Threats Tagged 'ghsa-p39j-x9h5-q66m'

OpenClaw contains a vulnerability where its embedded runner policy can be confused by provider aliases. This means that requests using provider aliases might be evaluated against an alias rather than the canonical provider identity, potentially allowing access to bundled tools outside the intended provider policy. The issue affects versions prior to 2026.4.25. The vulnerability does not alter the trusted-operator model of OpenClaw but depends on operator configuration and exposure to lower-trust inputs. A fix is available starting with version 2026.4.25. Until patched, it is recommended to avoid provider alias routing for embedded runner tool policy and to apply configuration hardening such as narrowing allowlists and disabling the affected feature if not needed.