8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-cwj3-vqpp-pmxr

GHSA-cwj3-vqpp-pmxr: OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

Summary

The agent-facing gateway tool protects config.apply and config.patch with a model-to-operator trust boundary. That guard used a hand-maintained denylist of protected config paths. The config schema outgrew that denylist, leaving sensitive subtrees writable through model-driven gateway config mutations.

Impact

A prompt-injected or otherwise compromised model running with access to the owner-only gateway tool could persist unsafe config changes that crossed security boundaries. Examples included config paths affecting command execution, network/proxy/TLS behavior, credential forwarding, telemetry or hook endpoints, memory/indexing surfaces, and operator policy controls. These changes could survive restart once written to config.

Affected Packages / Versions

Package: openclaw on npm
Affected: versions before 2026.4.23
Fixed: 2026.4.23
Latest stable verified fixed: openclaw@2026.4.23, tag v2026.4.23

Fix

OpenClaw replaced the denylist with a fail-closed allowlist. Agent-driven gateway config.apply and gateway config.patch now permit only narrow agent-tunable prompt/model settings and mention-gating paths. Other config changes are rejected before the gateway mutation RPC is invoked.

Fix Commit(s)

bceda6089aa7b3695cc7696b43c61ae3d01bb0ec (fix(gateway): fail closed on runtime config edits)

Severity

Severity remains high. The vulnerable entry point is owner-only, but the model/agent is not a trusted principal under OpenClaw's security model, and the guard is the explicit model-to-operator boundary for persisted config mutation.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-cwj3-vqpp-pmxr

GHSA-cwj3-vqpp-pmxr:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.23	2026.4.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in OpenClaw's gateway tool was due to an insecure implementation of a configuration mutation guard. The system used a denylist (PROTECTED_GATEWAY_CONFIG_PATHS) to prevent model-driven agents from modifying sensitive configuration settings via the config.apply and config.patch actions. However, this denylist was incomplete and did not cover all sensitive configuration paths. As a result, a compromised or malicious agent could modify critical settings, leading to a persistent security compromise.

The core of the vulnerability lies in the assertGatewayConfigMutationAllowed function in src/agents/tools/gateway-tool.ts. Before the patch, this function, along with its helpers isProtectedPathEqual, getValueAtPath, and getValueAtCanonicalPath, would check if any of the paths in the denylist were being modified. If a sensitive path was not on the list, the change would be allowed.

The fix, implemented in commit bceda6089aa7b3695cc7696b43c61ae3d01bb0ec, replaces this flawed denylist mechanism with a fail-safe allowlist (ALLOWED_GATEWAY_CONFIG_PATHS). The assertGatewayConfigMutationAllowed function was rewritten to only permit changes to a small, well-defined set of configuration paths that are safe for an agent to modify. Any attempt to change a path not on the allowlist is rejected. This change effectively closes the vulnerability by ensuring that any new, potentially sensitive configuration paths are protected by default.

Vulnerable functions

assertGatewayConfigMutationAllowed

src/agents/tools/gateway-tool.ts

This function contained the core logic for validating configuration changes made through the gateway tool. The vulnerability existed because it used a denylist (`PROTECTED_GATEWAY_CONFIG_PATHS`) which was incomplete. This allowed an attacker to modify sensitive configuration paths that were not explicitly listed in the denylist. The patch replaced this logic with an allowlist, ensuring that only explicitly permitted configuration paths can be modified.

isProtectedPathEqual

src/agents/tools/gateway-tool.ts

This function was a key component of the vulnerable denylist implementation. It was responsible for checking if a protected configuration path had been modified. The function was removed as part of the fix and replaced by a more secure allowlist-based validation mechanism.

getValueAtPath

src/agents/tools/gateway-tool.ts

This was a helper function for the vulnerable `isProtectedPathEqual` function. It was used to retrieve values from the configuration object based on a given path. It was removed as part of the migration to a more secure allowlist-based validation.

getValueAtCanonicalPath

src/agents/tools/gateway-tool.ts

This was a helper function for the vulnerable `getValueAtPath` function, used to retrieve configuration values. It was removed as part of the fix that replaced the denylist with an allowlist.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.8

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-cwj3-vqpp-pmxr: OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

Summary

Impact

Affected Packages / Versions

Fix

Fix Commit(s)

Severity

GHSA-cwj3-vqpp-pmxr:

8.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-cwj3-vqpp-pmxr: OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

Summary

Impact

Affected Packages / Versions

Fix

Fix Commit(s)

Severity

8.8

8.8

Technical Details

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI