GHSA-6x2m-hqfw-hvpj: OpenClaw: Node exec approvals could be replayed across nodes

March 2, 2026

exec.approval requests for host=node were not explicitly bound to the target nodeId, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.

References

github.com/advisories/GHSA-6x2m-hqfw-hvpj
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/4a3f8438e527ac371a67fe7ac68a287f0dbe6063
github.com/openclaw/openclaw/security/advisories/GHSA-6x2m-hqfw-hvpj

Code Behaviors & Features

Detect and mitigate GHSA-6x2m-hqfw-hvpj with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →