PT-2026-25110 · Npm · Openclaw
Publicado
2026-03-02
·
Atualizado
2026-03-02
CVSS v4.0
6.9
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |
Summary
exec.approval requests for host=node were not explicitly bound to the target nodeId, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.Impact
An operator approval for a
system.run request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.22-2 - Fixed:
2026.2.23(released)
Mitigation
Upgrade to
2026.2.23 or later once published.Fix Details
The fix requires and persists
nodeId for host=node approval requests and rejects execution when the approving node binding does not match the invoking node.Fix Commit(s)
- 4a3f8438e527ac371a67fe7ac68a287f0dbe6063
Release Process Note
patched versions is pre-set to the released version (2026.2.23). This advisory now reflects released fix version 2026.2.23.OpenClaw thanks @tdjackey for reporting.
Correção
Improper Authorization
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Openclaw