https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 02:50:08 +0000 https://db.gcve.eu/vuln/cve-2026-28473 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending the /approve chat command. The /approve command path invokes exec.approval.resolve through an internal privileged gateway client, bypassing the operator.approvals permission check that protects direct RPC calls.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending the /approve chat command. The /approve command path invokes exec.approval.resolve through an internal privileged gateway client, bypassing the operator.approvals permission check that protects direct RPC calls.</p> https://db.gcve.eu/vuln/cve-2026-28473 https://db.gcve.eu/vuln/ghsa-mqpw-46fh-299h <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>### What this means (plain language)</p> <p>If you give a client “chat/write” access to the gateway (`operator.write`) but you do not intend to let that client approve exec requests (`operator.approvals`), affected versions could still let that client approve/deny a pending exec approval by sending the `/approve` chat command.</p> <p>This is mainly relevant for shared or multi-client setups where different tokens are intentionally scoped differently. Single-operator installs are typically less impacted.</p> <p>### Technical summary</p> <p>A gateway client authenticated with a device token scoped only to `operator.write` (without `operator.approvals`) could approve/deny pending exec approval requests by sending a chat message containing the built-in `/approve` command.</p> <p>`exec.approval.resolve` is correctly scoped to `operator.approvals` for direct RPC calls, but the `/approve` command path invoked it via an internal privileged gateway client.</p> <p>## Affected Packages / Versions</p> <p>- `openclaw` (npm): `&lt; 2026.2.2`</p> <p>## Fix</p> <p>- Fixed in `openclaw` `2026.2.2`. - Fix commit(s): `efe2a464afcff55bb5a95b959e6bd9ec0fef086e`. - Change: when `/approve` is invoked from gateway clients (webchat/internal channel), it now requires the requesting client to have `operator.approvals` (or `operator.admin`).</p> <p>## Workarounds</p> <p>- Upgrade to `openclaw &gt;= 2026.2.2`. - If you cannot upgrade: avoid issuing write-only device tokens to untrusted clients; disable text commands (`commands.text=false`) or restrict access to…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>### What this means (plain language)</p> <p>If you give a client “chat/write” access to the gateway (`operator.write`) but you do not intend to let that client approve exec requests (`operator.approvals`), affected versions could still let that client approve/deny a pending exec approval by sending the `/approve` chat command.</p> <p>This is mainly relevant for shared or multi-client setups where different tokens are intentionally scoped differently. Single-operator installs are typically less impacted.</p> <p>### Technical summary</p> <p>A gateway client authenticated with a device token scoped only to `operator.write` (without `operator.approvals`) could approve/deny pending exec approval requests by sending a chat message containing the built-in `/approve` command.</p> <p>`exec.approval.resolve` is correctly scoped to `operator.approvals` for direct RPC calls, but the `/approve` command path invoked it via an internal privileged gateway client.</p> <p>## Affected Packages / Versions</p> <p>- `openclaw` (npm): `&lt; 2026.2.2`</p> <p>## Fix</p> <p>- Fixed in `openclaw` `2026.2.2`. - Fix commit(s): `efe2a464afcff55bb5a95b959e6bd9ec0fef086e`. - Change: when `/approve` is invoked from gateway clients (webchat/internal channel), it now requires the requesting client to have `operator.approvals` (or `operator.admin`).</p> <p>## Workarounds</p> <p>- Upgrade to `openclaw &gt;= 2026.2.2`. - If you cannot upgrade: avoid issuing write-only device tokens to untrusted clients; disable text commands (`commands.text=false`) or restrict access to…</p> https://db.gcve.eu/vuln/ghsa-mqpw-46fh-299h