Skip to content

Commit a4f516a

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-52q4-3xjc-6778 GHSA-5jvj-hxmh-6h6j GHSA-q2qc-744p-66r2 GHSA-q35r-vvhv-vx5h GHSA-q35r-vvhv-vx5h
1 parent 72bd986 commit a4f516a

5 files changed

Lines changed: 288 additions & 40 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-52q4-3xjc-6778/GHSA-52q4-3xjc-6778.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-52q4-3xjc-6778",
4+
"modified": "2026-03-29T15:48:15Z",
5+
"published": "2026-03-29T15:48:15Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName",
8+
"details": "## Summary\n\nGoogle Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `<= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nGoogle Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit `11ea1f67863d88b6cbcb229dd368a45e07094bff` requires stable group IDs for access decisions.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `11ea1f67863d88b6cbcb229dd368a45e07094bff`.\n\n## Fix Commit(s)\n\n- `11ea1f67863d88b6cbcb229dd368a45e07094bff`",
9+
"severity": [],
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "npm",
14+
"name": "openclaw"
15+
},
16+
"ranges": [
17+
{
18+
"type": "ECOSYSTEM",
19+
"events": [
20+
{
21+
"introduced": "0"
22+
},
23+
{
24+
"fixed": "2026.3.28"
25+
}
26+
]
27+
}
28+
],
29+
"database_specific": {
30+
"last_known_affected_version_range": "<= 2026.3.24"
31+
}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "WEB",
37+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-52q4-3xjc-6778"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/openclaw/openclaw/commit/11ea1f67863d88b6cbcb229dd368a45e07094bff"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/openclaw/openclaw"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-639",
51+
"CWE-807",
52+
"CWE-863"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-29T15:48:15Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/03/GHSA-5jvj-hxmh-6h6j/GHSA-5jvj-hxmh-6h6j.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5jvj-hxmh-6h6j",
4+
"modified": "2026-03-29T15:46:40Z",
5+
"published": "2026-03-29T15:46:40Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope",
8+
"details": "## Summary\n\nGateway HTTP Session History Route Bypasses Operator Read Scope\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `<= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nThe HTTP `/sessions/:sessionKey/history` route previously authenticated bearer tokens but skipped the same `operator.read` check used by `chat.history` over WebSocket. Commit `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea` makes HTTP callers declare operator scopes and rejects history reads that do not include `operator.read`.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea`.\n\n## Fix Commit(s)\n\n- `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea`",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "2026.3.24"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5jvj-hxmh-6h6j"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/openclaw/openclaw/commit/1c45123231516fa50f8cf8522ba5ff2fb2ca7aea"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/openclaw/openclaw"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-639",
53+
"CWE-863"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-03-29T15:46:40Z",
58+
"nvd_published_at": null
59+
}
60+
}

‎advisories/github-reviewed/2026/03/GHSA-q2qc-744p-66r2/GHSA-q2qc-744p-66r2.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q2qc-744p-66r2",
4+
"modified": "2026-03-29T15:47:50Z",
5+
"published": "2026-03-29T15:47:50Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility",
8+
"details": "## Summary\n\n`session_status` sessionId resolution bypasses sandboxed session-tree visibility\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `>= 2026.3.11, <= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\n`session_status` previously resolved a `sessionId` to a canonical session key after early visibility checks, letting sandboxed children reach parent or sibling sessions that were blocked by explicit `sessionKey`. Commit `d9810811b6c3c9266d7580f00574e5e02f7663de` enforces visibility after `sessionId` resolution so sandboxed callers cannot escape their session tree.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `d9810811b6c3c9266d7580f00574e5e02f7663de`.\n\n## Fix Commit(s)\n\n- `d9810811b6c3c9266d7580f00574e5e02f7663de`",
9+
"severity": [],
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "npm",
14+
"name": "openclaw"
15+
},
16+
"ranges": [
17+
{
18+
"type": "ECOSYSTEM",
19+
"events": [
20+
{
21+
"introduced": "2026.3.11"
22+
},
23+
{
24+
"fixed": "2026.3.28"
25+
}
26+
]
27+
}
28+
],
29+
"database_specific": {
30+
"last_known_affected_version_range": "<= 2026.3.24"
31+
}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "WEB",
37+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-q2qc-744p-66r2"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/openclaw/openclaw/commit/d9810811b6c3c9266d7580f00574e5e02f7663de"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/openclaw/openclaw"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-639",
51+
"CWE-863"
52+
],
53+
"severity": "HIGH",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-03-29T15:47:50Z",
56+
"nvd_published_at": null
57+
}
58+
}

‎advisories/github-reviewed/2026/03/GHSA-q35r-vvhv-vx5h/GHSA-q35r-vvhv-vx5h.json‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q35r-vvhv-vx5h",
4+
"modified": "2026-03-29T15:46:10Z",
5+
"published": "2026-03-26T21:31:26Z",
6+
"aliases": [
7+
"CVE-2026-3190"
8+
],
9+
"summary": "Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure",
10+
"details": "A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.keycloak:keycloak-server-spi-private"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "26.5.6"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.keycloak:keycloak-services"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "26.5.6"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.keycloak:keycloak-model-jpa"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "26.5.6"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "ADVISORY",
79+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3190"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/keycloak/keycloak/issues/46723"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/keycloak/keycloak/commit/f1baf25cbb1551202570f954102eb2d270ab0694"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://access.redhat.com/security/cve/CVE-2026-3190"
92+
},
93+
{
94+
"type": "WEB",
95+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442572"
96+
},
97+
{
98+
"type": "PACKAGE",
99+
"url": "https://github.com/keycloak/keycloak"
100+
}
101+
],
102+
"database_specific": {
103+
"cwe_ids": [
104+
"CWE-280"
105+
],
106+
"severity": "MODERATE",
107+
"github_reviewed": true,
108+
"github_reviewed_at": "2026-03-29T15:46:10Z",
109+
"nvd_published_at": "2026-03-26T19:17:06Z"
110+
}
111+
}

‎advisories/unreviewed/2026/03/GHSA-q35r-vvhv-vx5h/GHSA-q35r-vvhv-vx5h.json‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

0 commit comments

Comments
 (0)