https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 20:39:29 +0000 https://vulnerability.circl.lu/vuln/ghsa-6x2m-hqfw-hvpj <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary `exec.approval` requests for `host=node` were not explicitly bound to the target `nodeId`, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.</p> <p>## Impact An operator approval for a `system.run` request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.22-2` - Fixed: `2026.2.23` (released)</p> <p>## Mitigation Upgrade to `2026.2.23` or later once published.</p> <p>## Fix Details The fix requires and persists `nodeId` for `host=node` approval requests and rejects execution when the approving node binding does not match the invoking node.</p> <p>## Fix Commit(s) - 4a3f8438e527ac371a67fe7ac68a287f0dbe6063</p> <p>## Release Process Note `patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary `exec.approval` requests for `host=node` were not explicitly bound to the target `nodeId`, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.</p> <p>## Impact An operator approval for a `system.run` request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.22-2` - Fixed: `2026.2.23` (released)</p> <p>## Mitigation Upgrade to `2026.2.23` or later once published.</p> <p>## Fix Details The fix requires and persists `nodeId` for `host=node` approval requests and rejects execution when the approving node binding does not match the invoking node.</p> <p>## Fix Commit(s) - 4a3f8438e527ac371a67fe7ac68a287f0dbe6063</p> <p>## Release Process Note `patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-6x2m-hqfw-hvpj