{"data":{"id":"9780d2cb-41a4-4581-bcc2-bbfa9793160a","title":"GHSA-943q-mwmv-hhvh: OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval","summary":"OpenClaw Gateway's authenticated POST /tools/invoke endpoint did not deny high-risk session orchestration tools such as sessions_spawn and sessions_send by default, so a caller holding a valid Gateway token could create or control agent sessions and inject messages across sessions. ACP clients could also auto-approve permission requests for risky tools with insufficient user interaction. The advisory rates it CVSS 8.8 and affects openclaw versions before 2026.2.14.","solution":"Fixed in openclaw >= 2026.2.14. The default now denies high-risk tools over HTTP /tools/invoke (overridable with gateway.tools.{allow,deny}), ACP clients prompt for any non-read/search permission request, and ACP safe-kind inference is stricter. Deployment guidance: keep the Gateway loopback-only (gateway.bind=\"loopback\" or openclaw gateway run --bind loopback), avoid direct public internet exposure and use an SSH tunnel or Tailscale instead, and audit any configuration that opts into default-denied HTTP tools via gateway.tools.allow.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-943q-mwmv-hhvh","publishedAt":"2026-03-02T23:32:22.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.14 (fixed: 2026.2.14)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-943q-mwmv-hhvh"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-15T02:59:48.267Z","daysToFix":-15,"fixCheckedAt":"2026-10-29T21:40:22.107Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.14","matchedVersion":"2026.2.14","fixReleasedAt":"2026-02-15T02:59:48.267Z","daysToFix":-15,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:21.961Z"}]}}