| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| openclaw | < 2026.3.1 | 2026.3.1 |
| openclaw | < 2026.3.1 | 2026.3.1 |
An authorization mismatch allowed authenticated callers with operator.write access to invoke owner-only tool surfaces (gateway, cron) through agent runs in scoped-token deployments.
On affected deployments, write-scoped callers could perform control-plane actions beyond intended write scope.
Owner-only gating is now enforced consistently for owner-only tool surfaces during agent execution, and tool scope classification was tightened to remove the privilege mismatch.
<= 2026.2.262026.3.1これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン