| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| openclaw | < 2026.2.23 | 2026.2.23 |
exec.approval requests for host=node were not explicitly bound to the target nodeId, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.
An operator approval for a system.run request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.
openclaw (npm)<= 2026.2.22-22026.2.23 (released)Upgrade to 2026.2.23 or later once published.
The fix requires and persists nodeId for host=node approval requests and rejects execution when the approving node binding does not match the invoking node.
patched_versions is pre-set to the released version (2026.2.23). This advisory now reflects released fix version 2026.2.23.
OpenClaw thanks @tdjackey for reporting.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí