N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2f7j-rp58-mr42

GHSA-2f7j-rp58-mr42: OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

Summary

Before OpenClaw 2026.4.2, the Gateway connect success snapshot exposed local configPath and stateDir metadata to non-admin clients. Low-privilege authenticated clients could learn host filesystem layout and deployment details that were not needed for their role.

Impact

A non-admin client could recover host-specific filesystem paths and related deployment metadata, aiding host fingerprinting and chained attacks. This was an information-disclosure issue, not a direct authorization bypass.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

676b748056b5efca6f1255708e9dd9469edf5e2e — limit connect snapshot metadata to admin-scoped clients

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @topsec-bunney for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2f7j-rp58-mr42

GHSA-2f7j-rp58-mr42:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.4.1	2026.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the disclosure of sensitive host-specific paths (configPath and stateDir) to non-admin users connecting to the OpenClaw Gateway. The analysis of the provided patch 676b748056b5efca6f1255708e9dd9469edf5e2e reveals the root cause.

The function buildGatewaySnapshot in src/gateway/server/health-state.ts was responsible for assembling a "snapshot" of the gateway's status. In its vulnerable form, it always included the configPath and stateDir in the snapshot object it created.

This snapshot was then used by the attachGatewayWsMessageHandler function in src/gateway/server/ws-connection/message-handler.ts. This handler, upon a successful client connection (hello-ok), would send this snapshot to the client. Since there was no privilege check before creating and sending the snapshot, any authenticated user, regardless of their administrative status, would receive these sensitive paths.

The fix involves two parts:

The buildGatewaySnapshot function was modified to accept an opts object with an includeSensitive boolean property. The sensitive information is now only added to the snapshot if includeSensitive is true.
The attachGatewayWsMessageHandler function was updated to check if the connecting client's scopes include ADMIN_SCOPE. It then calls buildGatewaySnapshot with includeSensitive set to true only for admin users.

Therefore, during exploitation, a non-admin user would connect, and the attachGatewayWsMessageHandler would call buildGatewaySnapshot, which would then return the sensitive data. These two functions are central to the vulnerability.

Vulnerable functions

buildGatewaySnapshot

src/gateway/server/health-state.ts

This function was responsible for creating a snapshot of the gateway's state. Before the patch, it unconditionally included sensitive information like `configPath` and `stateDir`, which was then exposed to non-admin users. The patch modifies this function to only include this sensitive information if the `includeSensitive` option is explicitly set to true.

attachGatewayWsMessageHandler

src/gateway/server/ws-connection/message-handler.ts

This function handles WebSocket messages for the gateway. It calls `buildGatewaySnapshot` to get the state snapshot to send to the client upon successful connection. Before the patch, it called `buildGatewaySnapshot` without any parameters, which returned a snapshot containing sensitive information, regardless of the user's privileges. The patch ensures that the `includeSensitive` flag is passed to `buildGatewaySnapshot` based on whether the user has admin scopes, thus preventing information disclosure to non-admin users.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.