GHSA-52q4-3xjc-6778LowCVSS 4.2

OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Published
March 29, 2026
Last Modified
April 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-35617 →

📋 Description

Summary

Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

Google Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit 11ea1f67863d88b6cbcb229dd368a45e07094bff requires stable group IDs for access decisions.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 11ea1f67863d88b6cbcb229dd368a45e07094bff.

Fix Commit(s)

  • 11ea1f67863d88b6cbcb229dd368a45e07094bff

🎯 Affected products1

  • npm/openclaw:<= 2026.3.24

🔗 References (5)