GHSA-8mr2-f9wf-hcfq: Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback
(updated )
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v6x2-2qvm-6gv8. This link is maintained to preserve external references.
Original Description
OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset, creating dual-use of authentication secrets across security domains. Attackers with access to system prompts sent to third-party model providers can derive the gateway authentication token from the hash outputs, compromising gateway authentication security.
References
- github.com/advisories/GHSA-8mr2-f9wf-hcfq
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/c99e7696e6893083b256f0a6c88fb060f3a76fb7
- github.com/openclaw/openclaw/security/advisories/GHSA-v6x2-2qvm-6gv8
- nvd.nist.gov/vuln/detail/CVE-2026-32897
- www.vulncheck.com/advisories/openclaw-authentication-token-reuse-in-owner-id-prompt-hashing-fallback
Code Behaviors & Features
Detect and mitigate GHSA-8mr2-f9wf-hcfq with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →