Threats tagged 'ghsa-wwfp-w96m-c6x8'

OpenClaw versions from 2026.2.26 up to but not including 2026.3.31 enforced pending pairing-request caps per channel file rather than per account. This allowed requests from other accounts on multi-account channels to fill the shared pending window, blocking new pairing challenges on unaffected accounts. The issue caused denial of service for new pairing or onboarding requests on other accounts until existing requests were resolved. It did not permit cross-account approval, data access, or authorization bypass. The vulnerability was fixed in version 2026.3.31.