CWE-372: Incomplete Internal State Distinction

Base

The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

Consequences

Integrity, Other: Varies by Context, Unexpected State

Recent advisories

GHSA-9f4w-67g7-mqwv — OpenClaw: Endpoint persists after trust decline, leaking gateway credentials
GHSA-f693-58pc-2gfr — OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts
GHSA-3pm9-5j7m-59vc — OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config
GHSA-g42g-737j-qx6j — Access Restriction Bypass in kube-apiserver

All advisories for CWE-372

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor