GitHub Advisoryadvisory · npm

GHSA-rq6g-px6m-c248 OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting

HIGH Published 2026-02-18 Modified 2026-03-06 Official page ↗
Aliases
CVE-2026-28469
Ecosystem
npm
Packages
openclaw, clawdbot
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284, CWE-639
Reviewed
2026-02-18

Affected packages

• npm openclaw: < 2026.2.14 → fixed in 2026.2.14 • npm clawdbot: <= 2026.1.24-3 (no fix yet)

Description

Summary When multiple Google Chat webhook targets are registered on the same HTTP path, and request verification succeeds for more than one target, inbound webhook events could be routed by first-match semantics. This can cause cross-account policy/context misrouting. Affected Packages / Versions • npm: `openclaw` = 2026.2.14`. Workaround Ensure each Google Chat webhook target uses a unique webhook path so routing is never ambiguous. Release Process Note The advisory is pre-populated with the planned patched version. After the npm release is published, the remaining action should be to publish the advisory. Thanks @vincentkoc for reporting. --- Fix commit 61d59a802869177d9cef52204767cd83357ab79e confirmed on main and in v2026.2.14. Upgrade to `openclaw >= 2026.2.14`.

Related

Alias · CVE (1)

  • CVE-2026-28469 OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account… vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References