Threats tagged 'ghsa-v8qf-fr4g-28p2'

OpenClaw versions prior to 2026.4.20 contain a vulnerability in the assistant-media route where trusted-proxy callers were authenticated but the enforcement of operator scopes on identity-bearing HTTP auth paths was missing. This allowed trusted-proxy callers without the required operator.read scope to access assistant-media files and metadata within allowed media roots. The route still required gateway authentication and media-root checks. The issue is fixed in version 2026.4.20.