GHSA-wpg9-4g4v-f9rc

Suggest an improvement
Source
https://github.com/advisories/GHSA-wpg9-4g4v-f9rc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-wpg9-4g4v-f9rc/GHSA-wpg9-4g4v-f9rc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wpg9-4g4v-f9rc
Aliases
Downstream
Published
2026-03-03T21:32:25Z
Modified
2026-05-05T15:58:40Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L CVSS Calculator
  • 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels
Details

Summary

In openclaw@2026.3.1, the Discord voice transcript path called agentCommand(...) without senderIsOwner, and agentCommand defaults missing senderIsOwner to true.

This could allow a non-owner voice participant in the same channel to reach owner-only tool surfaces (gateway, cron) during voice transcript turns.

Security model note

OpenClaw’s documented trust model is a personal assistant model (one trusted operator), not an adversarial multi-user boundary.

  • OpenClaw does not treat one shared gateway/chat surface as a hardened per-user auth boundary.
  • Mixed-trust deployments (mutually untrusted users sharing one gateway/channel) are outside recommended deployment boundaries.

This report is treated as a valid hardening/authorization bug because owner-only tool policy should still be applied consistently across chat-driven turns, including Discord voice transcript ingress.

Details

Relevant path:

  1. Voice transcript run omitted senderIsOwner in Discord voice manager.
  2. Missing senderIsOwner defaulted to true in agentCommand.
  3. Owner-only tool policy is keyed on senderIsOwner.
  4. gateway and cron are owner-only tools.

Impact

  • Affects deployments where Discord voice is enabled and the bot is present in channels with non-owner participants.
  • No gateway-auth boundary bypass was required.
  • Practical risk depends strongly on whether the deployment is single-trust (recommended) or mixed-trust (not recommended).

Severity rationale

Downgraded from high to medium to align with OpenClaw’s trust model and deployment assumptions:

  • Requires participation in the same voice environment as the trusted operator workflow.
  • Requires Discord voice path conditions (joined voice channel + transcript flow).
  • Does not introduce a new cross-gateway or unauthenticated boundary bypass.

Remediation

  • Always pass explicit senderIsOwner from Discord voice transcript ingress.
  • Fail closed (false) when owner status is unknown for non-local/chat ingress paths.
  • Keep regression tests that verify owner/non-owner voice speaker handling.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.3.1
  • Patched versions: >= 2026.3.2 (released)
Database specific 
{
    "cwe_ids":  [
        "CWE-269",
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-03T21:32:25Z",
    "nvd_published_at":  "2026-03-19T22:16:39Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2026.3.2

Database specific

last_known_affected_version_range 
"<= 2026.3.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-wpg9-4g4v-f9rc/GHSA-wpg9-4g4v-f9rc.json"