GHSA-g27f-9qjv-22pm: OpenClaw log poisoning (indirect prompt injection) via WebSocket headers
- Identifier
- GHSA-g27f-9qjv-22pm
- Published
- Record updated
- Affected
- openclaw < 2026.2.13
- Fixed in
- 2026.2.13
- released February 13, 2026, 3 days before disclosure
Summary
OpenClaw versions up to and including 2026.2.12 logged WebSocket request headers such as Origin and User-Agent without neutralization or length limits when a connection closed before the connect handshake completed. An unauthenticated client that can reach the gateway can send crafted header values that are written into core logs. The main risk is indirect prompt injection (log poisoning) when those logs are later read by an LLM, and the advisory says impact is limited if logs are not fed into an LLM or other automation.
Mitigation
Fixed in 2026.2.13 (openclaw >= 2026.2.13), which sanitizes and truncates header values written to gateway logs, including removal of control and format characters and length limiting. Fix commits: d637a263505448bf4505b85535babbfaacedbaac, e84318e4bcdc948d92e57fda1eb763a65e1774f0 (PR #15592). Additional workarounds: treat logs as untrusted input during AI-assisted debugging (sanitize or escape them, and do not auto-execute instructions derived from logs), restrict gateway network exposure, and apply reverse-proxy limits on header size where applicable.
Topics
Related items
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
- MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
- InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)