Skip to content

Commit 03cfe94

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5jvj-hxmh-6h6j GHSA-74wf-h43j-vvmj GHSA-844j-xrrq-wgh4 GHSA-9hjh-fr4f-gxc4 GHSA-cfp9-w5v9-3q4h GHSA-j4c9-w69r-cw33 GHSA-rf6h-5gpw-qrgq GHSA-rvqr-hrcc-j9vv GHSA-wq58-2pvg-5h4f GHSA-x2cm-hg9c-mf5w GHSA-xp9r-prpg-373r GHSA-2crg-3p73-43xp
1 parent d21dd65 commit 03cfe94

12 files changed

Lines changed: 117 additions & 24 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-5jvj-hxmh-6h6j/GHSA-5jvj-hxmh-6h6j.json‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5jvj-hxmh-6h6j",
4-
"modified": "2026-03-29T15:46:40Z",
4+
"modified": "2026-04-10T17:26:09Z",
55
"published": "2026-03-29T15:46:40Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35657"
8+
],
79
"summary": "OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope",
810
"details": "## Summary\n\nGateway HTTP Session History Route Bypasses Operator Read Scope\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `<= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nThe HTTP `/sessions/:sessionKey/history` route previously authenticated bearer tokens but skipped the same `operator.read` check used by `chat.history` over WebSocket. Commit `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea` makes HTTP callers declare operator scopes and rejects history reads that do not include `operator.read`.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea`.\n\n## Fix Commit(s)\n\n- `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea`",
911
"severity": [
@@ -26,11 +28,14 @@
2628
"introduced": "0"
2729
},
2830
{
29-
"last_affected": "2026.3.24"
31+
"fixed": "2026.3.25"
3032
}
3133
]
3234
}
33-
]
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2026.3.24"
38+
}
3439
}
3540
],
3641
"references": [

‎advisories/github-reviewed/2026/03/GHSA-74wf-h43j-vvmj/GHSA-74wf-h43j-vvmj.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-74wf-h43j-vvmj",
4-
"modified": "2026-03-26T21:46:42Z",
4+
"modified": "2026-04-10T17:25:27Z",
55
"published": "2026-03-26T21:46:42Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35655"
8+
],
79
"summary": "OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting",
810
"details": "## Summary\nACP permission resolution trusted conflicting tool identity hints from rawInput and metadata, which could suppress dangerous-tool prompting.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: < 2026.3.22\n- Fixed: >= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `e4c61723cd2d530680cc61789311d464ab8cdf60`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/acp/client.ts now fails closed when meta, rawInput, and title tool identities conflict instead of trusting spoofable raw input.\n- src/acp/client.test.ts ships regressions for conflicting tool identity hints and dangerous-tool prompting.\n\nOpenClaw thanks @zpbrent for reporting.",
911
"severity": [

‎advisories/github-reviewed/2026/03/GHSA-844j-xrrq-wgh4/GHSA-844j-xrrq-wgh4.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-844j-xrrq-wgh4",
4-
"modified": "2026-03-26T21:42:30Z",
4+
"modified": "2026-04-10T17:25:44Z",
55
"published": "2026-03-26T21:42:30Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35656"
8+
],
79
"summary": "OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection",
810
"details": "## Summary\nWhen gateway.trustedProxies was configured, spoofed loopback hops in forwarding headers could be accepted as the client origin and weaken downstream auth and rate-limit decisions.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: < 2026.3.22\n- Fixed: >= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `fc2d29ea926f47c428c556e92ec981441228d2a4`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/gateway/net.ts now ignores loopback forwarded hops before trusted-proxy client resolution.\n- That shipped origin fix is the one consumed by canvas auth and gateway auth-rate-limit paths that rely on resolved client identity.\n\nOpenClaw thanks @lintsinghua for reporting.",
911
"severity": [

‎advisories/github-reviewed/2026/03/GHSA-9hjh-fr4f-gxc4/GHSA-9hjh-fr4f-gxc4.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9hjh-fr4f-gxc4",
4-
"modified": "2026-03-27T22:29:12Z",
4+
"modified": "2026-04-10T17:28:06Z",
55
"published": "2026-03-27T22:29:12Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35663"
8+
],
79
"summary": "OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin",
810
"details": "## Summary\n\nGateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `<= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nBackend-labeled reconnects could previously self-request broader scopes and bypass pairing, allowing non-admin operators to reconnect as `operator.admin`. Commit `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48` removes the backend self-pairing skip and requires pairing when requested scopes exceed the approved baseline.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48`.\n\n## Fix Commit(s)\n\n- `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48`",
911
"severity": [

‎advisories/github-reviewed/2026/03/GHSA-cfp9-w5v9-3q4h/GHSA-cfp9-w5v9-3q4h.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cfp9-w5v9-3q4h",
4-
"modified": "2026-03-26T21:48:06Z",
4+
"modified": "2026-04-10T17:26:28Z",
55
"published": "2026-03-26T21:48:06Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35658"
8+
],
79
"summary": "OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts",
810
"details": "## Summary\nThe `image` tool did not fully honor the `tools.fs.workspaceOnly` filesystem boundary. In affected releases, image-path resolution could still traverse sandbox bridge mounts outside the workspace and read files from mounted directories that the other file tools would reject.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `< 2026.3.2`\n- Fixed: `>= 2026.3.2`\n- Latest released tags checked: `v2026.3.23` (`ccfeecb6887cd97937e33a71877ad512741e82b2`) and `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `dd9d9c1c609dcb4579f9e57bd7b5c879d0146b53`\n- `14baadda2c456f3cf749f1f97e8678746a34a7f4`\n\n## Release Status\nThe complete fix shipped in `v2026.3.2` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- `src/agents/openclaw-tools.ts` now passes `fsPolicy` into `createImageTool`, so the image tool receives the same workspace-only policy input as the other filesystem tools.\n- `src/agents/tools/image-tool.ts`, `src/agents/tools/media-tool-shared.ts`, and `src/agents/sandbox-media-paths.ts` now restrict local roots and sandbox-bridge resolution to the workspace when `tools.fs.workspaceOnly` is enabled.\n\nOpenClaw thanks @YLChen-007 for reporting.",
911
"severity": [

‎advisories/github-reviewed/2026/03/GHSA-j4c9-w69r-cw33/GHSA-j4c9-w69r-cw33.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j4c9-w69r-cw33",
4-
"modified": "2026-03-29T15:50:23Z",
4+
"modified": "2026-04-10T17:27:24Z",
55
"published": "2026-03-29T15:50:23Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35661"
8+
],
79
"summary": "OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State",
810
"details": "## Summary\n\nTelegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `<= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nTelegram callback queries from direct messages previously used weaker callback-only authorization and could mutate session state without satisfying normal DM pairing. Commit `269282ac69ab6030d5f30d04822668f607f13065` enforces DM authorization for callbacks.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `269282ac69ab6030d5f30d04822668f607f13065`.\n\n## Fix Commit(s)\n\n- `269282ac69ab6030d5f30d04822668f607f13065`",
911
"severity": [],

‎advisories/github-reviewed/2026/03/GHSA-rf6h-5gpw-qrgq/GHSA-rf6h-5gpw-qrgq.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rf6h-5gpw-qrgq",
4-
"modified": "2026-03-29T15:49:50Z",
4+
"modified": "2026-04-10T17:25:07Z",
55
"published": "2026-03-29T15:49:50Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35654"
8+
],
79
"summary": "OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback",
810
"details": "## Summary\n\nMS Teams Feedback Invoke Bypasses Sender Allowlists and Records Unauthorized Session Feedback\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `<= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nMicrosoft Teams feedback invokes previously bypassed sender authorization and could record feedback or trigger reflection for unauthorized senders. Commit `c5415a474bb085404c20f8b312e436997977b1ea` applies the same DM and group authorization checks to feedback invokes.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `c5415a474bb085404c20f8b312e436997977b1ea`.\n\n## Fix Commit(s)\n\n- `c5415a474bb085404c20f8b312e436997977b1ea`",
911
"severity": [],

‎advisories/github-reviewed/2026/03/GHSA-rvqr-hrcc-j9vv/GHSA-rvqr-hrcc-j9vv.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rvqr-hrcc-j9vv",
4-
"modified": "2026-03-26T19:50:24Z",
4+
"modified": "2026-04-10T17:26:46Z",
55
"published": "2026-03-26T19:50:24Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35659"
8+
],
79
"summary": "OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution",
810
"details": "## Summary\nBonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: < 2026.3.22\n- Fixed: >= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `deecf68b59a9b7eea978e40fd3c2fe543087b569`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/infra/bonjour-discovery.ts now resolves and returns only concrete endpoints instead of falling back to unresolved TXT host and port hints.\n- src/cli/gateway-cli/discover.ts consumes only the fail-closed resolved endpoint path.\n\nOpenClaw thanks @nexrin for reporting.",
911
"severity": [

‎advisories/github-reviewed/2026/03/GHSA-wq58-2pvg-5h4f/GHSA-wq58-2pvg-5h4f.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wq58-2pvg-5h4f",
4-
"modified": "2026-04-09T13:43:30Z",
4+
"modified": "2026-04-10T17:27:04Z",
55
"published": "2026-03-26T19:00:45Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35660"
8+
],
79
"summary": "OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers",
810
"details": "## Summary\nBefore `v2026.3.23`, the Gateway `agent` RPC accepted `/reset` and `/new` for callers with only `operator.write`, even though the direct `sessions.reset` RPC correctly requires `operator.admin`.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `< 2026.3.23`\n- Fixed: `>= 2026.3.23`\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Root Cause\nThe vulnerable path lived in `src/gateway/server-methods/agent.ts`. A `/reset` or `/new` message with an explicit `sessionKey` reached `performGatewaySessionReset(...)` without enforcing the same `operator.admin` guard used by `sessions.reset`.\n\n## Fix Commit(s)\n- `50f6a2f136fed85b58548a38f7a3dbb98d2cd1a0` — `fix(gateway): require admin for agent session reset`\n\n## Release Status\nThe fix commit is contained in released tags `v2026.3.23` and `v2026.3.23-2`. The latest shipped tag and npm release both include the fix.\n\n## Code-Level Confirmation\n- `src/gateway/server-methods/agent.ts` now rejects `/reset` and `/new` for callers that do not have `operator.admin` before calling `performGatewaySessionReset(...)`.\n- `src/gateway/server-methods/agent.test.ts` contains the regression test `rejects /reset for write-scoped gateway callers`.\n\nThanks @smaeljaish771 for reporting.",
911
"severity": [

‎advisories/github-reviewed/2026/03/GHSA-x2cm-hg9c-mf5w/GHSA-x2cm-hg9c-mf5w.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-x2cm-hg9c-mf5w",
4-
"modified": "2026-03-26T21:44:41Z",
4+
"modified": "2026-04-10T17:27:44Z",
55
"published": "2026-03-26T21:44:41Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35662"
8+
],
79
"summary": "OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions",
810
"details": "## Summary\nLeaf subagents could still use the send action to message controlled child sessions even when their controlScope was narrower than children.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: < 2026.3.22\n- Fixed: >= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `7679eb375294941b02214c234aff3948796969d0`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/auto-reply/reply/commands-subagents/action-send.ts now threads controller context through the send path.\n- src/agents/subagent-control.ts now blocks send attempts unless the requester owns the target and has controlScope=\"children\".\n\nOpenClaw thanks @space08 for reporting.",
911
"severity": [

0 commit comments

Comments
 (0)