GHSA-v6x2-2qvm-6gv8: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

  • Auth-secret dual-use across security domains (gateway auth and prompt metadata hashing).
  • Hash outputs are visible to third-party model providers in system prompts.
  • No direct plaintext token disclosure.
  • Practical risk is highest when operators use weak gateway tokens and leave owner hash secret unset.

References

Code Behaviors & Features

Detect and mitigate GHSA-v6x2-2qvm-6gv8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →