deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-844j-xrrq-wgh4
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection

Details:
## Summary
When gateway.trustedProxies was configured, spoofed loopback hops in forwarding headers could be accepted as the client origin and weaken downstream auth and rate-limit decisions.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `fc2d29ea926f47c428c556e92ec981441228d2a4`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- src/gateway/net.ts now ignores loopback forwarded hops before trusted-proxy client resolution.
- That shipped origin fix is the one consumed by canvas auth and gateway auth-rate-limit paths that rely on resolved client identity.

OpenClaw thanks @lintsinghua for reporting.
GitHub Security Advisory: GHSA-hf68-49fm-59cq
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve

Details:
## Summary
device.pair.approve allowed an operator.pairing approver to approve a pending device request for broader operator scopes than the approver actually held.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `fc2d29ea926f47c428c556e92ec981441228d2a4`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- src/gateway/server-methods/devices.ts now threads caller scopes into device.pair.approve.
- src/infra/device-pairing.ts now rejects requested operator scopes that exceed the approver-held operator scope set.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-mp66-rf4f-mhh8
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-290: Authentication Bypass by Spoofing, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals

Details:
## Summary
Google Chat app-url webhook verification accepted add-on principals outside the intended deployment binding.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- extensions/googlechat/src/auth.ts now requires expectedAddOnPrincipal matching for add-on principals and rejects unexpected issuers.
- extensions/googlechat/src/monitor-webhook.ts passes the configured appPrincipal into auth verification for the shipped webhook path.

OpenClaw thanks @ijxpwastaken for reporting.
GitHub Security Advisory: GHSA-xhq5-45pm-2gjr
Package: openclaw (NPM)
Severity: LOW (CVSS 4.2)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key, CWE-807: Reliance on Untrusted Inputs in a Security Decision, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens

Details:
## Summary
Nextcloud Talk room authorization matched on collidable room names instead of the stable room token, allowing policy confusion across similarly named rooms.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- extensions/nextcloud-talk/src/inbound.ts now resolves allowlist policy from roomToken-backed room identity.
- extensions/nextcloud-talk/src/policy.ts now keys room authorization on stable room tokens instead of display names.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-pw7h-9g6p-c378
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation

Details:
## Summary
Tlon settings reconciliation treated explicit empty allowlists as unset, which could silently undo an intended deny-all revocation.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `3cbf932413e41d1836cb91aed1541a28a3122f93`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- extensions/tlon/src/monitor/index.ts now honors explicit empty allowlists as authoritative deny-all configuration.
- extensions/tlon/src/monitor/settings-helpers.test.ts ships regression coverage for explicit empty settings allowlists.

Thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-vfg3-pqpq-93m4
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete

Details:
## Summary
Tlon cite expansion happened before channel and DM authorization completed, allowing cite work and content handling before the final auth decision.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `3cbf932413e41d1836cb91aed1541a28a3122f93`
- `ebee4e2210e1f282a982c7ef2ad79d77a572fc87`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- extensions/tlon/src/monitor/index.ts now defers cite expansion until after authorization and preserves explicit empty-allowlist semantics.
- extensions/tlon/src/monitor/utils.ts and extensions/tlon/src/security.test.ts ship the deferred cite expansion behavior and regressions.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-3w6x-gv34-mqpf
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement

Details:
## Summary
Mutating internal ACP chat commands missed the operator.admin gate that should separate read-only and mutating control-plane actions.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `229426a257e49694a59fa4e3895861d02a4d767f`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- src/auto-reply/reply/commands-acp.ts now requires operator.admin for mutating internal ACP actions.
- src/auto-reply/reply/commands-acp.test.ts ships regression coverage for non-admin denial and admin success cases.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-8883-9w57-vwv6
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization, CWE-696: Incorrect Behavior Order, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions

Details:
## Summary
Mattermost interactive callback dispatch could run action handlers before normal sender authorization checks completed.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- extensions/mattermost/src/mattermost/interactions.ts now requires callback authorization before dispatching actions.
- extensions/mattermost/src/mattermost/monitor.ts routes callback authorization through the same sender and allowlist policy used for normal ingress.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-ppwq-6v66-5m6j
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status

Details:
## Summary
Read-scoped gateway snapshots could expose credentials embedded in channel baseUrl and related endpoint fields.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `f0202264d0de7ad345382b9008c5963bcefb01b7`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- src/channels/account-snapshot-fields.ts now strips URL userinfo from channel status snapshot fields.
- src/config/redact-snapshot.ts now redacts credential-bearing baseUrl and httpUrl fields while preserving safe context.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-wj55-88gf-x564
Package: openclaw (NPM)
Severity: LOW (CVSS 3.7)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw may have stale policy enforcement for queued node actions

Details:
## Summary
Queued node actions were not revalidated against current command policy when later delivered, so stale allowlists or declarations could survive policy tightening.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `ec2c6d83b9f5f91d6d9094842e0f19b88e63e3e2`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- src/gateway/server-methods/nodes.ts now revalidates queued actions against the current allowlist and declared command set at delivery time.
- src/gateway/server-methods/nodes.invoke-wake.test.ts includes the shipped stale-queue regression coverage.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-39pp-xp36-q6mg
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw has Inconsistent Host Exec Environment Override Sanitization

Details:
## Summary
Gateway host exec env override handling did not consistently apply the shared host environment policy, so blocked or malformed override keys could slip through inconsistent sanitization paths.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `7abfff756d6c68d17e21d1657bbacbaec86de232`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- src/infra/host-env-security.ts now provides one shared sanitizer and fail-closed diagnostics for blocked or malformed override keys.
- src/agents/bash-tools.exec.ts and src/node-host/invoke-system-run.ts both route env overrides through the shared sanitizer before execution.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-48vw-m3qc-wr99
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths

Details:
## Summary
Trusted-proxy Control UI sessions without device identity could retain self-declared privileged scopes on the device-less allow path.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `ccf16cd[PII_REDACTED]439346ae1d23352e3707e9e`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- src/gateway/server/ws-connection/message-handler.ts now strips unbound self-declared scopes on the trusted-proxy no-device path.
- src/gateway/server/ws-connection/connect-policy.ts remains the allow path, but the shipped scope scrub prevents privilege retention without device identity.

OpenClaw thanks @nexrin for reporting.
GitHub Security Advisory: GHSA-rm59-992w-x2mv
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling

Details:
## Summary
Voice Call webhook handling buffered request bodies before provider signature checks, enabling bounded unauthenticated resource exhaustion.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `651dc7450b68a5396a009db78ef[PII_REDACTED]ead`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- extensions/voice-call/src/webhook.ts now enforces header gating and shared pre-auth body caps before reading attacker-controlled request bodies.
- extensions/voice-call/src/webhook.test.ts ships regression coverage for missing-signature, oversize, and timeout pre-auth webhook cases.

OpenClaw thanks @SEORY0 for reporting.
GitHub Security Advisory: GHSA-rvqr-hrcc-j9vv
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.6)
CWE: CWE-345: Insufficient Verification of Data Authenticity, CWE-642: External Control of Critical State Data
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

Details:
## Summary
Bonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `deecf68b59a9b7eea978e40fd3c2fe543087b569`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- src/infra/bonjour-discovery.ts now resolves and returns only concrete endpoints instead of falling back to unresolved TXT host and port hints.
- src/cli/gateway-cli/discover.ts consumes only the fail-closed resolved endpoint path.

OpenClaw thanks @nexrin for reporting.
GitHub Security Advisory: GHSA-4qwc-c7g9-4xcw
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure

Details:
## Summary
Remote media HTTP error bodies were read without a hard size cap before failure handling, allowing unbounded allocation on error responses.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `81445a901091a5d27ef0b56fceedbe[PII_REDACTED]`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- src/media/fetch.ts now routes non-2xx failures through bounded prefix reads instead of buffering the whole error body.
- src/media/read-response-with-limit.ts enforces capped reads and truncates oversized snippets before surfacing failure text.

OpenClaw thanks @YLChen-007 for reporting.
GitHub Security Advisory: GHSA-cxmw-p77q-wchg
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-940: Improper Verification of Source of a Communication Channel
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface

Details:
## Summary
Android Canvas WebView pages from untrusted origins could invoke the JavascriptInterface bridge and inject instructions into the app.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `8b02ef133275be96d8aac[PII_REDACTED]c8a7f32e5`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- apps/android/app/src/main/java/ai/openclaw/app/ui/CanvasScreen.kt now snapshots page origin and rejects untrusted bridge calls.
- apps/android/app/src/main/java/ai/openclaw/app/node/CanvasActionTrust.kt centralizes trusted origin and path validation for the bridge.

OpenClaw thanks @cyjhhh for reporting.
GitHub Security Advisory: GHSA-qm9x-v7cx-7rq4
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-706: Use of Incorrectly-Resolved Name or Reference, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper

Details:
## Summary
Allow-always exec approvals did not unwrap /usr/bin/time, so an unregistered time wrapper could bypass executable binding and reuse approval state for the inner command.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `39409b6a6dd4239deea682e626bac9ba547bfb14`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- src/infra/dispatch-wrapper-resolution.ts now unwraps /usr/bin/time and binds approvals to the real inner executable.
- src/infra/exec-approvals-allow-always.test.ts ships regression coverage for time-wrapper allow-always approval bypasses.

OpenClaw thanks @YLChen-007 for reporting.
GitHub Security Advisory: GHSA-65h8-27jh-q8wv
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement

Details:
## Summary
Nostr inbound DM handling could perform crypto and dispatch work before sender and pairing policy enforcement, enabling unauthorized pre-auth computation.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `1ee9611079e81b9122f4bed01abb3d9f56206c77`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- extensions/nostr/src/channel.ts now performs authorization before decrypting and dispatching inbound DM content.
- extensions/nostr/src/nostr-bus.ts adds pre-crypto authorization, size, and rate guardrails before expensive decrypt work.

OpenClaw thanks @kuranikaran for reporting.
GitHub Security Advisory: GHSA-wv46-v6xc-2qhf
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key, CWE-706: Use of Incorrectly-Resolved Name or Reference, CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.

Details:
## Summary
Synology Chat reply delivery could rebind to a mutable username match instead of the stable numeric user_id recorded by the webhook event.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)
- Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s)
- `7ade3553b74ee3f461c4acd216653d5ba411f455`

## Release Status
The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation
- extensions/synology-chat/src/webhook-handler.ts now keeps replies bound to the stable webhook user identifier unless an explicit dangerous opt-in is enabled.
- extensions/synology-chat/src/config-schema.ts contains the explicit dangerous opt-in seam instead of silent username rebinding.

OpenClaw thanks @nexrin for reporting.