GHSA-8jhh-jcqg-mj5p: OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions

March 13, 2026

In affected versions of openclaw, channel-initiated config mutations were authorized against the originating account’s configWrites policy but did not consistently re-check the targeted account scope. An authorized sender on one account could mutate protected sibling-account configuration when the target account had configWrites: false.

References

github.com/advisories/GHSA-8jhh-jcqg-mj5p
github.com/openclaw/openclaw
github.com/openclaw/openclaw/releases/tag/v2026.3.11
github.com/openclaw/openclaw/security/advisories/GHSA-8jhh-jcqg-mj5p

Code Behaviors & Features

Detect and mitigate GHSA-8jhh-jcqg-mj5p with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →