Skip to content
Log inStart free trial

GHSA-v6x2-2qvm-6gv8 CVE-2026-32897

OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

Medium npm
Severity
0.0 / 10
Medium · CVSS 4.0
Exploit chance (EPSS)
0.27%
Chance of exploitation in the next 30 days. Higher than 18.88% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-522 Insufficiently Protected Credentials
Fix
2026.2.22
Upgrade openclaw to this version or later

Description

Vulnerability

OpenClaw reused gateway.auth.token (and gateway.remote.token) as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay=hash and commands.ownerDisplaySecret was unset.

This created secret dual-use between gateway authentication and prompt metadata hashing.

Impact

  • Auth-secret dual-use across security domains (gateway auth and prompt metadata hashing).
  • Hash outputs are visible to third-party model providers in system prompts.
  • No direct plaintext token disclosure.
  • Practical risk is highest when operators use weak gateway tokens and leave owner hash secret unset.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest affected published version: 2026.2.21-2
  • Vulnerable range: <= 2026.2.21-2
  • Patched version (planned next release): 2026.2.22

Affected Components

  • src/agents/cli-runner/helpers.ts
  • src/agents/pi-embedded-runner/run/attempt.ts
  • src/agents/pi-embedded-runner/compact.ts

Remediation

  • Added a shared owner-display resolver and secret-generation helper.
  • Removed fallback to gateway.auth.token and gateway.remote.token.
  • Auto-generates and persists a dedicated commands.ownerDisplaySecret when hash mode is enabled and secret is missing.

Fix Commit(s)

  • c99e7696e6893083b256f0a6c88fb060f3a76fb7

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.22). Once npm release 2026.2.22 is published, this advisory only needs to be published.

OpenClaw thanks @aether-ai-agent for reporting.

Affected versions

npm

PackageVulnerableFixed in
openclaw
< 2026.2.22
2026.2.22

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

openclaw npm → 2026.2.22

npm
npm install openclaw@2026.2.22
yarn
yarn add openclaw@2026.2.22
pnpm
pnpm add openclaw@2026.2.22

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack vector
Local
Attack complexity
High
Attack requirements
Present
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
Low
Integrity (vulnerable system)
None
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Weakness

CWE-522: Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

How to prevent it
  • Architecture and Design: Use an appropriate security mechanism to protect the credentials.
  • Architecture and Design: Make appropriate use of cryptography to protect the credentials.
  • Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-3x84-qq85-fj65
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
High Also affects openclaw
GHSA-9c3v-684m-579c
OpenClaw MCP SSE redirects could forward Authorization headers
Medium Also affects openclaw
GHSA-f397-5vjw-v2c2
OpenClaw: Shell inline-command parsing could miss an allowlist check
High Also affects openclaw
GHSA-rx78-29qr-5hq8
OpenClaw: Workspace-derived service PATH could influence trash command selection
High Also affects openclaw
GHSA-ccwh-wwpp-6wg5
OpenClaw: Host environment sanitizer missed two Node.js control variables
High Also affects openclaw
GHSA-985f-72mj-8gf7
OpenClaw: Tool group policy callers could accept unvalidated group IDs
Medium Also affects openclaw
GHSA-9v8j-9c9g-w66c
OpenClaw: Bootstrap token replay could widen pending pairing scopes
Medium Also affects openclaw
GHSA-c226-q6fx-6j6c
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags
Medium Also affects openclaw
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor