Skip to content

Commit 1658312

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-52q4-3xjc-6778 GHSA-xq8g-hgh6-87hv GHSA-rc8f-r29c-chr6 GHSA-rc8f-r29c-chr6
1 parent a8de38b commit 1658312

File tree

4 files changed

+113
-55
lines changed

4 files changed

+113
-55
lines changed

‎advisories/github-reviewed/2026/03/GHSA-52q4-3xjc-6778/GHSA-52q4-3xjc-6778.json‎

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,23 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-52q4-3xjc-6778",
4-
"modified": "2026-03-29T15:48:15Z",
4+
"modified": "2026-04-18T00:48:38Z",
55
"published": "2026-03-29T15:48:15Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35617"
8+
],
79
"summary": "OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName",
810
"details": "## Summary\n\nGoogle Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `<= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nGoogle Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit `11ea1f67863d88b6cbcb229dd368a45e07094bff` requires stable group IDs for access decisions.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `11ea1f67863d88b6cbcb229dd368a45e07094bff`.\n\n## Fix Commit(s)\n\n- `11ea1f67863d88b6cbcb229dd368a45e07094bff`",
9-
"severity": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
15+
},
16+
{
17+
"type": "CVSS_V4",
18+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
19+
}
20+
],
1021
"affected": [
1122
{
1223
"package": {
@@ -36,13 +47,21 @@
3647
"type": "WEB",
3748
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-52q4-3xjc-6778"
3849
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35617"
53+
},
3954
{
4055
"type": "WEB",
4156
"url": "https://github.com/openclaw/openclaw/commit/11ea1f67863d88b6cbcb229dd368a45e07094bff"
4257
},
4358
{
4459
"type": "PACKAGE",
4560
"url": "https://github.com/openclaw/openclaw"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-group-policy-rebinding-with-mutable-space-displayname"
4665
}
4766
],
4867
"database_specific": {
@@ -51,7 +70,7 @@
5170
"CWE-807",
5271
"CWE-863"
5372
],
54-
"severity": "MODERATE",
73+
"severity": "LOW",
5574
"github_reviewed": true,
5675
"github_reviewed_at": "2026-03-29T15:48:15Z",
5776
"nvd_published_at": null

‎advisories/github-reviewed/2026/03/GHSA-xq8g-hgh6-87hv/GHSA-xq8g-hgh6-87hv.json‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,23 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xq8g-hgh6-87hv",
4-
"modified": "2026-03-27T22:31:19Z",
4+
"modified": "2026-04-18T00:49:18Z",
55
"published": "2026-03-27T22:31:19Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-35623"
8+
],
79
"summary": "OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing",
810
"details": "## Summary\n\nBlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Password\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `<= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nBlueBubbles webhook auth previously rejected wrong passwords without throttling repeated guesses, allowing brute-force attempts against weak webhook passwords. Commit `5e08ce36d522a1c96df2bfe88e39303ae2643d92` adds repeated-guess throttling before auth failure responses.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `5e08ce36d522a1c96df2bfe88e39303ae2643d92`.\n\n## Fix Commit(s)\n\n- `5e08ce36d522a1c96df2bfe88e39303ae2643d92`",
9-
"severity": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
15+
},
16+
{
17+
"type": "CVSS_V4",
18+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
19+
}
20+
],
1021
"affected": [
1122
{
1223
"package": {
@@ -33,13 +44,21 @@
3344
"type": "WEB",
3445
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-xq8g-hgh6-87hv"
3546
},
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35623"
50+
},
3651
{
3752
"type": "WEB",
3853
"url": "https://github.com/openclaw/openclaw/commit/5e08ce36d522a1c96df2bfe88e39303ae2643d92"
3954
},
4055
{
4156
"type": "PACKAGE",
4257
"url": "https://github.com/openclaw/openclaw"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://www.vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-webhook-password-rate-limiting"
4362
}
4463
],
4564
"database_specific": {

‎advisories/github-reviewed/2026/04/GHSA-rc8f-r29c-chr6/GHSA-rc8f-r29c-chr6.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rc8f-r29c-chr6",
4+
"modified": "2026-04-18T00:48:48Z",
5+
"published": "2026-04-10T00:30:29Z",
6+
"withdrawn": "2026-04-18T00:48:48Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-xq8g-hgh6-87hv. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password guesses to the webhook endpoint to compromise authentication and gain unauthorized access.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"last_affected": "2026.3.24"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-xq8g-hgh6-87hv"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35623"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/5e08ce36d522a1c96df2bfe88e39303ae2643d92"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-webhook-password-rate-limiting"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-307"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-04-18T00:48:48Z",
66+
"nvd_published_at": "2026-04-09T22:16:30Z"
67+
}
68+
}

‎advisories/unreviewed/2026/04/GHSA-rc8f-r29c-chr6/GHSA-rc8f-r29c-chr6.json‎

Lines changed: 0 additions & 48 deletions
This file was deleted.

0 commit comments

Comments
 (0)