Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
HIGH severity

GHSA-943q-mwmv-hhvh — openclaw

HIGHFix: openclaw/openclaw#15390

GHSA-943q-mwmv-hhvh is a high-severity (CVSS 8.8) remote code execution vulnerability in openclaw. A fix is available for openclaw — see the affected versions and patch details below.

OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval

Published
Mar 2, 2026
Updated
Mar 4, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Mar 4, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

133other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
openclawnpm
3.0Mdownloads / week

Description

Summary

OpenClaw Gateway exposes an authenticated HTTP endpoint (POST /tools/invoke) intended for invoking a constrained set of tools. Two issues could combine to significantly increase blast radius in misconfigured or exposed deployments:

  • The HTTP gateway layer did not deny high-risk session orchestration tools by default, allowing a caller with Gateway auth to invoke tools like sessions_spawn / sessions_send and pivot into creating or controlling agent sessions.
  • ACP clients could auto-approve permission requests for risky tools with insufficient user interaction/guardrails, reducing the friction that should normally prevent silent execution or mutation.

Impact

If the Gateway is reachable by an attacker and they obtain a valid Gateway token, they may be able to:

  • Escalate from single-tool invocation to spawning/controlling sessions and reach command execution capabilities depending on tool policy and runtime environment.
  • Perform cross-session message injection via sessions_send.
  • In ACP-integrated scenarios, obtain unintended approvals for non-read/search tool permissions.

CVSS

  • CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8)

Affected versions

  • openclaw < 2026.2.14

Fixed in

  • openclaw >= 2026.2.14

Remediation

The default behavior is now hardened:

  • PR #15390: deny high-risk tools over HTTP /tools/invoke by default (with gateway.tools.{allow,deny} overrides) and harden ACP permission handling.
  • Commit bb1c3dfe1: ACP clients now prompt for any non-read/search permission request (fail closed for mutating/execution/fetch operations).
  • Commit 539689a2f: security audit warns when gateway.tools.allow re-enables default-denied HTTP tools, since this can increase RCE blast radius if the Gateway is reachable.
  • Commit 153a7644e: ACP safe-kind inference is stricter to avoid accidental auto-approval due to substring matches (still auto-approves only confident read/search).

Mitigations / deployment guidance

  • Keep the Gateway loopback-only unless you have a strong reason not to: gateway.bind="loopback" / openclaw gateway run --bind loopback.
  • Avoid exposing the Gateway directly to the public internet. Use an SSH tunnel or Tailscale to access a loopback-bound Gateway.
  • Treat opting in to default-denied HTTP tools (via gateway.tools.allow) as high-risk and audit such configurations carefully.

Credits

OpenClaw thanks @aether-ai-agent for reporting this issue and contributing remediation work.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmopenclawall versions2026.2.14npm install openclaw@2026.2.14

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openclaw, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update openclaw to 2026.2.14 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-943q-mwmv-hhvh is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-943q-mwmv-hhvh can be triaged on real exposure rather than presence alone.

Tailored to GHSA-943q-mwmv-hhvh. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary OpenClaw Gateway exposes an authenticated HTTP endpoint (`POST /tools/invoke`) intended for invoking a constrained set of tools. Two issues could combine to significantly increase blast radius in misconfigured or exposed deployments: - The HTTP gateway layer did not deny high-risk session orchestration tools by default, allowing a caller with Gateway auth to invoke tools like `sessions_spawn` / `sessions_send` and pivot into creating or controlling agent sessions. - ACP clients could auto-approve permission requests for risky tools with insufficient user interaction/guardrails, re
O3 Security · Impact-Aware SCA

Is GHSA-943q-mwmv-hhvh in your dependencies?

O3 Security finds GHSA-943q-mwmv-hhvh across npm dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
GHSA-943q-mwmv-hhvh: openclaw (High 8.8) | O3 Security