Skip to content

Commit 195938b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-8cp7-rp8r-mg77 GHSA-vjp8-wprm-2jw9 GHSA-x2ff-j5c2-ggpr
1 parent c159fa0 commit 195938b

File tree

3 files changed

+187
-0
lines changed

3 files changed

+187
-0
lines changed

‎advisories/github-reviewed/2026/03/GHSA-8cp7-rp8r-mg77/GHSA-8cp7-rp8r-mg77.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8cp7-rp8r-mg77",
4+
"modified": "2026-03-04T18:55:48Z",
5+
"published": "2026-03-04T18:55:48Z",
6+
"aliases": [],
7+
"summary": "OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP",
8+
"details": "## Summary\nOpenClaw's SSRF hostname/IP guard did not detect ISATAP embedded IPv4 addresses (`...:5efe:w.x.y.z`). A crafted URL containing an ISATAP IPv6 literal could embed a private IPv4 target (for example loopback) and bypass private-address filtering in URL-fetching paths.\n\n## Severity Assessment\nRated **medium**: the bug weakens SSRF protections in URL fetch flows, but impact depends on reaching a URL-fetching path with attacker-controlled input and is generally constrained to internal network access attempts.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `>=2026.1.20 <=2026.2.17`\n- Latest published at patch time: `2026.2.17`\n- Patched release: `2026.2.19`\n\n## Security Policy Context\nPer `SECURITY.md`, OpenClaw's web/gateway surface is intended for local use by default, public internet exposure is out-of-scope, and prompt-injection reports are out-of-scope for bounty handling. This advisory tracks a core SSRF-guard bypass in fetch protections.\n\n## Impact\nThis can permit SSRF-style access attempts to internal/private network targets through URL ingestion/fetch paths that rely on shared hostname/IP blocking.\n\n## Fix\n- Added RFC 5214 ISATAP embedded-IPv4 detection to the shared SSRF classifier.\n- Centralized hostname/IP blocking through `isBlockedHostnameOrIp` and routed relevant validators to that shared path.\n- Added regression tests for ISATAP private vs public embedded IPv4 handling.\n\n## Fix Commit(s)\n- `d51929ecb52fe65e90bf36795f4247feb29eb8aa`\n\nOpenClaw thanks @zpbrent for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "2026.1.20"
27+
},
28+
{
29+
"fixed": "2026.2.19"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-8cp7-rp8r-mg77"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/openclaw/openclaw/commit/d51929ecb52fe65e90bf36795f4247feb29eb8aa"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/openclaw/openclaw"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-918"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-04T18:55:48Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/03/GHSA-vjp8-wprm-2jw9/GHSA-vjp8-wprm-2jw9.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vjp8-wprm-2jw9",
4+
"modified": "2026-03-04T18:56:10Z",
5+
"published": "2026-03-04T18:56:10Z",
6+
"aliases": [],
7+
"summary": "OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access",
8+
"details": "### Summary\nOpenClaw had account-scope gaps in pairing-store access for DM pairing policy, which could let a pairing approval from one account authorize the same sender on another account in multi-account setups.\n\n### Impact\nThis is an authorization-boundary weakness in multi-account channel deployments. A sender approved in one account could be accepted in another account before explicit approval there.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published version affected: `2026.2.25`\n- Vulnerable range: `<= 2026.2.25`\n- Patched version (planned next release): `>= 2026.2.26`\n\n### Fix\nOpenClaw now enforces account-scoped pairing reads/writes consistently across core and extension message channels, with stricter runtime/SDK helpers and shared policy wiring to prevent cross-account pairing bleed.\n\n### Fix Commit(s)\n- `a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf`\n- `bce643a0bd145d3e9cb55400af33bd1b85baeb02`\n\n### Release Process Note\n`patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish of that version, this advisory is ready to publish without further content edits.\n\nOpenClaw thanks @tdjackey for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.2.26"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.2.25"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-vjp8-wprm-2jw9"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/commit/a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/openclaw/openclaw/commit/bce643a0bd145d3e9cb55400af33bd1b85baeb02"
51+
},
52+
{
53+
"type": "PACKAGE",
54+
"url": "https://github.com/openclaw/openclaw"
55+
}
56+
],
57+
"database_specific": {
58+
"cwe_ids": [
59+
"CWE-863"
60+
],
61+
"severity": "LOW",
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2026-03-04T18:56:10Z",
64+
"nvd_published_at": null
65+
}
66+
}

‎advisories/github-reviewed/2026/03/GHSA-x2ff-j5c2-ggpr/GHSA-x2ff-j5c2-ggpr.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x2ff-j5c2-ggpr",
4+
"modified": "2026-03-04T18:55:19Z",
5+
"published": "2026-03-04T18:55:19Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows",
8+
"details": "## Impact\n\nIn shared Slack workspace deployments that rely on sender restrictions (`allowFrom`, DM policy, or channel user allowlists), some interactive callbacks (`block_action`, `view_submission`, `view_closed`) could be accepted before full sender authorization checks.\n\nIn that scenario, an unauthorized workspace member could enqueue system-event text into an active session. This issue did not provide unauthenticated access, cross-gateway isolation bypass, or host-level privilege escalation by itself.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Vulnerable versions: `<= 2026.2.24`\n- Patched version: `2026.2.25` (planned next npm release)\n\n## Fix Commit(s)\n\n- `ce8c67c314b93f570f53c2a9abc124e1e3a54715`\n\n## Release Process Note\n\n`patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.\n\n## Trust Model Scope Note\n\nOpenClaw does not support adversarial multi-user isolation on a single shared gateway instance. The supported model is one trust boundary per gateway (separate gateways/hosts for mutually untrusted users). See: https://docs.openclaw.ai/gateway/security\n\nOpenClaw thanks @tdjackey for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.2.25"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.2.24"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-x2ff-j5c2-ggpr"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/commit/ce8c67c314b93f570f53c2a9abc124e1e3a54715"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/openclaw/openclaw"
51+
}
52+
],
53+
"database_specific": {
54+
"cwe_ids": [
55+
"CWE-863"
56+
],
57+
"severity": "HIGH",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-03-04T18:55:19Z",
60+
"nvd_published_at": null
61+
}
62+
}

0 commit comments

Comments
 (0)