PT-2026-25114 · Npm · Openclaw

Publicado 2026-03-02 · Atualizado 2026-03-02

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

Unauthorized senders could trigger two command paths without sender authorization checks:

1. stop-like natural-language abort triggers
2. /models command output

Impact

An unauthorized sender could disrupt active sessions and view model/auth metadata that should be authorization-gated.

Fix

Sender authorization is now enforced for stop-like abort triggers and /models listings.

Affected and Patched Versions

• Affected: <= 2026.2.26
• Patched: 2026.3.1

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

GHSA-8M9V-XPGF-G99M

Produtos afetados

Openclaw

Referências · 3

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-8m9v-xpgf-g99m · Nota
• https://osv.dev/vulnerability/GHSA-8m9v-xpgf-g99m · Aviso do Fabricante