GHSA-hfpr-jhpq-x4rm: OpenClaw `operator.write` Chat.send Could Reach Admin-only Vulnerability
MODERATEGHSA-hfpr-jhpq-x4rm is a MODERATE (CVSS 4.3) `operator.write` chat.send could reach admin-only vulnerability (CWE-863: Incorrect Authorization) affecting OpenClaw libraries in the npm ecosystem. The issue involves `operator.write` chat.send could reach admin-only config writes. Remediation is available by upgrading affected packages to version 2026.3.7.
GHSA-hfpr-jhpq-x4rm at a Glance
Security Impact
CVSS: 4.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
How to Fix GHSA-hfpr-jhpq-x4rm
To remediate this vulnerability, upgrade all affected OpenClaw dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install openclaw@2026.3.7Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls openclawHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-hfpr-jhpq-x4rm, inspect your project dependencies using npm:
npm ls openclawAnalyze the terminal output to locate any version of OpenClaw in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2026.3.7), your application is affected.
Note: The npm ls openclaw command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In OpenClaw, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-hfpr-jhpq-x4rm Affected OpenClaw Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
openclaw
|
npm |
< 2026.3.7
|
2026.3.7
|
References
Frequently Asked Questions
What is GHSA-hfpr-jhpq-x4rm?
Which OpenClaw versions are affected?
What version fixes GHSA-hfpr-jhpq-x4rm?
Is openclaw affected?
What is the CVSS score of GHSA-hfpr-jhpq-x4rm?
What CWE is associated with GHSA-hfpr-jhpq-x4rm?
How can I check npm dependencies for GHSA-hfpr-jhpq-x4rm?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-hfpr-jhpq-x4rm",
"modified" : "2026-03-09T19:54:41Z",
"published" : "2026-03-09T19:54:41Z",
"aliases" : [ ],
"summary" : "OpenClaw: `operator.write` chat.send could reach admin-only config writes",
"details" : "### Summary\nA gateway client authenticated with `operator.write` could route `/config set` or `/config unset` through `chat.send` and reach persistent config mutation even though direct config RPC methods are admin-scoped.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published vulnerable version: `2026.3.2`\n- Affected range: `<= 2026.3.2`\n- Patched in: `2026.3.7`\n\n### Details\nBefore the fix, `chat.send` ran slash commands in an internal gateway-chat context with `CommandAuthorized: true`, and `/config` write paths only checked command authorization plus `commands.config` / `channels.<provider>.configWrites` gates. That allowed an authenticated `operator.write` gateway client to bridge into persistent config writes even though direct `config.*` RPC methods remain `operator.admin` scoped.\n\nThe fix keeps command functionality intact while restoring the intended scope boundary:\n- persistent `/config set|unset` writes routed through gateway `chat.send` now require `operator.admin`\n- read-only `/config show` remains available to normal write-scoped gateway clients\n- normal messaging-channel `/config` behavior remains unchanged\n\n### Impact\nThis is a real authorization mismatch, but exploitability requires an already authenticated gateway client with `operator.write`, `chat.send` access, and `/config` command support enabled. Maintainer severity is set to medium because the bug is a scoped control-plane privilege mismatch rather than a broad unauthenticated or generic remote compromise. The main consequence is unintended persistent config mutation.\n\n### Fix Commit(s)\n- `5f8f58ae25e2a78f31b06edcf26532d634ca554e`\n\n### Release Process Note\nnpm `2026.3.7` was published on March 8, 2026. This advisory is fixed in the released package.\n\nThanks @tdjackey for reporting.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "openclaw"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2026.3.7"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 2026.3.2"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/security/advisories/GHSA-hfpr-jhpq-x4rm"
}, {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/commit/5f8f58ae25e2a78f31b06edcf26532d634ca554e"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/openclaw/openclaw"
}, {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/releases/tag/v2026.3.7"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-863" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-09T19:54:41Z",
"nvd_published_at" : null
}
}