GHSA-mp66-rf4f-mhh8: OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals

March 26, 2026

Google Chat app-url webhook verification accepted add-on principals outside the intended deployment binding.

References

github.com/advisories/GHSA-mp66-rf4f-mhh8
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66
github.com/openclaw/openclaw/security/advisories/GHSA-mp66-rf4f-mhh8

Code Behaviors & Features

Detect and mitigate GHSA-mp66-rf4f-mhh8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →