GitHub Advisoryadvisory · npm

GHSA-rvqr-hrcc-j9vv OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

MEDIUM Published 2026-03-26 Modified 2026-04-10 Official page ↗
Aliases
CVE-2026-35659
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-345, CWE-642
Reviewed
2026-03-26

Affected packages

• npm openclaw: < 2026.3.22 → fixed in 2026.3.22

Description

Summary Bonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target. Affected Packages / Versions • Package: `openclaw` (npm) • Affected: = 2026.3.22 • Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) • Latest published npm version checked: `2026.3.23-2` Fix Commit(s) • `deecf68b59a9b7eea978e40fd3c2fe543087b569` Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`. Code-Level Confirmation • src/infra/bonjour-discovery.ts now resolves and returns only concrete endpoints instead of falling back to unresolved TXT host and port hints. • src/cli/gateway-cli/discover.ts consumes only the fail-closed resolved endpoint path. OpenClaw thanks @nexrin for reporting.

Related

Alias · CVE (1)

  • CVE-2026-35659 OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing… vulnerability

Weakness · CWE (2)

  • CWE-345 Insufficient Verification of Data Authenticity weakness
  • CWE-642 External Control of Critical State Data weakness

References