deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wwc3-c577-533m
Package: openclaw (NPM)
Severity: LOW (CVSS 5.4)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rfqg-qgf8-xr9x. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.
GitHub Security Advisory: GHSA-7vq9-42cc-33j4
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xj9w-5r6q-x6v4. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.
GitHub Security Advisory: GHSA-mf69-r24q-ghhr
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-799: Improper Control of Interaction Frequency
Vulnerable versions: >= 2026.2.26, < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: Pairing pending-request caps were enforced per channel instead of per account

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-wwfp-w96m-c6x8. This link is maintained to preserve external references.

### Original Description
OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing challenges on unaffected accounts, causing denial of service.
GitHub Security Advisory: GHSA-m958-864j-xq5w
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-294: Authentication Bypass by Capture-replay
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-37v6-fxx8-xjmx. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 contains a replay detection bypass vulnerability in webhook signature handling that treats Base64 and Base64URL encoded signatures as distinct requests. Attackers can re-encode Telnyx webhook signatures to bypass replay detection while maintaining valid signature verification.
GitHub Security Advisory: GHSA-qgp3-3rj7-qqq4
Package: openclaw (NPM)
Severity: LOW (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rvvf-6vh3-9j43. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths that fail to enforce group DM channel allowlist restrictions. Authorized Discord users can bypass channel restrictions by invoking slash commands, allowing access to restricted group DM channels.
GitHub Security Advisory: GHSA-2xp4-qhr4-xqm2
Package: openclaw (NPM)
Severity: LOW (CVSS 7.1)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-mhr7-2xmv-4c4q. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a browser in trusted-proxy deployments to perform unauthorized actions on HTTP operator endpoints.
GitHub Security Advisory: GHSA-2hv5-4h3g-4hjv
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-799: Improper Control of Interaction Frequency
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6336-qqw9-v6x6. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient availability loss. Remote attackers can flood the webhook endpoint with concurrent requests before signature verification to exhaust resources and degrade service availability.
GitHub Security Advisory: GHSA-r7p2-r9g4-4xph
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Vulnerable versions: < 2026.4.2
Patched in: 2026.4.2

Summary: Duplicate Advisory: OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-2f7j-rp58-mr42. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. Non-admin clients can recover host-specific filesystem paths and deployment details, enabling host fingerprinting and facilitating chained attacks.
GitHub Security Advisory: GHSA-cw28-63x4-37c3
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-89r3-6x4j-v7wf. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback origin before replay rejection. Attackers with captured valid callbacks for live calls can exploit this to manipulate callback origins during the replay process.
GitHub Security Advisory: GHSA-wcm7-94wg-h74h
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6p8r-6m93-557f. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files to execute untrusted code or load malicious credentials.
GitHub Security Advisory: GHSA-jx3c-247h-cxwp
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.8)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3qpv-xf3v-mm45. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling loading of attacker-controlled hook code. Attackers can replace trusted default-on bundled hooks from untrusted workspaces to execute arbitrary code.
GitHub Security Advisory: GHSA-fjm8-mgc9-mf65
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-hr8g-2q7x-3f4w. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Control UI bootstrap payload to identify system versions and agent configurations.
GitHub Security Advisory: GHSA-pr66-whqj-rq5p
Package: openclaw (NPM)
Severity: LOW (CVSS 5.4)
CWE: CWE-351: Insufficient Type Distinction
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6336-qqw9-v6x6. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as direct messages in extensions/discord/src/monitor/agent-components-helpers.ts. Attackers can exploit this misclassification to bypass group DM policy enforcement or trigger incorrect session handling.
GitHub Security Advisory: GHSA-93rg-2xm5-2p9v
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: <= 2026.4.21
Patched in: 2026.4.22

Summary: OpenClaw's Gateway Control UI bootstrap config required Gateway auth

Details:
## Summary
Gateway Control UI bootstrap config required Gateway auth.

## Affected Packages / Versions
- Package: openclaw (npm)
- Affected versions: <= 2026.4.21
- Fixed version: 2026.4.22

## Impact
When Gateway authentication was enabled, the Control UI bootstrap config endpoint could still be read without a valid Gateway token. That response could expose sensitive bootstrap/config fields intended only for authenticated Control UI sessions.

## Fix
The bootstrap config route now goes through the same Gateway read-auth path as other authenticated Control UI reads. Regression tests cover unauthenticated rejection, valid-token access, and basePath handling.

## Fix Commit(s)
- 2321d67263bc710e357644d59f746b08d891051b

## Verification
- The fix commit is contained in the public v2026.4.22 tag.
- openclaw@2026.4.22 is published on npm and the compiled package contains the fix.
- Focused regression coverage for this path passed before publication.

OpenClaw thanks @zsxsoft for reporting.
GitHub Security Advisory: GHSA-5h3g-6xhh-rg6p
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: <= 2026.4.21
Patched in: 2026.4.22

Summary: OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

Details:
## Summary
OpenShell FS bridge reads pin and verify the opened file before returning bytes

## Affected Packages / Versions
- Package: openclaw (npm)
- Affected versions: <= 2026.4.21
- Fixed version: 2026.4.22

## Impact
A time-of-check/time-of-use race around OpenShell sandbox filesystem reads could let a symlink swap cause bytes outside the intended mount root to be read.

## Fix
OpenShell reads now open the file with no-follow semantics where available, validate the pinned file descriptor against the canonical mount root, reject unsafe hardlink/symlink cases, and use a strict fallback ancestor walk on platforms without fd-path readback.

## Fix Commit(s)
- 95119017c847c737bd113f0bff728c4666d79c45

## Verification
- The fix commit is contained in the public v2026.4.22 tag.
- openclaw@2026.4.22 is published on npm and the compiled package contains the fix.
- Focused regression coverage for this path passed before publication.

OpenClaw thanks @VladimirEliTokarev for reporting.
GitHub Security Advisory: GHSA-qgx9-6px9-7p75
Package: openclaw (NPM)
Severity: LOW (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: Duplicate Advisory: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v8qf-fr4g-28p2. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.read scope to access protected assistant-media files and metadata. Attackers can bypass identity-bearing HTTP auth path scope validation to retrieve sensitive media content within allowed media roots.
GitHub Security Advisory: GHSA-wppj-c6mr-83jj
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: <= 2026.4.21
Patched in: 2026.4.22

Summary: OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root

Details:
## Summary
OpenShell FS bridge writes stay pinned to the sandbox mount root.

## Affected Packages / Versions
- Package: openclaw (npm)
- Affected versions: <= 2026.4.21
- Fixed version: 2026.4.22

## Impact
A time-of-check/time-of-use race around OpenShell sandbox filesystem writes could let a symlink swap redirect a write outside the intended local mount root.

## Fix
OpenShell write paths now validate the canonical target against the mount root, reject unsafe symlink parents and symlink leaves for writes, and use root-scoped write helpers before syncing to the remote sandbox.

## Fix Commit(s)
- 7be82d4fd1193bcb7e44ee38838f00bf924ffa76

## Verification
- The fix commit is contained in the public v2026.4.22 tag.
- openclaw@2026.4.22 is published on npm and the compiled package contains the fix.
- Focused regression coverage for this path passed before publication.

OpenClaw thanks @VladimirEliTokarev for reporting.
GitHub Security Advisory: GHSA-vmfm-ch9h-5c7g
Package: signalk-server (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: <= 2.24.0
Patched in: 2.25.0

Summary: Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

Details:
## Summary

The HTTP login endpoints (`POST /login` and `POST /signalk/v1/auth/login`) are protected by `express-rate-limit` (default: 100 attempts per 10-minute window, configurable via `HTTP_RATE_LIMITS`). The WebSocket login path — sending `{login: {username, password}}` messages over an established WebSocket connection — calls `app.securityStrategy.login()` directly without any rate limiting.

An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds).

## Details

**Vulnerable code:** `src/interfaces/ws.ts`, function `processLoginRequest` (lines 753-780)

The function directly calls `app.securityStrategy.login(msg.login.username, msg.login.password)` with no throttling or attempt tracking.

**Rate-limited HTTP path for comparison:** `src/tokensecurity.ts` lines 609-617 apply `loginLimiter` middleware to the HTTP login routes at line 637.

## Steps to Reproduce

1. Start Signal K server with security enabled
2. Open a WebSocket connection to `ws://server:3000/signalk/v1/stream?subscribe=none`
3. Wait for the hello message
4. Send login attempts in rapid succession:
   ```json
   {"requestId": "1", "login": {"username": "admin", "password": "guess1"}}
   {"requestId": "2", "login": {"username": "admin", "password": "guess2"}}
   ```
5. Observe that all attempts are processed without any 429 response or throttling
6. For comparison, send 100+ HTTP POST requests to `/signalk/v1/auth/login` — the 101st returns 429

A POC script is available that demonstrates both the HTTP rate limiting working correctly and the WebSocket path accepting unlimited attempts.

## Impact

- Credential brute-forcing via the WebSocket protocol at ~20 attempts/sec (bcrypt-limited)
- Complete bypass of the HTTP rate limiting defense
- A single WebSocket connection is sufficient for unlimited attempts
- With multiple parallel connections, throughput multiplies
- A 10,000-word dictionary attack completes in ~8 minutes over a single connection

Signal K servers are commonly deployed on boat networks where they may be accessible to other devices on the same LAN.

## CWE

CWE-307: Improper Restriction of Excessive Authentication Attempts

## Suggested Fix

Track failed login attempts per remote IP in a shared store (or reuse the existing express-rate-limit store) that is checked in both the HTTP login middleware and the processLoginRequest WebSocket handler.

## Context

Found while building an open source maritime security scanner. Verified on v2.24.0 (current master).

Discovered by Mark Curphey
GitHub Security Advisory: GHSA-x3h8-jrgh-p8jx
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 2026.4.21
Patched in: 2026.4.22

Summary: OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs

Details:
## Summary
Exec allowlist analysis rejects shell expansion in unquoted heredocs.

## Affected Packages / Versions
- Package: openclaw (npm)
- Affected versions: <= 2026.4.21
- Fixed version: 2026.4.22

## Impact
An allowlisted command containing an unquoted heredoc could hide shell expansion in the heredoc body. That could make the approved command text look safer than what the shell would evaluate at runtime.

## Fix
The exec command analyzer now tracks heredoc bodies, rejects unquoted heredoc expansion tokens and continuation-splice bypasses, and preserves quoted heredocs and literal safe text.

## Fix Commit(s)
- b2e8b7d4bb2f22eaa16f5c4b07547774e90b65a5

## Verification
- The fix commit is contained in the public v2026.4.22 tag.
- openclaw@2026.4.22 is published on npm and the compiled package contains the fix.
- Focused regression coverage for this path passed before publication.

OpenClaw thanks @VladimirEliTokarev for reporting.
GitHub Security Advisory: GHSA-r6xh-pqhr-v4xh
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 2026.4.21
Patched in: 2026.4.22

Summary: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

Details:
## Summary
MCP loopback owner context is derived from server-issued bearer tokens.

## Affected Packages / Versions
- Package: openclaw (npm)
- Affected versions: <= 2026.4.21
- Fixed version: 2026.4.22

## Impact
The loopback MCP path accepted spoofable owner-context metadata from request headers, which could allow a non-owner loopback client to present itself as owner for owner-gated operations.

## Fix
The MCP loopback runtime now issues separate owner and non-owner bearer tokens and derives senderIsOwner exclusively from which token authenticated the request. The spoofable sender-owner header is no longer emitted or trusted.

## Fix Commit(s)
- 3cb1a56bfc9579a0f2336f9cfa12a8a744332a19

## Verification
- The fix commit is contained in the public v2026.4.22 tag.
- openclaw@2026.4.22 is published on npm and the compiled package contains the fix.
- Focused regression coverage for this path passed before publication.

OpenClaw thanks @VladimirEliTokarev for reporting.
GitHub Security Advisory: GHSA-55cf-xx38-4p9p
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-427: Uncontrolled Search Path Element, CWE-610: Externally Controlled Reference to a Resource in Another Sphere
Vulnerable versions: <= 2026.4.21
Patched in: 2026.4.22

Summary: OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

Details:
## Summary
Workspace dotenv files cannot override connector endpoint hosts.

## Affected Packages / Versions
- Package: openclaw (npm)
- Affected versions: <= 2026.4.21
- Fixed version: 2026.4.22

## Impact
A workspace .env file could set connector endpoint variables for Matrix, Mattermost, IRC, or Synology-related connectors and redirect runtime traffic away from the operator-configured endpoint.

## Fix
Workspace .env loading now blocks those endpoint variables, including per-account Matrix homeserver suffixes and generic base-url/API-host style overrides. Trusted global runtime dotenv loading remains separate.

## Fix Commit(s)
- 0623079e98abf7202591f1b04a89755eb7ec9272

## Verification
- The fix commit is contained in the public v2026.4.22 tag.
- openclaw@2026.4.22 is published on npm and the compiled package contains the fix.
- Focused regression coverage for this path passed before publication.

OpenClaw thanks @qi-scape for reporting.
GitHub Security Advisory: GHSA-q3jj-46pq-826r
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-277: Insecure Inherited Permissions
Vulnerable versions: <= 2026.4.21
Patched in: 2026.4.22

Summary: OpenClaw's ACP child sessions inherit subagent security envelope constraints

Details:
## Summary
ACP child sessions inherit subagent security envelope constraints.

## Affected Packages / Versions
- Package: openclaw (npm)
- Affected versions: <= 2026.4.21
- Fixed version: 2026.4.22

## Impact
A restricted subagent spawning an ACP child session could fail to carry forward subagent-only constraints such as depth, child-count limits, control scope, or target-agent restrictions.

## Fix
ACP spawn now resolves and persists child subagent envelope fields, enforces maximum depth and active-child caps, and applies the inherited control scope to child ACP sessions.

## Fix Commit(s)
- 31160dc069b7cc5d833b39c53736a41ad3befda2

## Verification
- The fix commit is contained in the public v2026.4.22 tag.
- openclaw@2026.4.22 is published on npm and the compiled package contains the fix.
- Focused regression coverage for this path passed before publication.

OpenClaw thanks @zsxsoft, @qclawer, and @KeenSecurityLab for reporting.