AI agent vulnerability · OpenClaw

GHSA-6x2m-hqfw-hvpj: OpenClaw: Node exec approvals could be replayed across nodes

mediumCVSS 4.0 6.9

Summary exec.approval requests for host=node were not explicitly bound to the target nodeId, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet. Impact An operator approval for a system.run request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.

Published Mar 2, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.2.23
Fixed in: 2026.2.23
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

exec.approval requests for host=node were not explicitly bound to the target nodeId, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.

Impact

An operator approval for a system.run request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.22-2
Fixed: 2026.2.23 (released)

Mitigation

Upgrade to 2026.2.23 or later once published.

Fix Details

The fix requires and persists nodeId for host=node approval requests and rejects execution when the approving node binding does not match the invoking node.

Fix Commit(s)

4a3f8438e527ac371a67fe7ac68a287f0dbe6063

Release Process Note

patched_versions is pre-set to the released version (2026.2.23). This advisory now reflects released fix version 2026.2.23.

OpenClaw thanks @tdjackey for reporting.

Credited to tdjackey.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries