GHSA-jr6x-2q95-fh2g: OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools

March 2, 2026

An authorization mismatch allowed authenticated callers with operator.write access to invoke owner-only tool surfaces (gateway, cron) through agent runs in scoped-token deployments.

References

github.com/advisories/GHSA-jr6x-2q95-fh2g
github.com/openclaw/openclaw
github.com/openclaw/openclaw/security/advisories/GHSA-jr6x-2q95-fh2g

Code Behaviors & Features

Detect and mitigate GHSA-jr6x-2q95-fh2g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →