GHSA-r7vr-gr74-94p8: OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces

OpenClaw documented /config and /debug as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces.

References

Code Behaviors & Features

Detect and mitigate GHSA-r7vr-gr74-94p8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →