Skip to content

Commit 676a0da

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3fqr-4cg8-h96q GHSA-c37p-4qqg-3p76 GHSA-h89v-j3x9-8wqj GHSA-mj5r-hh7j-4gxf GHSA-pg2v-8xwh-qhcc GHSA-q447-rj3r-2cgh GHSA-rq6g-px6m-c248 GHSA-w2cg-vxx6-5xjg
1 parent acf99cc commit 676a0da

8 files changed

Lines changed: 622 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/02/GHSA-3fqr-4cg8-h96q/GHSA-3fqr-4cg8-h96q.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3fqr-4cg8-h96q",
4+
"modified": "2026-02-18T00:53:59Z",
5+
"published": "2026-02-18T00:53:59Z",
6+
"aliases": [
7+
"CVE-2026-26317"
8+
],
9+
"summary": "OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints",
10+
"details": "## Summary\nBrowser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins.\n\n## Impact\nA malicious website can trigger unauthorized state changes against a victim's local OpenClaw browser control plane (for example opening tabs, starting/stopping the browser, mutating storage/cookies) if the browser control service is reachable on loopback in the victim's browser context.\n\n## Affected Packages / Versions\n- openclaw (npm): <= 2026.2.13\n- clawdbot (npm): <= 2026.1.24-3\n\n## Details\nThe browser control servers bind to loopback but exposed mutating HTTP endpoints without a CSRF-style guard. Browsers may send cross-origin requests to loopback addresses; without explicit validation, state-changing operations could be triggered from a non-loopback Origin/Referer.\n\n## Fix\nMutating HTTP methods (POST/PUT/PATCH/DELETE) are rejected when the request indicates a non-loopback Origin/Referer (or `Sec-Fetch-Site: cross-site`).\n\n## Fix Commit(s)\n- openclaw/openclaw: b566b09f81e2b704bf9398d8d97d5f7a90aa94c3\n\n## Workarounds / Mitigations\n- Enable browser control auth (token/password) and avoid running with auth disabled.\n- Upgrade to a release that includes the fix.\n\n## Credits\n- Reporter: @vincentkoc\n\n## Release Process Note\n`patched_versions` is set to the planned next release version. Once that npm release is published, the advisory should be ready to publish with no further edits.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "openclaw"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2026.2.14"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "clawdbot"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"last_affected": "2026.1.24-3"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-3fqr-4cg8-h96q"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/openclaw/openclaw/commit/b566b09f81e2b704bf9398d8d97d5f7a90aa94c3"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/openclaw/openclaw"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-352"
78+
],
79+
"severity": "HIGH",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-02-18T00:53:59Z",
82+
"nvd_published_at": null
83+
}
84+
}

‎advisories/github-reviewed/2026/02/GHSA-c37p-4qqg-3p76/GHSA-c37p-4qqg-3p76.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c37p-4qqg-3p76",
4+
"modified": "2026-02-18T00:54:48Z",
5+
"published": "2026-02-18T00:54:48Z",
6+
"aliases": [],
7+
"summary": "OpenClaw Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled",
8+
"details": "## Summary\n\nA Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled.\n\n## Impact\n\nThis issue is limited to configurations that explicitly enable and expose the voice-call webhook endpoint.\n\nNot affected by default:\n- The voice-call extension is optional and disabled by default.\n- The bypass only applied when `tunnel.allowNgrokFreeTierLoopbackBypass` was explicitly enabled.\n- Exploitation required the webhook to be reachable (typically via a public ngrok URL during development).\n\nWorst case (when exposed and the option was enabled):\n- An external attacker could send forged requests to the publicly reachable webhook endpoint that would be accepted without a valid `X-Twilio-Signature`.\n- This could result in unauthorized webhook event handling (integrity) and request flooding (availability).\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.2.13` (latest published as of 2026-02-14)\n- Patched versions: `>= 2026.2.14` (planned next release; pending publish)\n\n## Fix\n\n`allowNgrokFreeTierLoopbackBypass` no longer bypasses signature verification. It only enables trusting forwarded headers on loopback so the public ngrok URL can be reconstructed for correct signature validation.\n\nFix commit(s):\n- ff11d8793b90c52f8d84dae3fbb99307da51b5c9\n\nThanks @p80n-sec for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.2.14"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-c37p-4qqg-3p76"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/openclaw/openclaw/commit/ff11d8793b90c52f8d84dae3fbb99307da51b5c9"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/openclaw/openclaw"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-306"
57+
],
58+
"severity": "MODERATE",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-02-18T00:54:48Z",
61+
"nvd_published_at": null
62+
}
63+
}

‎advisories/github-reviewed/2026/02/GHSA-h89v-j3x9-8wqj/GHSA-h89v-j3x9-8wqj.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h89v-j3x9-8wqj",
4+
"modified": "2026-02-18T00:52:54Z",
5+
"published": "2026-02-18T00:52:54Z",
6+
"aliases": [],
7+
"summary": "OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)",
8+
"details": "## Summary\nArchive extraction lacked strict resource budgets, allowing high-expansion ZIP/TAR archives to consume excessive CPU/memory/disk during install/update flows.\n\n## Affected Packages / Versions\n- openclaw (npm): <= 2026.2.13\n- clawdbot (npm): <= 2026.1.24-3\n\n## Details\nAffected component: `src/infra/archive.ts` (`extractArchive`).\n\nThe extractor now enforces resource budgets (entry count and extracted byte limits; ZIP also enforces a compressed archive size limit) and rejects over-budget archives.\n\n## Fix Commit(s)\n- openclaw/openclaw@d3ee5deb87ee2ad0ab83c92c365611165423cb71\n- openclaw/openclaw@5f4b29145c236d124524c2c9af0f8acd048fbdea\n\n## Release Process Note\nThis advisory will be updated with patched versions once the next npm release containing the fix is published.\n\n## Credits\nThanks @vincentkoc for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.2.14"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "npm",
38+
"name": "clawdbot"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "0"
46+
},
47+
{
48+
"last_affected": "2026.1.24-3"
49+
}
50+
]
51+
}
52+
]
53+
}
54+
],
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-h89v-j3x9-8wqj"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/openclaw/openclaw/commit/5f4b29145c236d124524c2c9af0f8acd048fbdea"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/openclaw/openclaw/commit/d3ee5deb87ee2ad0ab83c92c365611165423cb71"
67+
},
68+
{
69+
"type": "PACKAGE",
70+
"url": "https://github.com/openclaw/openclaw"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
75+
}
76+
],
77+
"database_specific": {
78+
"cwe_ids": [
79+
"CWE-400"
80+
],
81+
"severity": "MODERATE",
82+
"github_reviewed": true,
83+
"github_reviewed_at": "2026-02-18T00:52:54Z",
84+
"nvd_published_at": null
85+
}
86+
}

‎advisories/github-reviewed/2026/02/GHSA-mj5r-hh7j-4gxf/GHSA-mj5r-hh7j-4gxf.json‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mj5r-hh7j-4gxf",
4+
"modified": "2026-02-18T00:54:32Z",
5+
"published": "2026-02-18T00:54:32Z",
6+
"aliases": [],
7+
"summary": "OpenClaw Telegram allowlist authorization accepted mutable usernames",
8+
"details": "## Summary\nTelegram allowlist authorization could match on `@username` (mutable/recyclable) instead of immutable numeric sender IDs.\n\n## Impact\nOperators who treat Telegram allowlists as strict identity controls could unintentionally grant access if a username changes hands (identity rebinding/spoof risk). This can allow an unauthorized sender to interact with the bot in allowlist mode.\n\n## Affected Packages / Versions\n- npm `openclaw`: <= 2026.2.13\n- npm `clawdbot`: <= 2026.1.24-3\n\n## Fix\nTelegram allowlist authorization now requires numeric Telegram sender IDs only. `@username` allowlist principals are rejected.\n\nA security audit warning was added to flag legacy configs that still contain non-numeric Telegram allowlist entries.\n\n`openclaw doctor --fix` now attempts to resolve `@username` allowFrom entries to numeric IDs (best-effort; requires a Telegram bot token).\n\n## Fix Commit(s)\n- e3b432e481a96b8fd41b91273818e514074e05c3\n- 9e147f00b48e63e7be6964e0e2a97f2980854128\n\nThanks @vincentkoc for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.2.14"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "npm",
38+
"name": "clawdbot"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "0"
46+
},
47+
{
48+
"last_affected": "2026.1.24-3"
49+
}
50+
]
51+
}
52+
]
53+
}
54+
],
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-mj5r-hh7j-4gxf"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/openclaw/openclaw/commit/9e147f00b48e63e7be6964e0e2a97f2980854128"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/openclaw/openclaw/commit/e3b432e481a96b8fd41b91273818e514074e05c3"
67+
},
68+
{
69+
"type": "PACKAGE",
70+
"url": "https://github.com/openclaw/openclaw"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
75+
}
76+
],
77+
"database_specific": {
78+
"cwe_ids": [
79+
"CWE-284",
80+
"CWE-290"
81+
],
82+
"severity": "MODERATE",
83+
"github_reviewed": true,
84+
"github_reviewed_at": "2026-02-18T00:54:32Z",
85+
"nvd_published_at": null
86+
}
87+
}

‎advisories/github-reviewed/2026/02/GHSA-pg2v-8xwh-qhcc/GHSA-pg2v-8xwh-qhcc.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pg2v-8xwh-qhcc",
4+
"modified": "2026-02-18T00:55:00Z",
5+
"published": "2026-02-18T00:55:00Z",
6+
"aliases": [],
7+
"summary": "OpenClaw affected by SSRF in optional Tlon (Urbit) extension authentication",
8+
"details": "## Summary\nThe optional Tlon (Urbit) extension previously accepted a user-provided base URL for authentication and used it to construct an outbound HTTP request, enabling server-side request forgery (SSRF) in affected deployments.\n\n## Impact\nThis only affects deployments that have installed and configured the Tlon (Urbit) extension, and where an attacker can influence the configured Urbit URL. Under those conditions, the gateway could be induced to make HTTP requests to attacker-chosen hosts (including internal addresses).\n\nDeployments that do not use the Tlon extension, or where untrusted users cannot change the Urbit URL, are not impacted.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.2.13`\n\n## Fixed Versions\n- `2026.2.14` (planned next release)\n\n## Fix Commit(s)\n- `bfa7d21e997baa8e3437657d59b1e296815cc1b1`\n\n## Details\nUrbit authentication now validates and normalizes the base URL and uses an SSRF guard that blocks private/internal hosts by default (opt-in: `channels.tlon.allowPrivateNetwork`).\n\n## Release Process Note\nThis advisory is pre-populated with the planned patched version (`2026.2.14`). After `openclaw@2026.2.14` is published to npm, publish this advisory without further edits.\n\nThanks @p80n-sec for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.2.14"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-pg2v-8xwh-qhcc"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/openclaw/openclaw/commit/bfa7d21e997baa8e3437657d59b1e296815cc1b1"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/openclaw/openclaw"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-918"
57+
],
58+
"severity": "MODERATE",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-02-18T00:55:00Z",
61+
"nvd_published_at": null
62+
}
63+
}

0 commit comments

Comments
 (0)