N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-v8qf-fr4g-28p2

GHSA-v8qf-fr4g-28p2: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: < 2026.4.20
Patched version: 2026.4.20

Impact

The Control UI assistant-media route authenticated trusted-proxy callers but did not enforce the declared operator scopes for identity-bearing HTTP auth paths. A trusted-proxy caller without operator.read could access assistant-media files and metadata that were otherwise inside allowed media roots.

The route still required successful gateway authentication and media-root checks. Severity is low.

Fix

Assistant-media file and metadata requests now require operator.read on identity-bearing HTTP auth paths.

Fix commit:

99ef3a63c58440d53f8e45ad861b846032fcb036

Release

Fixed in OpenClaw 2026.4.20.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-v8qf-fr4g-28p2

GHSA-v8qf-fr4g-28p2:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.20	2026.4.20

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handleControlUiAssistantMediaRequest function in src/gateway/control-ui.ts. The vulnerability description states that the assistant media route missed scope enforcement for trusted-proxy authorization. The provided patch adds a scope-checking block to this function. Specifically, it now calls resolveTrustedHttpOperatorScopes and authorizeOperatorScopesForMethod to ensure the caller has the operator.read scope (aliased as assistant.media.get in the code) when using an identity-bearing authentication method like a trusted proxy. Before this change, the function would proceed to serve media files without verifying the necessary scope, leading to an authorization bypass. The vulnerable function is handleControlUiAssistantMediaRequest as it's the entry point for handling the request and where the authorization logic was missing.

Vulnerable functions

handleControlUiAssistantMediaRequest

src/gateway/control-ui.ts

This function handles requests for the assistant media route. Before the patch, it did not enforce operator scopes for authenticated trusted-proxy callers. This allowed a user with valid gateway authentication but without the `operator.read` scope to access assistant media files and metadata.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.