GHSA-gv2f-q4wp-fvh5

Source

https://github.com/advisories/GHSA-gv2f-q4wp-fvh5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-gv2f-q4wp-fvh5/GHSA-gv2f-q4wp-fvh5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gv2f-q4wp-fvh5

Downstream

MINI-2h4g-c89r-rxvg

Withdrawn

2026-05-06T23:04:24Z

Published

2026-04-24T00:31:51Z

Modified

2026-05-06T23:19:48Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
7.4 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-3cw3-5vxw-g2h3. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints without explicit trust confirmation. Attackers can spoof discovery endpoints to redirect onboarding toward malicious gateways and capture gateway credentials or traffic.

Database specific

{
    "cwe_ids":  [
        "CWE-346"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-06T23:04:24Z",
    "nvd_published_at":  "2026-04-23T22:16:40Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2026.3.28

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-gv2f-q4wp-fvh5/GHSA-gv2f-q4wp-fvh5.json"