Description
OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misrouting when multiple webhook targets share the same HTTP path. Attackers can exploit first-match request verification semantics to process inbound webhook events under incorrect account contexts, bypassing intended allowlists and session policies.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenClaw | OpenClaw | < 2026.2.14 | 2026.2.14 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | clawdbot | <= 2026.1.24-3 | — | GHSA-rq6g-px6m-c248 |
| npm | openclaw | < 2026.2.14 | 2026.2.14 | GHSA-rq6g-px6m-c248 |
Advisories 1
- WID-SEC-2026-0424 OpenClaw: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 5, 2026
References
- GitHub Security Advisory (GHSA-rq6g-px6m-c248) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: OpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity third-party-advisory