N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2hm8-rqrm-xfjq

GHSA-2hm8-rqrm-xfjq: OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows

Summary

In authenticated non-owner DM sessions, a narrow tool-invocation path could reach broader-than-intended owner-only gateway actions.

Impact

This requires an authenticated non-owner sender in a DM session and a specific tool invocation path. No unauthenticated access is involved, and this does not provide direct code execution by itself.

Root Cause

Some gateway call paths were still using broader default scopes instead of method-level least-privilege scopes.
Owner-only enforcement depended on tool-name checks and was not consistently metadata-driven across all call paths.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.17 (latest published npm version as of February 19, 2026)
Patched: 2026.2.19

Remediation

Refactored gateway method scope mapping to a data-driven table and added guard tests to ensure all exposed core gateway methods stay classified.
Centralized owner-only enforcement in tool policy wrappers and tool metadata.
Marked owner-only tools explicitly (cron, gateway, whatsapp_login) and removed duplicated per-tool owner checks.
Refactored gateway call path internals into smaller helpers while preserving behavior and coverage.

Fix Commit(s)

a40c10d3e24568b1e2947c104484be74bf66b8d2
2777d8ad91ef1e8a7c6f5b4b18f8507be7d02914
3d7ad1cfca4daaa84cd553e843e0e08fa6201349

OpenClaw thanks @Adam55A-code for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2hm8-rqrm-xfjq

GHSA-2hm8-rqrm-xfjq:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.19	2026.2.19

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from two primary failures in access control. First, in authenticated non-owner DM sessions, the code path for handling tool invocations, specifically the handleInlineActions function, did not correctly apply policies to prevent non-owners from accessing owner-only tools like cron and gateway. The vulnerable code would select a tool from an unfiltered list, bypassing ownership checks.

Second, when a privileged tool was invoked by a non-owner, the underlying gateway calls made by that tool were not properly scoped. The callGatewayTool function, used by the gateway tool, would call the internal gateway API without specifying least-privilege scopes. This caused the callGateway function to fall back to a default set of highly privileged, admin-level scopes (operator.admin), allowing the non-owner to perform administrative actions.

The patches address this by first centralizing owner-only tool enforcement via the applyOwnerOnlyToolPolicy function, which is now called within handleInlineActions to filter and guard tools before execution. Secondly, the gateway was refactored to be data-driven, where every method is explicitly mapped to a least-privilege scope. The callGatewayTool function was updated to always resolve and use these minimal scopes, removing the reliance on the dangerous default. A runtime profile during exploitation would likely show handleInlineActions calling the execute method of a restricted tool (e.g., createGatewayTool), which in turn calls callGatewayTool with escalated privileges.

Vulnerable functions

handleInlineActions

src/auto-reply/reply/get-reply-inline-actions.ts

This function is the entry point for the vulnerability. It was responsible for handling tool dispatches from messages. Before the patch, it would find a tool from the complete, unfiltered list of tools (`tools.find(...)`) without checking if the sender had the necessary permissions (i.e., was an owner) for owner-restricted tools. The patch fixes this by first calling `applyOwnerOnlyToolPolicy` to get a list of `authorizedTools` and then finding the tool within that authorized list.

createCronTool.execute

src/agents/tools/cron-tool.ts

The `execute` method within the object returned by `createCronTool` was vulnerable because it lacked a consistent and centrally enforced ownership check. The initial state had no check. A first patch added a check (`if (opts?.senderIsOwner === false)`), which was then removed and replaced by a centralized policy (`ownerOnly: true` metadata). This allowed non-owner authenticated users to execute cron management actions, which should be restricted to owners.

createGatewayTool.execute

src/agents/tools/gateway-tool.ts

Similar to the cron tool, the `execute` method for the `gateway` tool was vulnerable due to a missing ownership check. This allowed non-owners to access administrative gateway functions like restarting the service or applying configuration changes. The patch first added an explicit check and later replaced it with a centralized policy enforcement mechanism.

callGatewayTool

src/agents/tools/gateway.ts

This function was a key part of the privilege escalation. It was responsible for making calls to the internal gateway but failed to specify any authorization scopes. This caused the downstream `callGateway` function to fall back to default admin-level scopes, granting the request far more permissions than intended. The patch adds a call to `resolveLeastPrivilegeOperatorScopesForMethod` to ensure all calls are made with the minimum necessary permissions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-2hm8-rqrm-xfjq: OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows

Summary

Impact

Root Cause

Affected Packages / Versions

Remediation

Fix Commit(s)

GHSA-2hm8-rqrm-xfjq:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

Basic Information

GHSA-2hm8-rqrm-xfjq: OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows

Summary

Impact

Root Cause

Affected Packages / Versions

Remediation

Fix Commit(s)

N/A

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI