PT-2026-25114 · Npm · Openclaw

Published 2026-03-02 · Updated 2026-03-02

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

Unauthorized senders could trigger two command paths without sender authorization checks:

1. stop-like natural-language abort triggers
2. /models command output

Impact

An unauthorized sender could disrupt active sessions and view model/auth metadata that should be authorization-gated.

Fix

Sender authorization is now enforced for stop-like abort triggers and /models listings.

Affected and Patched Versions

• Affected: <= 2026.2.26
• Patched: 2026.3.1

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

GHSA-8M9V-XPGF-G99M

Affected Products

Openclaw

References · 3

• https://osv.dev/vulnerability/GHSA-8m9v-xpgf-g99m · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-8m9v-xpgf-g99m · Note