5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-pjvx-rx66-r3fg

GHSA-pjvx-rx66-r3fg: OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping

Summary

/allowlist ... --store resolved the selected channel accountId for reads, but store writes still dropped that accountId and wrote into the legacy unscoped pairing allowlist store.

Because default-account reads still merge legacy unscoped entries, a store entry intended for one account could silently authorize the same sender on the default account.

This is a real cross-account sender-authorization scoping bug. Severity is set to medium because exploitation requires an already-authorized user who can run /allowlist edits.

Affected Packages / Versions

Package: openclaw (npm)
Latest published version checked: 2026.3.2
Affected versions: <= 2026.3.2
Fixed on main: March 7, 2026 in 70da80bcb5574a10925469048d2ebb2abf882e73
Patched release: 2026.3.7

Details

The affected path was:

src/auto-reply/reply/commands-allowlist.ts:386-393 resolved accountId and read store state with it
src/auto-reply/reply/commands-allowlist.ts:697-702 and src/auto-reply/reply/commands-allowlist.ts:730-733 wrote store state without passing accountId
src/pairing/pairing-store.ts:231-234 and src/pairing/pairing-store.ts:534-554 still merged legacy unscoped allowlist entries into the default account

The fix scopes /allowlist ... --store writes to the resolved account and clears legacy default-account store entries on removal so legacy reads no longer create cross-account authorization bleed-through.

Impact

Vulnerability class: improper authorization scoping / incorrect authorization
Exploitation requires: an already-authorized sender who can run /allowlist edits
Security effect: unintended authorization expansion from one channel account into default

Fix Commit(s)

70da80bcb5574a10925469048d2ebb2abf882e73 — scope /allowlist ... --store writes by account and clean up legacy default-account removals

Release Process Note

npm 2026.3.7 was published on March 8, 2026. This advisory is fixed in the released package.

Thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-pjvx-rx66-r3fg

GHSA-pjvx-rx66-r3fg:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.2	2026.3.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handleAllowlistCommand function within src/auto-reply/reply/commands-allowlist.ts. This function processes the /allowlist command, which can be used to manage sender authorizations. The vulnerability occurs when this command is used with the --store flag for a specific account. The function correctly identifies the target accountId for reading the current configuration but fails to use this accountId when writing the changes back to the persistent pairing store.

The patch shows that the direct calls to addChannelAllowFromStoreEntry and removeChannelAllowFromStoreEntry were made without the accountId. This caused the allowlist entry to be saved in a legacy, unscoped storage location. According to the vulnerability description, the logic for reading the allowlist for the default account merges entries from this legacy store. Consequently, an authorized user for a non-default account could add a sender to their allowlist, and that sender would also be authorized for the default account, which is an improper authorization expansion across accounts.

The fix introduces a new function, updatePairingStoreAllowlist, which takes the accountId as a parameter and passes it to the store writing functions. The handleAllowlistCommand is updated to use this new function, ensuring that all write operations to the pairing store are correctly scoped to the intended account. The fix also includes logic to clean up legacy unscoped entries upon removal to prevent further cross-account authorization issues.

Vulnerable functions

handleAllowlistCommand

src/auto-reply/reply/commands-allowlist.ts

The `handleAllowlistCommand` function was vulnerable because it did not pass the `accountId` when adding or removing entries from the pairing store. It resolved the `accountId` for read operations but failed to use it for write operations (`addChannelAllowFromStoreEntry` and `removeChannelAllowFromStoreEntry`). This resulted in allowlist entries intended for a specific account being written to a global, unscoped store, which was then incorrectly merged with the `default` account's allowlist, leading to a cross-account authorization vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.4

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-pjvx-rx66-r3fg: OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping

Summary

Affected Packages / Versions

Details

Impact

Fix Commit(s)

Release Process Note

GHSA-pjvx-rx66-r3fg:

5.4

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

5.4

5.4

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-pjvx-rx66-r3fg: OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping

Summary

Affected Packages / Versions

Details

Impact

Fix Commit(s)

Release Process Note

Technical Details

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI