-read exhaust tool workers. In affected versions, a lower-trust caller or configured input path could consume gateway resources and reduce availability.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could consume gateway resources and reduce availability. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.1`.\n\n### Mitigations\n\nUpgrade to OpenClaw `2026.6.1` or later. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","severity":"medium","author":null,"publisher":{"login":"joshavant","id":830519,"node_id":"MDQ6VXNlcjgzMDUxOQ==","avatar_url":"https://avatars.githubusercontent.com/u/830519?v=4","gravatar_id":"","url":"https://api.github.com/users/joshavant","html_url":"https://github.com/joshavant","followers_url":"https://api.github.com/users/joshavant/followers","following_url":"https://api.github.com/users/joshavant/following{/other_user}","gists_url":"https://api.github.com/users/joshavant/gists{/gist_id}","starred_url":"https://api.github.com/users/joshavant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshavant/subscriptions","organizations_url":"https://api.github.com/users/joshavant/orgs","repos_url":"https://api.github.com/users/joshavant/repos","events_url":"https://api.github.com/users/joshavant/events{/privacy}","received_events_url":"https://api.github.com/users/joshavant/received_events","type":"User","user_view_type":"public","site_admin":false},"identifiers":[{"value":"GHSA-4xwj-mcc7-x7x5","type":"GHSA"}],"state":"published","created_at":null,"updated_at":"2026-06-30T01:10:40Z","published_at":"2026-06-30T01:10:40Z","closed_at":null,"withdrawn_at":null,"submission":null,"vulnerabilities":[{"package":{"ecosystem":"npm","name":"openclaw"},"vulnerable_version_range":"< 2026.6.1","patched_versions":"2026.6.1","vulnerable_functions":[]}],"cvss_severities":{"cvss_v3":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cvss_v4":{"vector_string":null,"score":null}},"cwes":[{"cwe_id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"cwe_ids":["CWE-400"],"credits":[{"login":"ttzero25","type":"reporter"}],"credits_detailed":[{"user":{"login":"ttzero25","id":145201104,"node_id":"U_kgDOCKeX0A","avatar_url":"https://avatars.githubusercontent.com/u/145201104?v=4","gravatar_id":"","url":"https://api.github.com/users/ttzero25","html_url":"https://github.com/ttzero25","followers_url":"https://api.github.com/users/ttzero25/followers","following_url":"https://api.github.com/users/ttzero25/following{/other_user}","gists_url":"https://api.github.com/users/ttzero25/gists{/gist_id}","starred_url":"https://api.github.com/users/ttzero25/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ttzero25/subscriptions","organizations_url":"https://api.github.com/users/ttzero25/orgs","repos_url":"https://api.github.com/users/ttzero25/repos","events_url":"https://api.github.com/users/ttzero25/events{/privacy}","received_events_url":"https://api.github.com/users/ttzero25/received_events","type":"User","user_view_type":"public","site_admin":false},"type":"reporter","state":"accepted"}],"collaborating_users":null,"collaborating_teams":null,"private_fork":null,"comments":1,"cvss":{"vector_string":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5}}]