OpenClaw: Channel read actions could skip target allowlistsGHSA-g7fw-3gjp-g5hf
MEDIUMFix: openclaw/openclaw#99905GHSA-g7fw-3gjp-g5hf is a medium-severity (CVSS 6.5) CWE-862 vulnerability in @openclaw/msteams. A fix is available for @openclaw/msteams — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-g7fw-3gjp-g5hf.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-g7fw-3gjp-g5hf by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@openclaw/msteamsnpm@openclaw/feishunpm@openclaw/matrixnpmDescription
Summary
Channel read actions could skip target allowlists. In affected versions, explicit read targets in Microsoft Teams, Feishu, Matrix, and Google Chat could reach channels or rooms outside the configured read policy.
This advisory is scoped to caller-supplied targets for message, reaction, pin, member, and related metadata reads in the named plugins. It does not change OpenClaw's trusted-operator model or create per-user isolation within one Gateway.
Impact
A lower-trust sender or steered agent with access to a channel read action could retrieve content or metadata from a target excluded by the operator's channel allowlist. Practical impact depends on the bot account's platform permissions.
Patched Versions
The first stable patched version is 2026.8.1.
Mitigations
upgrade each affected channel plugin to 2026.8.1 or later. Before upgrading, disable explicit-target read actions or limit the connected bot account to allowed channels at the platform level.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @openclaw/msteams | all versions | 2026.8.1npm install @openclaw/msteams@2026.8.1 |
| 📦npm | @openclaw/feishu | all versions | 2026.8.1npm install @openclaw/feishu@2026.8.1 |
| 📦npm | @openclaw/matrix | all versions | 2026.8.1npm install @openclaw/matrix@2026.8.1 |
| 📦npm | @openclaw/googlechat | all versions | 2026.8.1npm install @openclaw/googlechat@2026.8.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @openclaw/msteams, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @openclaw/msteams to 2026.8.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g7fw-3gjp-g5hf is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is GHSA-g7fw-3gjp-g5hf in your dependencies?
Find it across npm, including transitive dependencies.