GHSA-pjvx-rx66-r3fg: OpenClaw Cross-account Sender Authorization Expansion Vulnerability
MODERATEGHSA-pjvx-rx66-r3fg is a MODERATE (CVSS 5.4) cross-account sender authorization expansion vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affecting OpenClaw libraries in the npm ecosystem. The issue involves cross-account sender authorization expansion in `/allowlist ... --store` account scoping. Remediation is available by upgrading affected packages to version 2026.3.7.
GHSA-pjvx-rx66-r3fg at a Glance
Security Impact
CVSS: 5.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
How to Fix GHSA-pjvx-rx66-r3fg
To remediate this vulnerability, upgrade all affected OpenClaw dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install openclaw@2026.3.7Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls openclawHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-pjvx-rx66-r3fg, inspect your project dependencies using npm:
npm ls openclawAnalyze the terminal output to locate any version of OpenClaw in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2026.3.7), your application is affected.
Note: The npm ls openclaw command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key, where the system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. In OpenClaw, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-pjvx-rx66-r3fg Affected OpenClaw Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
openclaw
|
npm |
< 2026.3.7
|
2026.3.7
|
References
Frequently Asked Questions
What is GHSA-pjvx-rx66-r3fg?
Which OpenClaw versions are affected?
What version fixes GHSA-pjvx-rx66-r3fg?
Is openclaw affected?
What is the CVSS score of GHSA-pjvx-rx66-r3fg?
What CWE is associated with GHSA-pjvx-rx66-r3fg?
How can I check npm dependencies for GHSA-pjvx-rx66-r3fg?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-pjvx-rx66-r3fg",
"modified" : "2026-03-09T19:54:08Z",
"published" : "2026-03-09T19:54:08Z",
"aliases" : [ ],
"summary" : "OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping",
"details" : "### Summary\n`/allowlist ... --store` resolved the selected channel `accountId` for reads, but store writes still dropped that `accountId` and wrote into the legacy unscoped pairing allowlist store.\n\nBecause default-account reads still merge legacy unscoped entries, a store entry intended for one account could silently authorize the same sender on the `default` account.\n\nThis is a real cross-account sender-authorization scoping bug. Severity is set to **medium** because exploitation requires an already-authorized user who can run `/allowlist` edits.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published version checked: `2026.3.2`\n- Affected versions: `<= 2026.3.2`\n- Fixed on `main`: March 7, 2026 in `70da80bcb5574a10925469048d2ebb2abf882e73`\n- Patched release: `2026.3.7`\n\n### Details\nThe affected path was:\n- `src/auto-reply/reply/commands-allowlist.ts:386-393` resolved `accountId` and read store state with it\n- `src/auto-reply/reply/commands-allowlist.ts:697-702` and `src/auto-reply/reply/commands-allowlist.ts:730-733` wrote store state without passing `accountId`\n- `src/pairing/pairing-store.ts:231-234` and `src/pairing/pairing-store.ts:534-554` still merged legacy unscoped allowlist entries into the `default` account\n\nThe fix scopes `/allowlist ... --store` writes to the resolved account and clears legacy default-account store entries on removal so legacy reads no longer create cross-account authorization bleed-through.\n\n### Impact\n- Vulnerability class: improper authorization scoping / incorrect authorization\n- Exploitation requires: an already-authorized sender who can run `/allowlist` edits\n- Security effect: unintended authorization expansion from one channel account into `default`\n\n### Fix Commit(s)\n- `70da80bcb5574a10925469048d2ebb2abf882e73` — scope `/allowlist ... --store` writes by account and clean up legacy default-account removals\n\n### Release Process Note\nnpm `2026.3.7` was published on March 8, 2026. This advisory is fixed in the released package.\n\nThanks @tdjackey for reporting.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "openclaw"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2026.3.7"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 2026.3.2"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/security/advisories/GHSA-pjvx-rx66-r3fg"
}, {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/commit/70da80bcb5574a10925469048d2ebb2abf882e73"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/openclaw/openclaw"
}, {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/releases/tag/v2026.3.7"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-639", "CWE-863" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-09T19:54:08Z",
"nvd_published_at" : null
}
}