N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-877v-w3f5-3pcq

GHSA-877v-w3f5-3pcq: OpenClaw: Feishu thread history and quoted messages bypass sender allowlist

Summary

Feishu thread history and quoted messages bypass sender allowlist

Current Maintainer Triage

Status: open
Normalized severity: medium
Assessment: Real in shipped v2026.3.28 Feishu because fetched quoted/root/thread context bypasses sender allowlists, and SECURITY.md does not exempt remote sender-allowlist bypasses.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

f45e5a6569aab1d58cc6de25b19f1dc4c8779b85 — 2026-03-31T19:43:54+09:00

Release Process Note

The fix is already present in released version 2026.3.31.
This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-877v-w3f5-3pcq

GHSA-877v-w3f5-3pcq:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handleFeishuMessage function in extensions/feishu/src/bot.ts. The function processes incoming messages from Feishu and, in doing so, fetches additional context like quoted messages and thread history. The core of the vulnerability is that the function failed to apply the configured groupSenderAllowFrom allowlist to this fetched context. The patch f45e5a6569aab1d58cc6de25b19f1dc4c8779b85 introduces checks to filter this context. Specifically, it adds calls to a new function shouldIncludeFetchedGroupContextMessage before including content from a quoted message or a thread's root message. It also uses filterFetchedGroupContextMessages to filter the entire thread history. These changes ensure that any message content used to build the agent's context, whether from the current message or from fetched history, originates from a sender on the allowlist. Therefore, handleFeishuMessage is the function that would appear in a runtime profile during the exploitation of this vulnerability, as it is the entry point for processing the message and its associated (and previously unchecked) context.

Vulnerable functions

handleFeishuMessage

extensions/feishu/src/bot.ts

The `handleFeishuMessage` function is responsible for processing incoming Feishu messages. Before the patch, this function would fetch and include content from quoted messages and thread history without verifying if the senders of that content were on the group's sender allowlist. This allowed unauthorized content to be injected into the agent's context. The patch adds checks using the new `shouldIncludeFetchedGroupContextMessage` and `filterFetchedGroupContextMessages` functions to ensure that only content from allowlisted senders is included.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.