{"action":"Upgrade openclaw to 2026.2.21 or later.","affected":[{"fixed":"2026.2.21","introduced":"0"}],"component":"openclaw","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2026.2.21"],"ghsa_id":"GHSA-cjv3-m589-v3rx","id":"tcs_01M5KFK1HF0RNYPWGRTZ0VXXSA","modified_at":"2026-03-04T15:14:04.950421Z","published_at":"2026-03-03T23:17:06Z","references":["https://osv.dev/vulnerability/GHSA-cjv3-m589-v3rx","https://github.com/openclaw/openclaw/security/advisories/GHSA-cjv3-m589-v3rx","https://github.com/openclaw/openclaw/commit/08a7967936cfc0b2af6b27ec1f9272542648ad6c","https://github.com/openclaw/openclaw/commit/c45f3c5b004c8d63dc0e282e2176f8c9355d24f1","https://github.com/openclaw/openclaw"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-cjv3-m589-v3rx","url":"https://osv.dev/vulnerability/GHSA-cjv3-m589-v3rx"}],"summary":"OpenClaw has Canvas route hardening for mixed-trust deployments"}