Skip to content

Commit 384f809

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4jpw-hj22-2xmc GHSA-4w7m-58cg-cmff GHSA-8jhh-jcqg-mj5p GHSA-jf6w-m8jw-jfxc GHSA-mj4p-rc52-m843 GHSA-qc36-x95h-7j53 GHSA-qvr7-g57c-mrc7 GHSA-rw39-5899-8mxp GHSA-xf99-j42q-5w5p GHSA-xvx8-77m6-gwg6 GHSA-xw77-45gv-p728
1 parent d8138ab commit 384f809

11 files changed

Lines changed: 653 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-4jpw-hj22-2xmc/GHSA-4jpw-hj22-2xmc.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4jpw-hj22-2xmc",
4+
"modified": "2026-03-13T15:47:29Z",
5+
"published": "2026-03-13T15:47:29Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE",
8+
"details": "## Summary\nIn affected versions of `openclaw`, a caller holding only `operator.pairing` could use `device.token.rotate` to mint a new token with broader scopes for an already paired device. If the target device was approved for `operator.admin`, the attacker could obtain an administrative token without already holding administrative scope.\n\n## Impact\nThis is a critical authorization flaw. On deployments with connected node hosts or companion apps that expose `system.run`, the escalated token could then modify node execution approvals and reach real remote code execution on the node. Even without nodes, the flaw still granted unauthorized gateway-admin access.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.3.8`\n- Fixed in: `2026.3.11`\n\n## Technical Details\n`device.token.rotate` accepted caller-supplied target scopes and validated them against the target device's approved scopes, but it did not constrain the newly minted scopes to the caller's own current scope set. That allowed a pairing-scoped caller to mint a broader token for an already paired administrative device.\n\n## Fix\nOpenClaw now enforces caller-scope subsetting in `device.token.rotate`, preventing callers from minting device tokens broader than the scopes they already hold. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.3.11"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-4jpw-hj22-2xmc"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/openclaw/openclaw"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-269"
53+
],
54+
"severity": "CRITICAL",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-13T15:47:29Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/03/GHSA-4w7m-58cg-cmff/GHSA-4w7m-58cg-cmff.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4w7m-58cg-cmff",
4+
"modified": "2026-03-13T15:47:35Z",
5+
"published": "2026-03-13T15:47:34Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries",
8+
"details": "## Summary\nIn affected versions of `openclaw`, sandboxed leaf subagents could still access the `subagents` control surface and resolve against the parent requester scope instead of remaining confined to their own session tree.\n\n## Impact\nA low-privilege sandboxed leaf worker could steer or kill a sibling run owned by the same requester and cause that sibling to execute with its own broader tool policy. This is a sandbox and session-scope boundary bypass.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.3.8`\n- Fixed in: `2026.3.11`\n\n## Technical Details\nLeaf subagents retained the `subagents` tool, and subagent control requests were authorized against the parent requester scope rather than the caller's own spawned descendants. The control path prevented only self-targeting, not cross-sibling steering.\n\n## Fix\nOpenClaw now removes `subagents` control access from leaf subagents by default, scopes subagent control to the caller's own descendants, and rejects `steer` and `kill` requests that target runs outside that descendant tree. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.3.11"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-4w7m-58cg-cmff"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/openclaw/openclaw"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-269"
53+
],
54+
"severity": "HIGH",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-13T15:47:34Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/03/GHSA-8jhh-jcqg-mj5p/GHSA-8jhh-jcqg-mj5p.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8jhh-jcqg-mj5p",
4+
"modified": "2026-03-13T15:48:00Z",
5+
"published": "2026-03-13T15:47:59Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions",
8+
"details": "## Summary\nIn affected versions of `openclaw`, channel-initiated config mutations were authorized against the originating account's `configWrites` policy but did not consistently re-check the targeted account scope. An authorized sender on one account could mutate protected sibling-account configuration when the target account had `configWrites: false`.\n\n## Impact\nThis is an account-scoped policy bypass inside a single gateway deployment. Channel commands such as `/config set channels.<provider>.accounts.<id>...` and config-backed `/allowlist ... --config --account <id>` could modify protected sibling-account configuration.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.3.8`\n- Fixed in: `2026.3.11`\n\n## Technical Details\nThe mutation path validated the origin account scope but did not consistently authorize every resolved target scope. Ambiguous collection and root writes under `channels` and `channels.<provider>.accounts` could therefore reach protected account configuration from channel command surfaces.\n\n## Fix\nOpenClaw now authorizes config mutations against both the origin scope and each resolved target scope, and it rejects ambiguous root and collection writes from channel commands unless the caller is an internal gateway client with `operator.admin`. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.3.11"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-8jhh-jcqg-mj5p"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/openclaw/openclaw"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-639",
53+
"CWE-862"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-03-13T15:47:59Z",
58+
"nvd_published_at": null
59+
}
60+
}

‎advisories/github-reviewed/2026/03/GHSA-jf6w-m8jw-jfxc/GHSA-jf6w-m8jw-jfxc.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jf6w-m8jw-jfxc",
4+
"modified": "2026-03-13T15:48:11Z",
5+
"published": "2026-03-13T15:48:11Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent`",
8+
"details": "## Summary\nIn affected versions of `openclaw`, a gateway caller with `operator.write` could issue `agent` requests containing `/new` or `/reset` and reach the same reset path used by the admin-only `sessions.reset` RPC.\n\n## Impact\nOn gateways where a caller is intentionally granted `operator.write` but not `operator.admin`, that caller could reset targeted conversation state through `agent` slash commands. This crosses the documented method-scope boundary between write-scoped messaging and admin-only session mutation.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.3.8`\n- Fixed in: `2026.3.11`\n\n## Technical Details\nScope checks were enforced only on the outer RPC method. The `agent` slash-command path reused admin-only reset logic internally, so a write-scoped caller could reach session-reset mutation without holding `operator.admin`.\n\n## Fix\nOpenClaw no longer routes conversation `/new` and `/reset` through the admin-only `sessions.reset` entry point. Reset logic now lives in a shared service, while `sessions.reset` remains admin-only. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.3.11"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-jf6w-m8jw-jfxc"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/openclaw/openclaw"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-863"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-13T15:48:11Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/03/GHSA-mj4p-rc52-m843/GHSA-mj4p-rc52-m843.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mj4p-rc52-m843",
4+
"modified": "2026-03-13T15:48:16Z",
5+
"published": "2026-03-13T15:48:16Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Sandbox staged writes could escape the verified parent directory before commit",
8+
"details": "## Summary\nIn affected versions of `openclaw`, sandbox fs-bridge writes validated the destination before commit, but temporary file creation and population were not pinned to a verified parent directory. A raced parent-path alias change could cause the staged temp file to be created outside the intended writable mount before the final guarded replace step.\n\n## Impact\nThis is a sandbox boundary bypass affecting integrity and availability within the writable mount scope. Attacker-controlled bytes could be written outside the intended validated path before the final guarded step ran.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.3.8`\n- Fixed in: `2026.3.11`\n\n## Technical Details\nThe older staging flow created and wrote the temporary file using target-directory shell path operations before the final replace step revalidated the destination. That meant the last guard protected only the final rename, not the earlier temp-file materialization path.\n\n## Fix\nOpenClaw now resolves a pinned mount root plus relative parent path, creates the temporary file inside the verified parent directory, and performs the final atomic replace from that pinned directory context. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.3.11"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-mj4p-rc52-m843"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/openclaw/openclaw"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-367",
53+
"CWE-59"
54+
],
55+
"severity": "HIGH",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-03-13T15:48:16Z",
58+
"nvd_published_at": null
59+
}
60+
}

‎advisories/github-reviewed/2026/03/GHSA-qc36-x95h-7j53/GHSA-qc36-x95h-7j53.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qc36-x95h-7j53",
4+
"modified": "2026-03-13T15:48:05Z",
5+
"published": "2026-03-13T15:48:05Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity",
8+
"details": "## Summary\nIn affected versions of `openclaw`, node-host `system.run` approvals did not bind a mutable file operand for some script runners, including forms such as `tsx` and `jiti`. An attacker could obtain approval for a benign script-runner command, rewrite the referenced script on disk, and have the modified code execute under the already approved run context.\n\n## Impact\nDeployments that rely on node-host `system.run` approvals for script integrity could execute rewritten local code after operator approval. This can lead to unintended local code execution as the OpenClaw runtime user.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `< 2026.3.11`\n- Fixed in: `2026.3.11`\n\n## Technical Details\nThe approval planner only tracked mutable script operands for a hardcoded set of interpreters and runtime forms. Commands such as `tsx ./run.ts` and `jiti ./run.ts` fell through without a bound file snapshot, so the final pre-execution revalidation step was skipped.\n\n## Fix\nOpenClaw now fails closed for approval-backed interpreter and runtime commands unless it can bind exactly one concrete local file operand, and it extends direct-file binding coverage for additional runtime forms. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.3.11"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-qc36-x95h-7j53"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/openclaw/openclaw"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-863"
53+
],
54+
"severity": "HIGH",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-13T15:48:05Z",
57+
"nvd_published_at": null
58+
}
59+
}

0 commit comments

Comments
 (0)