N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-57r2-h2wj-g887

GHSA-57r2-h2wj-g887: OpenClaw: Isolated cron awareness events were recorded as trusted system events

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: < 2026.4.20
Patched version: 2026.4.20

Impact

Output from webhook-triggered isolated cron agent runs could be queued into the main session awareness stream without trusted: false. That made the event render as a trusted System: event instead of an untrusted system event.

This is a trust-labeling issue that can strengthen prompt-injection impact, but it does not directly bypass gateway auth, tool policy, or sandboxing. Severity is low.

Fix

OpenClaw now preserves untrusted labels for isolated cron awareness events and forwards the trust flag through cron delivery helpers.

Fix commit:

f61896b03cc7031f51106a04566831f4ac2a0bd7

Release

Fixed in OpenClaw 2026.4.20.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-57r2-h2wj-g887

GHSA-57r2-h2wj-g887:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.20	2026.4.20

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by the system's failure to correctly handle the trust level of events originating from isolated cron jobs. These events were being incorrectly labeled as 'trusted' when they should have been treated as 'untrusted'. The analysis of the patch reveals two key functions contributing to this issue.

First, the queueCronAwarenessSystemEvent function in src/cron/isolated-agent/delivery-dispatch.ts is responsible for creating these cron-related events. The patch shows that a trusted: false flag was added to the call to enqueueSystemEvent within this function. This indicates that, prior to the fix, events generated by this function were not explicitly marked as untrusted, causing them to default to a trusted status.

Second, the buildGatewayCronService function in src/gateway/server-cron.ts sets up the cron service and its dependencies. Within this function, the implementation of enqueueSystemEvent was not passing the trusted property from its options to the underlying event system. The patch modifies this to forward opts?.trusted. This reveals a systemic issue where the trust level of an event could be dropped as it passed through the cron service, preventing any caller from correctly setting an event as untrusted.

In summary, the vulnerability stems from both the initial creation of untrusted events without the proper flag and a middleware layer that would have stripped the flag anyway. Both queueCronAwarenessSystemEvent and buildGatewayCronService are therefore identified as vulnerable functions as they were both instrumental in causing the improper trust labeling.

Vulnerable functions

queueCronAwarenessSystemEvent

src/cron/isolated-agent/delivery-dispatch.ts

This function queues a system event for an isolated cron job. Before the patch, it did not specify that the event was untrusted, leading to the event being treated as a trusted system event. The patch adds `trusted: false` to the `enqueueSystemEvent` call, correcting the trust level.

buildGatewayCronService

src/gateway/server-cron.ts

This function constructs the cron service for the gateway. The `enqueueSystemEvent` dependency it created did not forward the `trusted` status of an event. This meant that even if a caller attempted to mark an event as untrusted, this information would be lost. The patch corrects this by forwarding the `trusted` option.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.