GHSA-rv2q-f2h5-6xmg: OpenClaw's Node role device-identity bypass allows unauthorized node.event injection

March 3, 2026

A client authenticated with a shared gateway token could connect as role=node without device identity/pairing, then call node.event to trigger agent.request and voice.transcript flows.

References

github.com/advisories/GHSA-rv2q-f2h5-6xmg
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/ddcb2d79b17bf2a42c5037d8aeff1537a12b931e
github.com/openclaw/openclaw/security/advisories/GHSA-rv2q-f2h5-6xmg

Code Behaviors & Features

Detect and mitigate GHSA-rv2q-f2h5-6xmg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →