Skip to content

Commit c7b0755

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5m9r-p9g7-679c GHSA-99qw-6mr3-36qr GHSA-cxfr-3qp8-hpmw GHSA-j5qh-5234-4rqp GHSA-phgf-3849-rgjq GHSA-xw77-45gv-p728 GHSA-cxfr-3qp8-hpmw GHSA-j5qh-5234-4rqp GHSA-phgf-3849-rgjq
1 parent e8ce96d commit c7b0755

9 files changed

Lines changed: 228 additions & 138 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-5m9r-p9g7-679c/GHSA-5m9r-p9g7-679c.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5m9r-p9g7-679c",
4-
"modified": "2026-03-13T20:55:38Z",
4+
"modified": "2026-04-06T22:50:15Z",
55
"published": "2026-03-13T20:55:38Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-34505"
8+
],
79
"summary": "OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation",
810
"details": "### Summary\n\nThe Zalo webhook handler applied request rate limiting only after webhook authentication succeeded. Requests with an invalid secret returned `401` but did not count against the rate limiter, allowing repeated secret guesses without triggering `429`.\n\n### Impact\n\nThis made brute-force guessing materially easier for weak but policy-compliant webhook secrets. Once the secret was guessed, an attacker could submit forged Zalo webhook traffic.\n\n### Affected versions\n\n`openclaw` `<= 2026.3.11`\n\n### Patch\n\nFixed in `openclaw` `2026.3.12`. Rate limiting now applies before successful authentication is required, closing the pre-auth brute-force gap. Users should update to `2026.3.12` or later and prefer strong webhook secrets.",
911
"severity": [
@@ -41,6 +43,10 @@
4143
"type": "WEB",
4244
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c"
4345
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34505"
49+
},
4450
{
4551
"type": "WEB",
4652
"url": "https://github.com/openclaw/openclaw/pull/44173"
@@ -56,6 +62,10 @@
5662
{
5763
"type": "WEB",
5864
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.12"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://www.vulncheck.com/advisories/openclaw-webhook-rate-limiting-bypass-via-pre-authentication-secret-validation"
5969
}
6070
],
6171
"database_specific": {

‎advisories/github-reviewed/2026/03/GHSA-99qw-6mr3-36qr/GHSA-99qw-6mr3-36qr.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-99qw-6mr3-36qr",
4-
"modified": "2026-03-13T20:55:14Z",
4+
"modified": "2026-04-06T22:49:40Z",
55
"published": "2026-03-13T20:55:13Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-32920"
8+
],
79
"summary": "OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories",
810
"details": "### Summary\n\nOpenClaw automatically discovered and loaded plugins from `.openclaw/extensions/` inside the current workspace without an explicit trust or install step. A malicious repository could include a crafted workspace plugin that executed as soon as a user ran OpenClaw from that cloned directory.\n\n### Impact\n\nOpening or running OpenClaw in an untrusted repository could lead to arbitrary code execution under the user's account.\n\n### Affected versions\n\n`openclaw` `<= 2026.3.11`\n\n### Patch\n\nFixed in `openclaw` `2026.3.12`. Workspace plugin loading now requires explicit trusted state before execution. Users should update to `2026.3.12` or later and avoid running OpenClaw inside untrusted repositories on older releases.",
911
"severity": [
@@ -41,13 +43,21 @@
4143
"type": "WEB",
4244
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-99qw-6mr3-36qr"
4345
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32920"
49+
},
4450
{
4551
"type": "PACKAGE",
4652
"url": "https://github.com/openclaw/openclaw"
4753
},
4854
{
4955
"type": "WEB",
5056
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.12"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-auto-discovery-of-workspace-plugins"
5161
}
5262
],
5363
"database_specific": {

‎advisories/github-reviewed/2026/03/GHSA-cxfr-3qp8-hpmw/GHSA-cxfr-3qp8-hpmw.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cxfr-3qp8-hpmw",
4+
"modified": "2026-04-06T22:50:08Z",
5+
"published": "2026-03-31T12:31:36Z",
6+
"withdrawn": "2026-04-06T22:50:08Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-5m9r-p9g7-679c. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.12"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34505"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.vulncheck.com/advisories/openclaw-webhook-rate-limiting-bypass-via-pre-authentication-secret-validation"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-307"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-04-06T22:50:08Z",
62+
"nvd_published_at": "2026-03-31T12:16:30Z"
63+
}
64+
}

‎advisories/github-reviewed/2026/03/GHSA-j5qh-5234-4rqp/GHSA-j5qh-5234-4rqp.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j5qh-5234-4rqp",
4+
"modified": "2026-04-06T22:49:34Z",
5+
"published": "2026-03-31T12:31:35Z",
6+
"withdrawn": "2026-04-06T22:49:33Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-99qw-6mr3-36qr. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.12"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-99qw-6mr3-36qr"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32920"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-auto-discovery-of-workspace-plugins"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-829"
58+
],
59+
"severity": "HIGH",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-04-06T22:49:33Z",
62+
"nvd_published_at": "2026-03-31T12:16:28Z"
63+
}
64+
}

‎advisories/github-reviewed/2026/03/GHSA-phgf-3849-rgjq/GHSA-phgf-3849-rgjq.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-phgf-3849-rgjq",
4+
"modified": "2026-04-06T22:49:20Z",
5+
"published": "2026-03-31T12:31:35Z",
6+
"withdrawn": "2026-04-06T22:49:20Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xw77-45gv-p728. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent methods to perform privileged gateway actions including session deletion and agent execution.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "2026.3.7"
32+
},
33+
{
34+
"fixed": "2026.3.11"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-xw77-45gv-p728"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32916"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-plugin-subagent-routes-via-synthetic-admin-scopes"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-266"
58+
],
59+
"severity": "CRITICAL",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-04-06T22:49:20Z",
62+
"nvd_published_at": "2026-03-31T12:16:28Z"
63+
}
64+
}

‎advisories/github-reviewed/2026/03/GHSA-xw77-45gv-p728/GHSA-xw77-45gv-p728.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xw77-45gv-p728",
4-
"modified": "2026-03-13T15:47:23Z",
4+
"modified": "2026-04-06T22:49:26Z",
55
"published": "2026-03-13T15:47:23Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-32916"
8+
],
79
"summary": "OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes",
810
"details": "## Summary\nIn affected versions of `openclaw`, the plugin subagent runtime dispatched gateway methods through a synthetic operator client that always carried broad administrative scopes. Plugin-owned HTTP routes using `auth: \"plugin\"` could therefore trigger admin-only gateway actions without normal gateway authorization.\n\n## Impact\nThis is a critical authorization bypass. An external unauthenticated request to a plugin-owned route could reach privileged subagent runtime methods and perform admin-only gateway actions such as deleting sessions, reading session data, or triggering agent execution.\n\n## Affected Packages and Versions\n- Package: `openclaw` (npm)\n- Affected versions: `>= 2026.3.7, < 2026.3.11`\n- Fixed in: `2026.3.11`\n\n## Technical Details\nThe new plugin subagent runtime preserved neither the original caller's auth context nor least-privilege scope. Instead, it executed gateway dispatches through a fabricated operator client with administrative scopes, which was reachable from plugin-owned routes that intentionally bypass normal gateway auth so plugins can perform their own webhook verification.\n\n## Fix\nOpenClaw now preserves real authorization boundaries for plugin subagent calls instead of dispatching them through synthetic admin scopes. The fix shipped in `openclaw@2026.3.11`.\n\n## Workarounds\nUpgrade to `2026.3.11` or later.",
911
"severity": [
@@ -38,13 +40,21 @@
3840
"type": "WEB",
3941
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-xw77-45gv-p728"
4042
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32916"
46+
},
4147
{
4248
"type": "PACKAGE",
4349
"url": "https://github.com/openclaw/openclaw"
4450
},
4551
{
4652
"type": "WEB",
4753
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-plugin-subagent-routes-via-synthetic-admin-scopes"
4858
}
4959
],
5060
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-cxfr-3qp8-hpmw/GHSA-cxfr-3qp8-hpmw.json‎

Lines changed: 0 additions & 44 deletions
This file was deleted.

‎advisories/unreviewed/2026/03/GHSA-j5qh-5234-4rqp/GHSA-j5qh-5234-4rqp.json‎

Lines changed: 0 additions & 44 deletions
This file was deleted.

0 commit comments

Comments
 (0)