Skip to content

Commit 36e86ad

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-mf5g-6r6f-ghhm GHSA-59xc-5v89-r7pr GHSA-pg8g-f2hf-x82m GHSA-qx8j-g322-qj6m GHSA-59xc-5v89-r7pr GHSA-pg8g-f2hf-x82m
1 parent 3040454 commit 36e86ad

6 files changed

Lines changed: 167 additions & 105 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-mf5g-6r6f-ghhm/GHSA-mf5g-6r6f-ghhm.json‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mf5g-6r6f-ghhm",
4-
"modified": "2026-03-29T15:50:09Z",
4+
"modified": "2026-04-10T20:25:07Z",
55
"published": "2026-03-29T15:50:09Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35646"
8+
],
79
"summary": "OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token",
810
"details": "## Summary\n\nSynology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Weak Webhook Token\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `<= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nSynology Chat webhook auth previously rejected invalid tokens without throttling repeated guesses, allowing brute-force attempts against weak webhook secrets. Commit `0b4d07337467f4d40a0cc1ced83d45ceaec0863c` adds repeated-guess throttling before auth failure responses.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `0b4d07337467f4d40a0cc1ced83d45ceaec0863c`.\n\n## Fix Commit(s)\n\n- `0b4d07337467f4d40a0cc1ced83d45ceaec0863c`",
9-
"severity": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
15+
}
16+
],
1017
"affected": [
1118
{
1219
"package": {
@@ -25,24 +32,29 @@
2532
}
2633
]
2734
}
28-
],
29-
"database_specific": {
30-
"last_known_affected_version_range": "<= 2026.3.24"
31-
}
35+
]
3236
}
3337
],
3438
"references": [
3539
{
3640
"type": "WEB",
3741
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-mf5g-6r6f-ghhm"
3842
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35646"
46+
},
3947
{
4048
"type": "WEB",
4149
"url": "https://github.com/openclaw/openclaw/commit/0b4d07337467f4d40a0cc1ced83d45ceaec0863c"
4250
},
4351
{
4452
"type": "PACKAGE",
4553
"url": "https://github.com/openclaw/openclaw"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://www.vulncheck.com/advisories/openclaw-pre-authentication-rate-limit-bypass-in-webhook-token-validation"
4658
}
4759
],
4860
"database_specific": {

‎advisories/github-reviewed/2026/04/GHSA-59xc-5v89-r7pr/GHSA-59xc-5v89-r7pr.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-59xc-5v89-r7pr",
4+
"modified": "2026-04-10T20:25:02Z",
5+
"published": "2026-04-10T00:30:30Z",
6+
"withdrawn": "2026-04-10T20:25:02Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-mf5g-6r6f-ghhm. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts, enabling attackers to guess weak tokens through rapid successive requests.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.28"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-mf5g-6r6f-ghhm"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35646"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/0b4d07337467f4d40a0cc1ced83d45ceaec0863c"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-pre-authentication-rate-limit-bypass-in-webhook-token-validation"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-307"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-04-10T20:25:02Z",
66+
"nvd_published_at": "2026-04-09T22:16:34Z"
67+
}
68+
}

‎advisories/github-reviewed/2026/04/GHSA-pg8g-f2hf-x82m/GHSA-pg8g-f2hf-x82m.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pg8g-f2hf-x82m",
4+
"modified": "2026-04-10T20:24:54Z",
5+
"published": "2026-04-09T00:31:59Z",
6+
"withdrawn": "2026-04-10T20:24:54Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-qx8j-g322-qj6m. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects. Attackers can exploit this by triggering redirects to exfiltrate sensitive request data or headers to unintended origins.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.4.8"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-qx8j-g322-qj6m"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40037"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-unsafe-request-body-replay-via-fetchwithssrfguard-cross-origin-redirects"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-601"
62+
],
63+
"severity": "HIGH",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-04-10T20:24:54Z",
66+
"nvd_published_at": "2026-04-08T22:16:24Z"
67+
}
68+
}

‎advisories/github-reviewed/2026/04/GHSA-qx8j-g322-qj6m/GHSA-qx8j-g322-qj6m.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qx8j-g322-qj6m",
4-
"modified": "2026-04-09T17:37:08Z",
4+
"modified": "2026-04-10T20:24:59Z",
55
"published": "2026-04-09T17:37:08Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-40037"
8+
],
79
"summary": "OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects",
810
"details": "## Impact\n\n`fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects.\n\nA guarded fetch could resend unsafe request bodies or headers when following cross-origin redirects.\n\nOpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<2026.3.31`\n- Patched versions: `2026.4.8`\n\n## Fix\n\nThe issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.\n\n## Verification\n\nThe fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.\n\n## Credits\n\nThanks @BG0ECV for reporting.",
911
"severity": [
@@ -38,13 +40,21 @@
3840
"type": "WEB",
3941
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-qx8j-g322-qj6m"
4042
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40037"
46+
},
4147
{
4248
"type": "WEB",
4349
"url": "https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"
4450
},
4551
{
4652
"type": "PACKAGE",
4753
"url": "https://github.com/openclaw/openclaw"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://www.vulncheck.com/advisories/openclaw-unsafe-request-body-replay-via-fetchwithssrfguard-cross-origin-redirects"
4858
}
4959
],
5060
"database_specific": {

‎advisories/unreviewed/2026/04/GHSA-59xc-5v89-r7pr/GHSA-59xc-5v89-r7pr.json‎

Lines changed: 0 additions & 48 deletions
This file was deleted.

‎advisories/unreviewed/2026/04/GHSA-pg8g-f2hf-x82m/GHSA-pg8g-f2hf-x82m.json‎

Lines changed: 0 additions & 48 deletions
This file was deleted.

0 commit comments

Comments
 (0)