N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7jm2-g593-4qrc

GHSA-7jm2-g593-4qrc: OpenClaw: Agent gateway config mutations could change protected operator settings

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: < 2026.4.20
Patched version: 2026.4.20

Impact

The agent-facing gateway config.patch / config.apply guard did not cover several operator-trusted settings, including sandbox policy, plugin enablement, gateway auth/TLS, hook routing, MCP server configuration, SSRF policy, and filesystem hardening. A prompt-injected model with access to the owner-only gateway tool could persist changes to those settings.

This is a model-to-operator guard bypass, not a remote unauthenticated gateway compromise. Severity is medium.

Fix

OpenClaw now blocks model-driven gateway config mutations for the broader operator-trusted path set and covers per-agent overrides and array-entry patching.

Fix commit:

fe30b31a97a917ecc6e92f6c85378b6b20352422

Release

Fixed in OpenClaw 2026.4.20.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7jm2-g593-4qrc

GHSA-7jm2-g593-4qrc:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.20	2026.4.20

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the gateway tool, which allowed agents to modify protected configuration settings. The core of the vulnerability is in the assertGatewayConfigMutationAllowed function within src/agents/tools/gateway-tool.ts. This function acts as a guard for config.patch and config.apply actions. Before the fix, this function's validation was inadequate. It used a simple deep equality check (isDeepStrictEqual) and had an incomplete list of configuration paths to protect. This allowed a compromised or malicious agent to craft a configuration patch that could, for example, disable sandboxing, enable untrusted plugins, or alter security policies for SSRF and filesystem access. The vulnerability was particularly exploitable through manipulations of array elements in the configuration (e.g., the agents.list), which the original check failed to handle correctly. The patch addresses this by introducing a new, more sophisticated validation function, isProtectedPathEqual, which can correctly compare configurations even when arrays are modified, and by significantly expanding the list of PROTECTED_GATEWAY_CONFIG_PATHS. Therefore, any runtime profile of the exploitation would show assertGatewayConfigMutationAllowed being called to process the malicious configuration update.

Vulnerable functions

assertGatewayConfigMutationAllowed

src/agents/tools/gateway-tool.ts

This function is responsible for validating configuration changes from agents. The original implementation used `isDeepStrictEqual` and an incomplete list of protected paths, which was insufficient to prevent malicious changes to sensitive settings. An attacker could bypass these checks, particularly by manipulating array elements, to change operator-trusted configurations. The patch replaces the simple equality check with a more robust `isProtectedPathEqual` function and expands the list of protected paths.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.