GitHub Advisoryadvisory · npm
GHSA-5gjc-grvm-m88j OpenClaw: Memory dreaming config persistence was reachable from operator.write commands
MEDIUM
Official page ↗
- Aliases
- CVE-2026-43568
- Ecosystem
- npm
- Packages
- openclaw
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-266, CWE-863
- Reviewed
- 2026-04-17
Affected packages
• npm openclaw: >= 2026.4.5, < 2026.4.10 → fixed in 2026.4.10
Description
Summary
Memory dreaming config persistence was reachable from operator.write commands.
Affected Packages / Versions
• Package: `openclaw`
• Ecosystem: npm
• Affected versions: `>= 2026.4.5 = 2026.4.10`
Impact
A write-scoped gateway path could toggle persistent memory dreaming settings through `/dreaming`, crossing into an admin-class configuration mutation.
Technical Details
The fix requires admin scope for persistent dreaming gateway toggles.
Fix
The issue was fixed in #63872. The first stable tag containing the fix is `v2026.4.10`, and `[email protected]` includes the fix.
Fix Commit(s)
• `6af17b39e11f5f35e23b7e5a5f71a7d0aa3c7310`
• PR: #63872
Release Process Note
Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.
Credits
Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Related
Alias · CVE (1)
- CVE-2026-43568 OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify… vulnerability