GHSA-mhgq-xpfq-6r66MediumCVSS 8.2
OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes
🔗 CVE IDs covered (1)
📋 Description
Summary
Unauthenticated plugin-auth HTTP routes receive operator runtime scopes
Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: v2026.3.28 still gives auth:"plugin" routes operator WRITE_SCOPE, but impact should stay limited to plugin routes that actually touch privileged runtime actions before plugin auth completes.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
2a1db0c0f1fa375004a95ba0ef030534790a6d47— 2026-04-01T00:20:49+09:00
OpenClaw thanks @davidluzsilva for reporting.
🎯 Affected products1
- npm/openclaw:<= 2026.3.28
🔗 References (5)
- https://github.com/openclaw/openclaw/security/advisories/GHSA-mhgq-xpfq-6r66
- https://github.com/openclaw/openclaw/commit/2a1db0c0f1fa375004a95ba0ef030534790a6d47
- https://nvd.nist.gov/vuln/detail/CVE-2026-41394
- https://www.vulncheck.com/advisories/openclaw-unauthorized-operator-scope-access-in-unauthenticated-plugin-auth-routes
- https://github.com/advisories/GHSA-mhgq-xpfq-6r66