GHSA-6x2m-hqfw-hvpj
GHSA-6x2m-hqfw-hvpj · OpenClaw: Node exec approvals could be replayed across nodes
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
## Summary `exec.approval` requests for `host=node` were not explicitly bound to the target `nodeId`, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet. ## Impact An operator approval for a `system.run` request could be reused across nodes if the request payload did not carry node identity through approval and execution checks. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `<= 2026.2.22-2` - Fixed: `2026.2.23` (released) ## Mitigation Upgrade to `2026.2.23` or later once published. ## Fix Details The fix requires and persists `nodeId` for `host=node` approval requests and rejects execution when the approving node binding does not match the invoking node. ## Fix Commit(s) - 4a3f8438e527ac371a67fe7ac68a287f0dbe6063 ## Release Process Note `patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`. OpenClaw thanks @tdjackey for reporting.
CVSS 6.9 · Media · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
openclaw npm
- Intervalos de versiones afectados
- SEMVER: < 2026.2.23
Actualiza a 2026.2.23