Threats tagged 'ghsa-49qj-frf3-688h'

CVE-2026-100525 is a medium severity vulnerability in the OpenClaw diagnostics-prometheus plugin before version 2026.9.3. The plugin fails to enforce the operator.read scope on its authenticated metrics endpoint, allowing authenticated users without read scope to access operational metrics. This affects deployments using identity-bearing Gateway authentication modes like trusted-proxy. The issue is fixed in version 2026.9.3. Workarounds include disabling the Prometheus endpoint or restricting access to identities with operator.read scope.