CVE-2026-28473
OpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Command
概要
OpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Command
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending the /approve chat command. The /approve command path invokes exec.approval.resolve through an internal privileged gateway client, bypassing the operator.approvals permission check that protects direct RPC calls.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com