{"action":"Upgrade openclaw to 2026.2.23 or later.","affected":[{"fixed":"2026.2.23","introduced":"0"}],"component":"openclaw","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2026.2.23"],"ghsa_id":"GHSA-2ch6-x3g4-7759","id":"tcs_01M5KEST19T2VSAV1SMCJHPRCW","modified_at":"2026-03-04T15:09:59.987542Z","published_at":"2026-03-03T23:19:46Z","references":["https://osv.dev/vulnerability/GHSA-2ch6-x3g4-7759","https://github.com/openclaw/openclaw/security/advisories/GHSA-2ch6-x3g4-7759","https://github.com/openclaw/openclaw/commit/08e2aa44e78a9c946d97bea62304e6f533b8fa8e","https://github.com/openclaw/openclaw"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-2ch6-x3g4-7759","url":"https://osv.dev/vulnerability/GHSA-2ch6-x3g4-7759"}],"summary":"OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From"}