N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-v6x2-2qvm-6gv8

GHSA-v6x2-2qvm-6gv8: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

Vulnerability

OpenClaw reused gateway.auth.token (and gateway.remote.token) as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay=hash and commands.ownerDisplaySecret was unset.

This created secret dual-use between gateway authentication and prompt metadata hashing.

Impact

Auth-secret dual-use across security domains (gateway auth and prompt metadata hashing).
Hash outputs are visible to third-party model providers in system prompts.
No direct plaintext token disclosure.
Practical risk is highest when operators use weak gateway tokens and leave owner hash secret unset.

Affected Packages / Versions

Package: openclaw (npm)
Latest affected published version: 2026.2.21-2
Vulnerable range: <= 2026.2.21-2
Patched version (planned next release): 2026.2.22

Affected Components

src/agents/cli-runner/helpers.ts
src/agents/pi-embedded-runner/run/attempt.ts
src/agents/pi-embedded-runner/compact.ts

Remediation

Added a shared owner-display resolver and secret-generation helper.
Removed fallback to gateway.auth.token and gateway.remote.token.
Auto-generates and persists a dedicated commands.ownerDisplaySecret when hash mode is enabled and secret is missing.

Fix Commit(s)

c99e7696e6893083b256f0a6c88fb060f3a76fb7

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.22). Once npm release 2026.2.22 is published, this advisory only needs to be published.

OpenClaw thanks @aether-ai-agent for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-v6x2-2qvm-6gv8

GHSA-v6x2-2qvm-6gv8:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.21-2	2026.2.22

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-v6x2-2qvm-6gv8, stems from the reuse of gateway authentication tokens (gateway.auth.token and gateway.remote.token) as a fallback secret for hashing owner IDs in system prompts. This practice is insecure as it mixes secrets from two different security contexts: gateway authentication and prompt metadata obfuscation. The analysis of the patch commit c99e7696e6893083b256f0a6c88fb060f3a76fb7 confirms this. The changes explicitly remove the fallback logic from three key functions: buildSystemPrompt, compactEmbeddedPiSessionDirect, and runEmbeddedAttempt. In the vulnerable versions, these functions would check for commands.ownerDisplaySecret and, if it was missing, would incorrectly use the gateway tokens. An attacker with knowledge of the hashed owner ID could potentially try to reverse the hash or use it in other contexts, and while direct token disclosure is not possible, the risk is elevated if weak gateway tokens are used. The patch remediates this by introducing a new helper, resolveOwnerDisplaySetting, which strictly uses the dedicated ownerDisplaySecret and does not fall back to other tokens. Additionally, the system now auto-generates and persists a dedicated secret if one is not configured, ensuring a proper separation of concerns.

Vulnerable functions

buildSystemPrompt

src/agents/cli-runner/helpers.ts

The function `buildSystemPrompt` in `src/agents/cli-runner/helpers.ts` was vulnerable because it used the `gateway.auth.token` or `gateway.remote.token` as a fallback for the `ownerDisplaySecret` when hashing the owner ID. This constitutes a reuse of secrets across different security domains, as the gateway token is intended for authentication, not for hashing prompt metadata.

compactEmbeddedPiSessionDirect

src/agents/pi-embedded-runner/compact.ts

The function `compactEmbeddedPiSessionDirect` in `src/agents/pi-embedded-runner/compact.ts` was vulnerable because it used the `gateway.auth.token` or `gateway.remote.token` as a fallback for the `ownerDisplaySecret` when hashing the owner ID for embedded sessions. This leads to the same secret dual-use vulnerability as in other parts of the application.

runEmbeddedAttempt

src/agents/pi-embedded-runner/run/attempt.ts

The function `runEmbeddedAttempt` in `src/agents/pi-embedded-runner/run/attempt.ts` was vulnerable as it also fell back to using `gateway.auth.token` or `gateway.remote.token` for the `ownerDisplaySecret`. This function is part of the embedded agent runner and its use of the gateway token for hashing created an improper trust boundary between authentication and data obfuscation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-v6x2-2qvm-6gv8: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

Vulnerability

Impact

Affected Packages / Versions

Affected Components

Remediation

Fix Commit(s)

Release Process Note

GHSA-v6x2-2qvm-6gv8:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-v6x2-2qvm-6gv8: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

Vulnerability

Impact

Affected Packages / Versions

Affected Components

Remediation

Fix Commit(s)

Release Process Note

Technical Details

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI