Description
OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval authorization. Attackers can resolve pending approvals without proper authorization by exploiting this logic flaw if they know an approval id.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenClaw | OpenClaw | < 2026.4.12 | 2026.4.12 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | openclaw | < 2026.4.12 | 2026.4.12 | GHSA-49cg-279w-m73x |
Advisories 1
- WID-SEC-2026-1174 OpenClaw: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · May 5, 2026
References
- GitHub Security Advisory (GHSA-49cg-279w-m73x) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists third-party-advisory