Threats tagged 'ghsa-p39j-x9h5-q66m'

OpenClaw CLI has a vulnerability where the embedded runner policy can be confused by provider aliases. This means that requests using provider aliases might compare policy against an alias rather than the canonical provider identity, potentially allowing access to bundled tools outside the intended provider policy. The issue affects versions before 2026.4.25. The vulnerability has a low severity score and does not affect the trusted-operator model of OpenClaw. Mitigation includes avoiding provider alias routing for embedded runner tool policy until patched and applying general hardening measures.