GHSA-2xcp-x87w-q377: OpenClaw: Hook mapping templates could bypass hook session-key opt-in

April 25, 2026

Templated hook mapping sessionKey values were treated differently from request-supplied session keys. A hook mapping could render an externally influenced session key even when hooks.allowRequestSessionKey was disabled, bypassing the intended routing opt-in for hook callers.

This affects webhook routing isolation. It does not grant host execution by itself. Severity is medium.

References

github.com/advisories/GHSA-2xcp-x87w-q377
github.com/openclaw/openclaw/commit/5275d008ed33203dba3f98e969ad683a65c416c3
github.com/openclaw/openclaw/security/advisories/GHSA-2xcp-x87w-q377

Code Behaviors & Features

Detect and mitigate GHSA-2xcp-x87w-q377 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →