Skip to content

Commit cfb7537

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7wq2-32h4-9hc9 GHSA-2f7j-rp58-mr42 GHSA-37v6-fxx8-xjmx GHSA-42mx-vp8m-j7qh GHSA-6336-qqw9-v6x6 GHSA-mhr7-2xmv-4c4q GHSA-qcc3-jqwp-5vh2 GHSA-rfqg-qgf8-xr9x GHSA-rvvf-6vh3-9j43 GHSA-wwfp-w96m-c6x8 GHSA-xj9w-5r6q-x6v4
1 parent cf7af1f commit cfb7537

11 files changed

Lines changed: 351 additions & 35 deletions

File tree

‎advisories/github-reviewed/2025/11/GHSA-7wq2-32h4-9hc9/GHSA-7wq2-32h4-9hc9.json‎

Lines changed: 173 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7wq2-32h4-9hc9",
4-
"modified": "2025-11-13T22:22:34Z",
4+
"modified": "2026-05-06T23:24:24Z",
55
"published": "2025-11-13T22:22:34Z",
66
"aliases": [],
77
"summary": "AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance",
8-
"details": "### Description of Vulnerability: \nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nAWS recommends customers upgrade to the following versions: AWS Go Wrapper to 2025-10-17.\n\n\n### Source of Vulnerability Report: \nAllistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)\n\n\n### Affected products & versions: \nAWS Go Wrapper < 2025-10-17.\n\n\n### Platforms:\n MacOS/Windows/Linux",
8+
"details": "### Description of Vulnerability: \nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nWe recommend customers upgrade to the following versions: AWS Go Wrapper to 2025-10-17\n\n\n### Source of Vulnerability Report: \nAllistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)\n\n\n### Affected products & versions: \nAWS Go Wrapper < 2025-10-17\n\n\n### Platforms:\n MacOS/Windows/Linux",
99
"severity": [
1010
{
1111
"type": "CVSS_V3",
@@ -31,6 +31,177 @@
3131
]
3232
}
3333
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "Go",
38+
"name": "github.com/aws/aws-advanced-go-wrapper/auth-helpers"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "0"
46+
},
47+
{
48+
"fixed": "1.0.2"
49+
}
50+
]
51+
}
52+
]
53+
},
54+
{
55+
"package": {
56+
"ecosystem": "Go",
57+
"name": "github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager"
58+
},
59+
"ranges": [
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "0"
65+
},
66+
{
67+
"fixed": "1.0.2"
68+
}
69+
]
70+
}
71+
]
72+
},
73+
{
74+
"package": {
75+
"ecosystem": "Go",
76+
"name": "github.com/aws/aws-advanced-go-wrapper/federated-auth"
77+
},
78+
"ranges": [
79+
{
80+
"type": "ECOSYSTEM",
81+
"events": [
82+
{
83+
"introduced": "0"
84+
},
85+
{
86+
"fixed": "1.0.2"
87+
}
88+
]
89+
}
90+
]
91+
},
92+
{
93+
"package": {
94+
"ecosystem": "Go",
95+
"name": "github.com/aws/aws-advanced-go-wrapper/iam"
96+
},
97+
"ranges": [
98+
{
99+
"type": "ECOSYSTEM",
100+
"events": [
101+
{
102+
"introduced": "0"
103+
},
104+
{
105+
"fixed": "1.0.2"
106+
}
107+
]
108+
}
109+
]
110+
},
111+
{
112+
"package": {
113+
"ecosystem": "Go",
114+
"name": "github.com/aws/aws-advanced-go-wrapper/mysql-driver"
115+
},
116+
"ranges": [
117+
{
118+
"type": "ECOSYSTEM",
119+
"events": [
120+
{
121+
"introduced": "0"
122+
},
123+
{
124+
"fixed": "1.0.2"
125+
}
126+
]
127+
}
128+
]
129+
},
130+
{
131+
"package": {
132+
"ecosystem": "Go",
133+
"name": "github.com/aws/aws-advanced-go-wrapper/okta"
134+
},
135+
"ranges": [
136+
{
137+
"type": "ECOSYSTEM",
138+
"events": [
139+
{
140+
"introduced": "0"
141+
},
142+
{
143+
"fixed": "1.0.2"
144+
}
145+
]
146+
}
147+
]
148+
},
149+
{
150+
"package": {
151+
"ecosystem": "Go",
152+
"name": "github.com/aws/aws-advanced-go-wrapper/otlp"
153+
},
154+
"ranges": [
155+
{
156+
"type": "ECOSYSTEM",
157+
"events": [
158+
{
159+
"introduced": "0"
160+
},
161+
{
162+
"fixed": "1.0.2"
163+
}
164+
]
165+
}
166+
]
167+
},
168+
{
169+
"package": {
170+
"ecosystem": "Go",
171+
"name": "github.com/aws/aws-advanced-go-wrapper/pgx-driver"
172+
},
173+
"ranges": [
174+
{
175+
"type": "ECOSYSTEM",
176+
"events": [
177+
{
178+
"introduced": "0"
179+
},
180+
{
181+
"fixed": "1.0.2"
182+
}
183+
]
184+
}
185+
]
186+
},
187+
{
188+
"package": {
189+
"ecosystem": "Go",
190+
"name": "github.com/aws/aws-advanced-go-wrapper/xray"
191+
},
192+
"ranges": [
193+
{
194+
"type": "ECOSYSTEM",
195+
"events": [
196+
{
197+
"introduced": "0"
198+
},
199+
{
200+
"fixed": "1.0.2"
201+
}
202+
]
203+
}
204+
]
34205
}
35206
],
36207
"references": [

‎advisories/github-reviewed/2026/04/GHSA-2f7j-rp58-mr42/GHSA-2f7j-rp58-mr42.json‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2f7j-rp58-mr42",
4-
"modified": "2026-04-07T18:15:44Z",
4+
"modified": "2026-05-06T23:24:51Z",
55
"published": "2026-04-07T18:15:44Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-41339"
8+
],
79
"summary": "OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients",
810
"details": "## Summary\n\nBefore OpenClaw 2026.4.2, the Gateway `connect` success snapshot exposed local `configPath` and `stateDir` metadata to non-admin clients. Low-privilege authenticated clients could learn host filesystem layout and deployment details that were not needed for their role.\n\n## Impact\n\nA non-admin client could recover host-specific filesystem paths and related deployment metadata, aiding host fingerprinting and chained attacks. This was an information-disclosure issue, not a direct authorization bypass.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.4.1`\n- Patched versions: `>= 2026.4.2`\n- Latest published npm version: `2026.4.1`\n\n## Fix Commit(s)\n\n- `676b748056b5efca6f1255708e9dd9469edf5e2e` — limit connect snapshot metadata to admin-scoped clients\n\n## Release Process Note\n\nThe fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.\n\nThanks @topsec-bunney for reporting.",
911
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
},
1016
{
1117
"type": "CVSS_V4",
1218
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
@@ -41,13 +47,21 @@
4147
"type": "WEB",
4248
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-2f7j-rp58-mr42"
4349
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41339"
53+
},
4454
{
4555
"type": "WEB",
4656
"url": "https://github.com/openclaw/openclaw/commit/676b748056b5efca6f1255708e9dd9469edf5e2e"
4757
},
4858
{
4959
"type": "PACKAGE",
5060
"url": "https://github.com/openclaw/openclaw"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://www.vulncheck.com/advisories/openclaw-information-disclosure-via-gateway-connect-snapshot"
5165
}
5266
],
5367
"database_specific": {

‎advisories/github-reviewed/2026/04/GHSA-37v6-fxx8-xjmx/GHSA-37v6-fxx8-xjmx.json‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,21 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-37v6-fxx8-xjmx",
4-
"modified": "2026-04-03T02:58:17Z",
4+
"modified": "2026-05-06T23:25:13Z",
55
"published": "2026-04-03T02:58:17Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-41351"
8+
],
79
"summary": "OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding",
810
"details": "## Summary\nTelnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding\n\n## Current Maintainer Triage\n- Status: narrow\n- Normalized severity: low\n- Assessment: Shipped v2026.3.28 replay hashing treated equivalent Telnyx Base64/Base64URL signatures as distinct requests, but signature verification still held, so lower to low.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version: `2026.3.31`\n- Vulnerable version range: `<=2026.3.28`\n- Patched versions: `>= 2026.3.31`\n- First stable tag containing the fix: `v2026.3.31`\n\n## Fix Commit(s)\n- `ad77666054651c1fd77b1dc60fd6a8db6600a29a` — 2026-03-30T20:01:43+01:00\n\n## Release Process Note\n- The fix is already present in released version `2026.3.31`.\n- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.\n\nOpenClaw thanks @AntAISecurityLab for reporting.",
911
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
15+
},
1016
{
1117
"type": "CVSS_V4",
12-
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
1319
}
1420
],
1521
"affected": [
@@ -41,6 +47,10 @@
4147
"type": "WEB",
4248
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-37v6-fxx8-xjmx"
4349
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41351"
53+
},
4454
{
4555
"type": "WEB",
4656
"url": "https://github.com/openclaw/openclaw/commit/ad77666054651c1fd77b1dc60fd6a8db6600a29a"
@@ -52,13 +62,17 @@
5262
{
5363
"type": "WEB",
5464
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.31"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://www.vulncheck.com/advisories/openclaw-webhook-replay-detection-bypass-via-base64-signature-re-encoding"
5569
}
5670
],
5771
"database_specific": {
5872
"cwe_ids": [
5973
"CWE-294"
6074
],
61-
"severity": "LOW",
75+
"severity": "MODERATE",
6276
"github_reviewed": true,
6377
"github_reviewed_at": "2026-04-03T02:58:17Z",
6478
"nvd_published_at": null

‎advisories/github-reviewed/2026/04/GHSA-42mx-vp8m-j7qh/GHSA-42mx-vp8m-j7qh.json‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,21 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-42mx-vp8m-j7qh",
4-
"modified": "2026-04-07T18:11:21Z",
4+
"modified": "2026-05-06T23:25:20Z",
55
"published": "2026-04-07T18:11:21Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-41355"
8+
],
79
"summary": "OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup",
810
"details": "## Summary\nOpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup\n\n## Current Maintainer Triage\n- Status: narrow\n- Normalized severity: medium\n- Assessment: Real on shipped <=2026.3.22 OpenShell mirror sync, but exploit needs mirror mode plus hooks enabled plus explicit hook opt-in plus restart, so high is overstated even though the direct fix shipped in v2026.3.28.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version: `2026.3.31`\n- Vulnerable version range: `<=2026.3.24`\n- Patched versions: `>= 2026.3.28`\n- First stable tag containing the fix: `v2026.3.28`\n\n## Fix Commit(s)\n- `c02ee8a3a4cb390b23afdf21317aa8b2096854d1` — 2026-03-25T19:59:07Z\n\n## Release Process Note\n- The fix is already present in released version `2026.3.28`.\n- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.\n\nThanks @tdjackey for reporting.",
911
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
15+
},
1016
{
1117
"type": "CVSS_V4",
12-
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
18+
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
1319
}
1420
],
1521
"affected": [
@@ -41,13 +47,21 @@
4147
"type": "WEB",
4248
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-42mx-vp8m-j7qh"
4349
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41355"
53+
},
4454
{
4555
"type": "WEB",
4656
"url": "https://github.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1"
4757
},
4858
{
4959
"type": "PACKAGE",
5060
"url": "https://github.com/openclaw/openclaw"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://www.vulncheck.com/advisories/openshell-arbitrary-code-execution-via-mirror-mode-sandbox-file-conversion"
5165
}
5266
],
5367
"database_specific": {

‎advisories/github-reviewed/2026/04/GHSA-6336-qqw9-v6x6/GHSA-6336-qqw9-v6x6.json‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,21 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6336-qqw9-v6x6",
4-
"modified": "2026-04-06T23:06:22Z",
4+
"modified": "2026-05-06T23:24:54Z",
55
"published": "2026-04-03T03:26:51Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-41341"
8+
],
79
"summary": "OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message",
810
"details": "## Summary\nDiscord Component Interaction Misclassifies Group DM as Direct Message\n\n## Current Maintainer Triage\n- Status: narrow\n- Normalized severity: low\n- Assessment: Real on shipped v2026.3.24 component-interaction routing/auth in extensions/discord/src/monitor/agent-components-helpers.ts, but impact is limited to Group DM policy or session misclassification.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version: `2026.3.31`\n- Vulnerable version range: `<=2026.3.28`\n- Patched versions: `>= 2026.3.31`\n- First stable tag containing the fix: `v2026.3.31`\n\n## Fix Commit(s)\n- `8c83128fc38d5a3642b8ccbea58550755fdbbbaf` — 2026-03-30T11:17:53-06:00\n\n## Release Process Note\n- The fix is already present in released version `2026.3.31`.\n- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.\n\nThanks @nexrin for reporting.",
911
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
15+
},
1016
{
1117
"type": "CVSS_V4",
12-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
1319
}
1420
],
1521
"affected": [
@@ -41,6 +47,10 @@
4147
"type": "WEB",
4248
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-6336-qqw9-v6x6"
4349
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41341"
53+
},
4454
{
4555
"type": "WEB",
4656
"url": "https://github.com/openclaw/openclaw/commit/8c83128fc38d5a3642b8ccbea58550755fdbbbaf"
@@ -52,13 +62,18 @@
5262
{
5363
"type": "WEB",
5464
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.31"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://www.vulncheck.com/advisories/openclaw-component-interaction-misclassification-in-discord-extension"
5569
}
5670
],
5771
"database_specific": {
5872
"cwe_ids": [
73+
"CWE-351",
5974
"CWE-863"
6075
],
61-
"severity": "MODERATE",
76+
"severity": "LOW",
6277
"github_reviewed": true,
6378
"github_reviewed_at": "2026-04-03T03:26:51Z",
6479
"nvd_published_at": null

0 commit comments

Comments
 (0)