GHSA-pfv7-rr5m-qmv6

Suggest an improvement
Source
https://github.com/advisories/GHSA-pfv7-rr5m-qmv6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-pfv7-rr5m-qmv6/GHSA-pfv7-rr5m-qmv6.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pfv7-rr5m-qmv6
Downstream
Published
2026-03-03T21:42:27Z
Modified
2026-03-04T15:16:36.295412Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint
Details

Summary

When the optional Chrome extension relay is enabled, /extension accepted unauthenticated WebSocket upgrades while /json/* and /cdp required auth.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: <= 2026.2.17
  • Latest published npm version at triage time: 2026.2.17

Impact

This is a local-only issue on loopback (127.0.0.1) and only applies when the extension relay feature is in use. A local process on the same machine could connect to /extension without the token and interfere with extension-relay behavior.

No remote network exploit path is involved.

Fix

  • Require gateway-token auth on both /extension and /cdp relay WebSocket endpoints.
  • Keep loopback/origin checks as defense-in-depth, not as authentication.
  • Use one token path in setup: gateway.auth.token / OPENCLAW_GATEWAY_TOKEN.

Fix Commit(s)

  • 7e54b6c96feb1a5c30884f2b32037b8dadd0e532

OpenClaw thanks @tdjackey for reporting.

Database specific 
{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T21:42:27Z",
    "nvd_published_at": null
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.2.19

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-pfv7-rr5m-qmv6/GHSA-pfv7-rr5m-qmv6.json"