Threats tagged 'ghsa-q7q8-3mgw-q67r'

OpenClaw CLI versions before 2026.5.19 contain a vulnerability where message read actions can bypass channel allowlist checks. This allows lower-trust callers with access to these actions to request messages from channels they should not normally access. The impact depends on the operator's configuration and whether untrusted inputs can reach the vulnerable path. The issue does not affect the trusted-operator model but can expose sensitive messages if the feature is enabled and reachable. A fix is available in version 2026.5.19.