Advisory details:
github_osv / GHSA-mqpw-46fh-299h
| Advisory ID | github_osv/GHSA-mqpw-46fh-299h |
| Aliases |
CVE-2026-28473
|
| Summary | OpenClaw authorization bypass: operator.write can resolve exec approvals via chat.send -> /approve ## Summary ### What this means (plain language) If you give a client “chat/write” access to the gateway (`operator.write`) but you do not intend to let that client approve exec requests (`operator.approvals`), affected versions could still let that client approve/deny a pending exec approval by sending the `/approve` chat command. This is mainly relevant for shared or multi-client setups where different tokens are intentionally scoped differently. Single-operator installs are typically less impacted. ### Technical summary A gateway client authenticated with a device token scoped only to `operator.write` (without `operator.approvals`) could approve/deny pending exec approval requests by sending a chat message containing the built-in `/approve` command. `exec.approval.resolve` is correctly scoped to `operator.approvals` for direct RPC calls, but the `/approve` command path invoked it via an internal privileged gateway client. ## Affected Packages / Versions - `openclaw` (npm): `< 2026.2.2` ## Fix - Fixed in `openclaw` `2026.2.2`. - Fix commit(s): `efe2a464afcff55bb5a95b959e6bd9ec0fef086e`. - Change: when `/approve` is invoked from gateway clients (webchat/internal channel), it now requires the requesting client to have `operator.approvals` (or `operator.admin`). ## Workarounds - Upgrade to `openclaw >= 2026.2.2`. - If you cannot upgrade: avoid issuing write-only device tokens to untrusted clients; disable text commands (`commands.text=false`) or restrict access to the webchat/control UI. ## References - Fix: `src/auto-reply/reply/commands-approve.ts` - Coverage: `src/auto-reply/reply/commands-approve.test.ts` ## Release Process Note This advisory is kept in draft; once the fixed npm versions are available, it can be published without further edits. Thanks @yueyueL for reporting. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.5 |
| Risk | 3.2 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-269 | Improper Privilege Management |
| CWE-863 | Incorrect Authorization |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 7.2 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mqpw-46fh-299h/GHSA-mqpw-46fh-299h.json |
| cvssv4 | 7.2 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mqpw-46fh-299h/GHSA-mqpw-46fh-299h.json |
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-09T18:06:08Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/28xxx/CVE-2026-28473.json
Source Advisory: vulnrichment/CVE-2026-28473
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]