GHSA-cwj3-vqpp-pmxr

Source

https://github.com/advisories/GHSA-cwj3-vqpp-pmxr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-cwj3-vqpp-pmxr/GHSA-cwj3-vqpp-pmxr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cwj3-vqpp-pmxr

Downstream

MINI-gw68-wwg9-4rj4

Published

2026-05-05T18:44:31Z

Modified

2026-05-05T19:01:21.760109Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

Details

Summary

The agent-facing gateway tool protects config.apply and config.patch with a model-to-operator trust boundary. That guard used a hand-maintained denylist of protected config paths. The config schema outgrew that denylist, leaving sensitive subtrees writable through model-driven gateway config mutations.

Impact

A prompt-injected or otherwise compromised model running with access to the owner-only gateway tool could persist unsafe config changes that crossed security boundaries. Examples included config paths affecting command execution, network/proxy/TLS behavior, credential forwarding, telemetry or hook endpoints, memory/indexing surfaces, and operator policy controls. These changes could survive restart once written to config.

Affected Packages / Versions

Package: openclaw on npm
Affected: versions before 2026.4.23
Fixed: 2026.4.23
Latest stable verified fixed: openclaw@2026.4.23, tag v2026.4.23

Fix

OpenClaw replaced the denylist with a fail-closed allowlist. Agent-driven gateway config.apply and gateway config.patch now permit only narrow agent-tunable prompt/model settings and mention-gating paths. Other config changes are rejected before the gateway mutation RPC is invoked.

Fix Commit(s)

bceda6089aa7b3695cc7696b43c61ae3d01bb0ec (fix(gateway): fail closed on runtime config edits)

Severity

Severity remains high. The vulnerable entry point is owner-only, but the model/agent is not a trusted principal under OpenClaw's security model, and the guard is the explicit model-to-operator boundary for persisted config mutation.

Database specific

{
    "github_reviewed_at": "2026-05-05T18:44:31Z",
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-862"
    ],
    "severity": "HIGH",
    "github_reviewed": true
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2026.4.23

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-cwj3-vqpp-pmxr/GHSA-cwj3-vqpp-pmxr.json"