{"action":"Upgrade openclaw to 2026.2.22 or later.","affected":[{"fixed":"2026.2.22","introduced":"0"}],"component":"openclaw","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2026.2.22"],"ghsa_id":"GHSA-f6h3-846h-2r8w","id":"tcs_01M5KFMP6SFXC7EWPSNJMWSPG0","modified_at":"2026-03-04T19:16:14.145969Z","published_at":"2026-03-04T18:58:07Z","references":["https://osv.dev/vulnerability/GHSA-f6h3-846h-2r8w","https://github.com/openclaw/openclaw/security/advisories/GHSA-f6h3-846h-2r8w","https://github.com/openclaw/openclaw/commit/6817c0ec7b4fa830123d4f5c340f075a4bd04ee2","https://github.com/openclaw/openclaw"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-f6h3-846h-2r8w","url":"https://osv.dev/vulnerability/GHSA-f6h3-846h-2r8w"}],"summary":"OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization"}