GHSA-6xg4-82hv-cp6f: OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing

March 31, 2026

ACP-only provenance fields in chat.send were gated by self-declared client metadata from the WebSocket handshake rather than verified authorization state.

References

github.com/advisories/GHSA-6xg4-82hv-cp6f
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/4b9542716c26ac77652bcaa0f562043b298b409f
github.com/openclaw/openclaw/security/advisories/GHSA-6xg4-82hv-cp6f

Code Behaviors & Features

Detect and mitigate GHSA-6xg4-82hv-cp6f with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →