GHSA-r65x-2hqr-j5hf: OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy

March 3, 2026

A paired node device could reconnect with spoofed platform/deviceFamily metadata and broaden node command policy eligibility because reconnect metadata was accepted from the client while these fields were not bound into the device-auth signature.

References

github.com/advisories/GHSA-r65x-2hqr-j5hf
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/7d8aeaaf06e2e616545d2c2cec7fa27f36b59b6a
github.com/openclaw/openclaw/security/advisories/GHSA-r65x-2hqr-j5hf

Code Behaviors & Features

Detect and mitigate GHSA-r65x-2hqr-j5hf with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →