N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jf56-mccx-5f3f

GHSA-jf56-mccx-5f3f: OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel

Impact

Authenticated /hooks/wake and mapped wake payloads are promoted into the trusted System: prompt channel.

An authenticated wake hook or mapped wake payload could be promoted into the trusted System prompt channel instead of an untrusted event.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.2
Patched versions: 2026.4.8

Fix

The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.

Verification

The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.

Credits

Thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-jf56-mccx-5f3f

GHSA-jf56-mccx-5f3f:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.4.2	2026.4.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the provided commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5, which is explicitly mentioned in the security advisory as the fix. The vulnerability describes a trust boundary violation where a user-controlled payload from a /hooks/wake endpoint is promoted to a trusted System: prompt channel. The fix is located in the fetchWithSsrFGuard function within src/infra/net/fetch-guard.ts, a function designed to prevent Server-Side Request Forgery (SSRF). The patch modifies the logic to skip DNS pinning when a trusted environment proxy is configured.

The reasoning connects these two seemingly disparate facts by hypothesizing that the vulnerability is triggered by an unhandled exception. Specifically, in the vulnerable version, fetchWithSsrFGuard would always attempt to resolve and pin the DNS for a given hostname. If OpenClaw is configured to use a trusted proxy, and a user provides a hostname in the wake payload that is only resolvable by that proxy, the initial DNS lookup would fail. This failure would throw an exception. It is inferred that the code handling the /hooks/wake functionality does not correctly handle this specific error case, leading it to erroneously process the original, un-sanitized payload as a trusted system command. The patch prevents this condition by aligning the code with the intended logic: if a trusted proxy is used, the responsibility of DNS resolution is delegated to it, and the problematic initial DNS lookup is skipped. Therefore, fetchWithSsrFGuard is identified as the key function, as its behavior is the trigger for the vulnerability, even if the root cause lies in the error handling of its caller.

Vulnerable functions

fetchWithSsrFGuard

src/infra/net/fetch-guard.ts

The vulnerability allows authenticated payloads from `/hooks/wake` to be promoted to a trusted system channel. This likely occurs when the hook triggers a URL fetch via `fetchWithSsrFGuard`. Before the patch, this function unconditionally performed a DNS lookup. In a configuration using a trusted proxy, if the user-supplied hostname was only resolvable by the proxy, the DNS lookup would fail and throw an exception. The vulnerability likely stems from the calling code's improper handling of this exception, causing it to fall back to treating the user's original payload as trusted. The patch fixes this by skipping the DNS lookup when a trusted proxy is used, thus preventing the exception that triggers the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.