GHSA-2f7j-rp58-mr42: OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

April 7, 2026

Before OpenClaw 2026.4.2, the Gateway connect success snapshot exposed local configPath and stateDir metadata to non-admin clients. Low-privilege authenticated clients could learn host filesystem layout and deployment details that were not needed for their role.

References

github.com/advisories/GHSA-2f7j-rp58-mr42
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/676b748056b5efca6f1255708e9dd9469edf5e2e
github.com/openclaw/openclaw/security/advisories/GHSA-2f7j-rp58-mr42

Code Behaviors & Features

Detect and mitigate GHSA-2f7j-rp58-mr42 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →