Skip to content

Commit e8ce96d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-35cq-wv6v-88xf GHSA-6q2v-vfwp-pvwh GHSA-9q8j-chc7-wpgp GHSA-g7cr-9h7q-4qxq GHSA-vhwf-4x96-vqx2 GHSA-vr7j-g7jv-h5mp GHSA-xg59-f45v-9r9j GHSA-xvx8-77m6-gwg6 GHSA-xxj4-96ph-g6j6 GHSA-qxgf-hmcj-3xw3 GHSA-35cq-wv6v-88xf GHSA-6q2v-vfwp-pvwh GHSA-xg59-f45v-9r9j GHSA-xxj4-96ph-g6j6
1 parent 0361495 commit e8ce96d

14 files changed

Lines changed: 356 additions & 206 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-35cq-wv6v-88xf/GHSA-35cq-wv6v-88xf.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-35cq-wv6v-88xf",
4+
"modified": "2026-04-06T22:45:57Z",
5+
"published": "2026-03-31T15:31:56Z",
6+
"withdrawn": "2026-04-06T22:45:57Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw affected by SSRF via unguarded image download in fal provider",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-qxgf-hmcj-3xw3. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URLs. A malicious or compromised fal relay can exploit unguarded image download fetches to expose internal service metadata and responses through the image pipeline.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.28"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-qxgf-hmcj-3xw3"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34504"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/80d1e8a11a2ac118c7f7a70bba9c862b6141d928"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-image-download-in-fal-provider"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-918"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-04-06T22:45:57Z",
66+
"nvd_published_at": "2026-03-31T15:16:19Z"
67+
}
68+
}

‎advisories/github-reviewed/2026/03/GHSA-6q2v-vfwp-pvwh/GHSA-6q2v-vfwp-pvwh.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6q2v-vfwp-pvwh",
4+
"modified": "2026-04-06T22:46:34Z",
5+
"published": "2026-03-29T15:30:20Z",
6+
"withdrawn": "2026-04-06T22:46:34Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-vhwf-4x96-vqx2. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archive download and copy operations. A local attacker can rebind the tools-root path between validation and final write to redirect the installer outside the intended tools directory.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.8"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-vhwf-4x96-vqx2"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33574"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/9abf014f3502009faf9c73df5ca2cff719e54639"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-path-traversal-via-tools-root-rebinding-in-skills-download"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-367"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-04-06T22:46:34Z",
66+
"nvd_published_at": "2026-03-29T13:17:03Z"
67+
}
68+
}

advisories/unreviewed/2026/03/GHSA-9q8j-chc7-wpgp/GHSA-9q8j-chc7-wpgp.json renamed to advisories/github-reviewed/2026/03/GHSA-9q8j-chc7-wpgp/GHSA-9q8j-chc7-wpgp.json

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9q8j-chc7-wpgp",
4-
"modified": "2026-03-29T15:30:20Z",
4+
"modified": "2026-04-06T22:46:20Z",
55
"published": "2026-03-29T15:30:20Z",
6-
"aliases": [
7-
"CVE-2026-33572"
8-
],
9-
"details": "OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.",
6+
"withdrawn": "2026-04-06T22:46:19Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw session transcript files were created without forced user-only permissions",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-vr7j-g7jv-h5mp. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",
@@ -17,7 +17,27 @@
1717
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1818
}
1919
],
20-
"affected": [],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.2.17"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
2141
"references": [
2242
{
2343
"type": "WEB",
@@ -41,8 +61,8 @@
4161
"CWE-378"
4262
],
4363
"severity": "MODERATE",
44-
"github_reviewed": false,
45-
"github_reviewed_at": null,
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-04-06T22:46:19Z",
4666
"nvd_published_at": "2026-03-29T13:17:02Z"
4767
}
4868
}

‎advisories/github-reviewed/2026/03/GHSA-g7cr-9h7q-4qxq/GHSA-g7cr-9h7q-4qxq.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g7cr-9h7q-4qxq",
4-
"modified": "2026-03-12T14:21:35Z",
4+
"modified": "2026-04-06T22:45:49Z",
55
"published": "2026-03-12T14:21:35Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-34506"
8+
],
79
"summary": "OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty",
810
"details": "OpenClaw's Microsoft Teams plugin widened group sender authorization when a team/channel route allowlist was configured but `groupAllowFrom` was empty. Before the fix, a matching route allowlist entry could cause the message handler to synthesize wildcard sender authorization for that route, allowing any sender in the matched team/channel to bypass the intended `groupPolicy: \"allowlist\"` sender check.\n\nThis does not affect default unauthenticated access, but it does weaken a documented Teams group authorization boundary and can allow unauthorized group senders to trigger replies in allowlisted Teams routes.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Latest published vulnerable version: `2026.3.7`\n- Affected range: `<= 2026.3.7`\n- Fixed in released version: `2026.3.8`\n\n## Fix Commit(s)\n\n- `88aee9161e0e6d32e810a25711e32a808a1777b2`\n\n## Release Verification\n\n- Verified fixed in GitHub release `v2026.3.8` published on March 9, 2026.\n- Verified `npm view openclaw version` resolves to `2026.3.8`.\n- Verified the release contains the regression test covering the Teams route-allowlist sender-bypass case and that the test passes against the `v2026.3.8` tree.\n\nThanks @zpbrent for reporting.",
911
"severity": [
@@ -41,13 +43,21 @@
4143
"type": "WEB",
4244
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g7cr-9h7q-4qxq"
4345
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34506"
49+
},
4450
{
4551
"type": "WEB",
4652
"url": "https://github.com/openclaw/openclaw/commit/88aee9161e0e6d32e810a25711e32a808a1777b2"
4753
},
4854
{
4955
"type": "PACKAGE",
5056
"url": "https://github.com/openclaw/openclaw"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-in-microsoft-teams-plugin-via-route-allowlist-configuration"
5161
}
5262
],
5363
"database_specific": {

‎advisories/github-reviewed/2026/03/GHSA-vhwf-4x96-vqx2/GHSA-vhwf-4x96-vqx2.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vhwf-4x96-vqx2",
4-
"modified": "2026-03-12T14:21:32Z",
4+
"modified": "2026-04-06T22:46:40Z",
55
"published": "2026-03-12T14:21:32Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-33574"
8+
],
79
"summary": "OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path",
810
"details": "OpenClaw's skills download installer validated the intended per-skill tools root lexically, but later reused that mutable path while downloading and copying the archive into place. If a local attacker could rebind that tools-root path between validation and the final write, the installer could be redirected to write outside the intended tools directory.\n\nThe fix pins the canonical per-skill tools root immediately after validation and derives later download/copy paths from that canonical root, so rebinding the lexical path fails closed instead of redirecting the write.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Latest published vulnerable version: `2026.3.7`\n- Affected range: `<= 2026.3.7`\n- Fixed in released version: `2026.3.8`\n\n## Fix Commit(s)\n\n- `9abf014f3502009faf9c73df5ca2cff719e54639`\n\n## Release Verification\n\n- Verified fixed in GitHub release `v2026.3.8` published on March 9, 2026.\n- Verified `npm view openclaw version` resolves to `2026.3.8`.\n- Verified the release contains the regression test covering tools-root rebinding and that the test passes against the `v2026.3.8` tree.\n\nThanks @tdjackey for reporting.",
911
"severity": [
@@ -41,13 +43,21 @@
4143
"type": "WEB",
4244
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-vhwf-4x96-vqx2"
4345
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33574"
49+
},
4450
{
4551
"type": "WEB",
4652
"url": "https://github.com/openclaw/openclaw/commit/9abf014f3502009faf9c73df5ca2cff719e54639"
4753
},
4854
{
4955
"type": "PACKAGE",
5056
"url": "https://github.com/openclaw/openclaw"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://www.vulncheck.com/advisories/openclaw-path-traversal-via-tools-root-rebinding-in-skills-download"
5161
}
5262
],
5363
"database_specific": {

‎advisories/github-reviewed/2026/03/GHSA-vr7j-g7jv-h5mp/GHSA-vr7j-g7jv-h5mp.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vr7j-g7jv-h5mp",
4-
"modified": "2026-03-16T20:41:51Z",
4+
"modified": "2026-04-06T22:46:26Z",
55
"published": "2026-03-16T20:41:51Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-33572"
8+
],
79
"summary": "OpenClaw session transcript files were created without forced user-only permissions",
810
"details": "`openclaw` created new session transcript JSONL files with overly broad default permissions in affected releases. On multi-user hosts, other local users or processes could read transcript contents, including secrets that might appear in tool output.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (`npm`)\n- Affected versions: `<= 2026.2.15`\n- First fixed version: `2026.2.17`\n- Current latest npm release checked during verification: `2026.3.13` (not affected)\n\n## Impact\n\nSession transcript JSONL files are created under the local OpenClaw session store. In affected releases, newly created transcript files did not force user-only permissions, so transcript contents could be readable by other local users depending on the host environment and umask behavior.\n\n## Fix\n\nNew transcript files are now created with `0o600` permissions. Existing transcript permission drift is also remediated by the security audit fix flow.\n\nVerified in code:\n\n- `src/config/sessions/transcript.ts:82` writes new transcript files with `mode: 0o600`\n- `src/config/sessions/sessions.test.ts:303` includes regression coverage asserting `0o600`\n\n## Fix Commit(s)\n\n- `095d522099653367e1b76fa5bb09d4ddf7c8a57c`\n\n## Release Note\n\nThis fix first shipped in `2026.2.17` and is present in the current npm release `2026.3.13`.",
911
"severity": [
@@ -41,13 +43,21 @@
4143
"type": "WEB",
4244
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-vr7j-g7jv-h5mp"
4345
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33572"
49+
},
4450
{
4551
"type": "WEB",
4652
"url": "https://github.com/openclaw/openclaw/commit/095d522099653367e1b76fa5bb09d4ddf7c8a57c"
4753
},
4854
{
4955
"type": "PACKAGE",
5056
"url": "https://github.com/openclaw/openclaw"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://www.vulncheck.com/advisories/openclaw-insufficient-file-permissions-in-session-transcript-files"
5161
}
5262
],
5363
"database_specific": {

‎advisories/github-reviewed/2026/03/GHSA-xg59-f45v-9r9j/GHSA-xg59-f45v-9r9j.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xg59-f45v-9r9j",
4+
"modified": "2026-04-06T22:45:43Z",
5+
"published": "2026-03-31T12:31:36Z",
6+
"withdrawn": "2026-04-06T22:45:43Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-g7cr-9h7q-4qxq. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.8"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g7cr-9h7q-4qxq"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34506"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/88aee9161e0e6d32e810a25711e32a808a1777b2"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-in-microsoft-teams-plugin-via-route-allowlist-configuration"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-863"
62+
],
63+
"severity": "LOW",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-04-06T22:45:43Z",
66+
"nvd_published_at": "2026-03-31T12:16:30Z"
67+
}
68+
}

0 commit comments

Comments
 (0)