Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

GHSA-c28g-vh7m-fm7v

Fix: openclaw/openclaw@2aa93d4

GHSA-c28g-vh7m-fm7v is a CWE-863 vulnerability in openclaw. O3 Security confirms whether GHSA-c28g-vh7m-fm7v is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners

Also known asCVE-2026-44991
Published
Apr 29, 2026
Updated
May 19, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Aug 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-c28g-vh7m-fm7v.

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs15th percentile — riskier than 15% of all scored CVEsHighest risk
0.00%0.25%0.49%0.74%0.0%0.2%0.2%0.2%Jun 26Aug 26Aug 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

139other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
openclawnpm
2.6Mdownloads / week

Description

Impact

OpenClaw deployments before 2026.4.21 could treat a non-owner sender as authorized for owner-enforced slash commands when all of the following were true:

  • a channel plugin declared commands.enforceOwnerForCommands: true;
  • the channel accepted wildcard inbound senders with allowFrom: ["*"];
  • no explicit commands.ownerAllowFrom was configured.

In that state, src/auto-reply/command-auth.ts reused the channel inbound wildcard as part of the command-owner decision. A sender who was not the owner could therefore pass the owner-command gate for commands such as /send, /config, or /debug on the affected channel.

The issue is limited to the command-owner authorization axis. It does not by itself grant owner-only tool access, host/sandbox access, or gateway administrator scope.

Affected Packages / Versions

  • Package: openclaw on npm
  • Affected versions: <= 2026.4.20
  • Patched version: 2026.4.21

The latest public release, 2026.4.21, contains the fix.

Patches

The fix requires a concrete owner identity or internal operator-admin scope when a plugin enforces owner-only commands. Wildcard channel allowFrom no longer implies wildcard command ownership.

Fix commits:

  • 2aa93d44a1b2c7058c371f261fda2b5d4de4a882 on main
  • 995febb7b1e811ff6a1df5b18c22de94103f4c9f in the 2026.4.21 release line

Workarounds

Upgrade to [email protected] or later. Before upgrading, avoid wildcard/open-DM sender policy on owner-enforced channels, or configure commands.ownerAllowFrom to the intended owner identities.

Credits

OpenClaw thanks @zsxsoft for reporting.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmopenclawall versions2026.4.21

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openclaw. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update openclaw to 2026.4.21 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-c28g-vh7m-fm7v is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether GHSA-c28g-vh7m-fm7v is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-c28g-vh7m-fm7v. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Impact OpenClaw deployments before `2026.4.21` could treat a non-owner sender as authorized for owner-enforced slash commands when all of the following were true: - a channel plugin declared `commands.enforceOwnerForCommands: true`; - the channel accepted wildcard inbound senders with `allowFrom: ["*"]`; - no explicit `commands.ownerAllowFrom` was configured. In that state, `src/auto-reply/command-auth.ts` reused the channel inbound wildcard as part of the command-owner decision. A sender who was not the owner could therefore pass the owner-command gate for commands such as `/send`, `/co
O3 Security · Impact-Aware SCA

Is GHSA-c28g-vh7m-fm7v in your dependencies?

O3 detects GHSA-c28g-vh7m-fm7v across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works