PT-2026-32077 · Npm · Openclaw

Publicado 2026-04-01 · Atualizado 2026-04-01

OSV

CVSS v3.1

7.3

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Summary

Allow-always persistence could trust wrapper carrier executables instead of the actual invoked target when commands were routed through dispatch wrappers.

Impact

A one-time approval could persist a broader future allowlist entry than the operator intended, weakening execution approval boundaries.

Affected Component

src/infra/exec-approvals-allowlist.ts

Fixed Versions

• Affected: <= 2026.3.24
• Patched: >= 2026.3.28
• Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 9ec44fad39 (Exec approvals: reject wrapper carrier allow-always targets).

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

GHSA-P4X4-2R7F-WJXG

Produtos afetados

Openclaw

Referências · 5

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-p4x4-2r7f-wjxg · Nota
• https://github.com/openclaw/openclaw/commit/9ec44fad390f0bc1c29c3cc418b322560cb0222b · Nota
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.28 · Nota
• https://osv.dev/vulnerability/GHSA-p4x4-2r7f-wjxg · Aviso do Fabricante