PT-2026-30781 · Npm · Openclaw

Publicado 2026-03-27 · Atualizado 2026-03-27

OSV

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Summary

Gateway Plugin HTTP auth: "gateway" Mints operator.admin Runtime Scope

Affected Packages / Versions

• Package: openclaw
• Affected versions: <= 2026.3.24
• First patched version: 2026.3.25
• Latest published npm version at verification time: 2026.3.24

Details

Gateway-authenticated plugin HTTP routes previously created a runtime scope set that included operator.admin regardless of caller-granted scopes. Commit ec2dbcff9afd8a52e00de054b506c91726d9fbbe keeps plugin HTTP runtime scopes least-privileged and preserves caller scope boundaries.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit ec2dbcff9afd8a52e00de054b506c91726d9fbbe.

Fix Commit(s)

• ec2dbcff9afd8a52e00de054b506c91726d9fbbe

Correção

Incorrect Privilege Assignment

Incorrect Authorization

Enumeração de Fraquezas

CWE-266

CWE-863

Identificadores relacionados

GHSA-QM2M-28PF-HGJW

Produtos afetados

Openclaw

Referências · 4

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qm2m-28pf-hgjw · Nota
• https://github.com/openclaw/openclaw/commit/ec2dbcff9afd8a52e00de054b506c91726d9fbbe · Nota
• https://osv.dev/vulnerability/GHSA-qm2m-28pf-hgjw · Aviso do Fabricante