Threats tagged 'ghsa-3c6j-hq33-3jv4'

OpenClaw CLI versions prior to 2026.5.18 contain a vulnerability where paired nodes can forge exec lifecycle events without sufficient provenance verification. This allows a malicious or compromised paired node to send crafted lifecycle events to the gateway, potentially causing the gateway to treat attacker-supplied data as legitimate exec lifecycle results. The vulnerability requires the attacker to already control a paired node connection and does not allow unauthenticated access to the gateway. The issue is resolved in version 2026.5.18.