GHSA-v6x2-2qvm-6gv8: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback
- Identifier
- GHSA-v6x2-2qvm-6gv8
- Published
- Record updated
- Affected
- openclaw <= 2026.2.21-2
- Fixed in
- 2026.2.22
- released February 22, 2026, 8 days before disclosure
Summary
OpenClaw, the npm package `openclaw`, reused `gateway.auth.token` and `gateway.remote.token` as a fallback secret for hashing owner IDs in prompts when `commands.ownerDisplay=hash` is set and `commands.ownerDisplaySecret` is unset. This linked gateway authentication to prompt metadata hashing, and the hash outputs are visible to third-party model providers in system prompts, though no plaintext token is disclosed directly. Risk is highest when operators use weak gateway tokens and leave the owner hash secret unset. Versions up to and including 2026.2.21-2 are affected.
Mitigation
Fixed in 2026.2.22 (planned next release). The fix removes the fallback to `gateway.auth.token` and `gateway.remote.token`, and auto-generates and persists a dedicated `commands.ownerDisplaySecret` when hash mode is enabled and the secret is missing.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online