PT-2026-32316 · Npm · Openclaw

Published 2026-04-03 · Updated 2026-04-03

OSV

CVSS v4.0

7.1

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

macOS Wide-Area Discovery Accepts Arbitrary Tailnet Peer as DNS Authority and Exfiltrates Operator Credentials

Current Maintainer Triage

• Status: narrow
• Normalized severity: medium
• Assessment: Real shipped macOS discovery steering bug, but exploitation needs same-tailnet position, a CA-trusted endpoint, and user selection, so medium not high.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published npm version: 2026.3.31
• Vulnerable version range: <=2026.3.28
• Patched versions: >= 2026.3.31
• First stable tag containing the fix: v2026.3.31

Fix Commit(s)

• a23c33a681f8c1b22dc793995acc4c5c4b568346 — 2026-03-31T10:04:11+01:00

OpenClaw thanks @nexrin for reporting.

Fix

Origin Validation Error

Weakness Enumeration

CWE-350

CWE-346

Related Identifiers

GHSA-Q9W8-CF67-R238

Affected Products

Openclaw

References · 5

• https://osv.dev/vulnerability/GHSA-q9w8-cf67-r238 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-q9w8-cf67-r238 · Note
• https://github.com/openclaw/openclaw/commit/a23c33a681f8c1b22dc793995acc4c5c4b568346 · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note