GHSA-3w6x-gv34-mqpf: OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement

March 26, 2026

Mutating internal ACP chat commands missed the operator.admin gate that should separate read-only and mutating control-plane actions.

References

github.com/advisories/GHSA-3w6x-gv34-mqpf
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/229426a257e49694a59fa4e3895861d02a4d767f
github.com/openclaw/openclaw/security/advisories/GHSA-3w6x-gv34-mqpf

Code Behaviors & Features

Detect and mitigate GHSA-3w6x-gv34-mqpf with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →