{"data":{"id":"7c59433c-ef9f-4894-a94c-d37fa880a65f","title":"GHSA-5847-rm3g-23mw: OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants","summary":"OpenClaw's hook authentication throttle keyed failed attempts by raw socket remoteAddress text, so IPv4 and IPv4-mapped IPv6 forms of the same client (such as 1.2.3.4 and ::ffff:1.2.3.4) received separate rate-limit buckets. An attacker could split failed attempts across both forms and double the brute-force budget from 20 to 40 attempts per 60-second window. Affected are the openclaw npm package at versions <= 2026.2.21-2, in src/gateway/server-http.ts and src/gateway/auth-rate-limit.ts.","solution":"Patched version (planned next release): 2026.2.22. The remediation centralizes and reuses canonical client-IP normalization for auth rate-limiting, and uses that canonical key for hook auth throttling. Fix commit: 3284d2eb227e7b6536d543bcf5c3e320bc9d13c5.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-5847-rm3g-23mw","publishedAt":"2026-03-03T00:38:48.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.22 (fixed: 2026.2.22)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-5847-rm3g-23mw"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-23T00:36:27.582Z","daysToFix":-8,"fixCheckedAt":"2026-10-29T21:40:21.364Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.22","matchedVersion":"2026.2.22","fixReleasedAt":"2026-02-23T00:36:27.582Z","daysToFix":-8,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:21.218Z"}]}}