GHSA-2q7j-2vhx-56g8: OpenClaw broken authz bypasses

Q: Is GHSA-2q7j-2vhx-56g8 actively exploited?

No confirmed active exploitation of GHSA-2q7j-2vhx-56g8 has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-2q7j-2vhx-56g8?

Upgrade to OpenClaw `2026.6.9` or later, where the authorization check is enforced correctly. Until patched, disable the Feishu tool/feature entirely if it isn't required, or restrict it to trusted operators only. Keep channel and tool allowlists narrow, and avoid sharing a single Gateway instance between mutually untrusted users or tenants. For detection, audit logs for any Feishu tool actions attributed to accounts that were explicitly disabled or flagged low-trust, and review the commit (`d4f11d3`) and PR #93363 to understand exactly which enforcement path was missing.

Q: What systems are affected by GHSA-2q7j-2vhx-56g8?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/tool integrations, multi-tenant AI gateways.

Q: What is the CVSS score for GHSA-2q7j-2vhx-56g8?

GHSA-2q7j-2vhx-56g8 has a CVSS v3.1 base score of 8.1 (HIGH).

CISO Take

OpenClaw's Feishu integration failed to enforce per-account disablement, meaning a lower-trust caller or a configured input path could trigger tool actions that should have required a stronger authorization or policy check. This is a CVSS 8.1 (network vector, low complexity, low privileges, no user interaction) incorrect-authorization flaw (CWE-863) with high confidentiality and integrity impact, so a caller you believed was locked out could still read or manipulate data through the agent's Feishu tool. There is no evidence of active exploitation — it's not in CISA KEV, no EPSS score is available, and no public exploit or scanner template exists — and the package shows only 3 tracked downstream dependents, which caps the immediate blast radius. The real exposure is operational: any Gateway shared across mutually untrusted users or tenants with the Feishu feature enabled is at risk right now, independent of internet-scale exploitation trends. Upgrade to `2026.6.9` immediately; until then, disable the Feishu feature or restrict it to trusted operators only, and keep tool/channel allowlists narrow.

Sources:GitHub AdvisoryATLAS

What is the risk?

The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a serious authorization gap: no user interaction is needed, complexity is low, and only low privileges are required to trigger the bypass, but availability is unaffected. Practical risk is gated by configuration — the flaw only matters if the Feishu tool feature is enabled and reachable by a caller who was supposed to be blocked by per-account disablement. There's no KEV listing, no EPSS percentile, and no known PoC or Nuclei template, so this is not yet an actively-weaponized bug; risk is currently theoretical/config-dependent rather than observed-in-the-wild. Downstream footprint is small (3 dependents), but any deployment that shares one Gateway across untrusted users or tenants should treat this as high priority given the confidentiality/integrity impact.

How does the attack unfold?

Entry via disabled or lower-trust channel

An attacker controls or routes a request through an account/input path that an operator had explicitly disabled for the Feishu tool.

AML.T0012

Authorization check bypass

The per-account disablement/policy check (CWE-863) is not enforced, letting the request reach the Feishu tool handler despite the intended restriction.

Unauthorized tool invocation

The Feishu tool executes the caller's requested action as if fully authorized, invoking agent tool capabilities that should have been blocked.

AML.T0053

Impact: confidentiality/integrity loss

The attacker gains unauthorized read or write access to Feishu workspace data or actions, matching the CVSS C:H/I:H impact.

AML.T0086

Entry via disabled or lower-trust channel

An attacker controls or routes a request through an account/input path that an operator had explicitly disabled for the Feishu tool.

AML.T0012

Authorization check bypass

The per-account disablement/policy check (CWE-863) is not enforced, letting the request reach the Feishu tool handler despite the intended restriction.

Unauthorized tool invocation

The Feishu tool executes the caller's requested action as if fully authorized, invoking agent tool capabilities that should have been blocked.

AML.T0053

Impact: confidentiality/integrity loss

The attacker gains unauthorized read or write access to Feishu workspace data or actions, matching the CVSS C:H/I:H impact.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	npm	< 2026.6.9-beta.1	`2026.6.9`
3 dependents32% patched~5d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

Upgrade to OpenClaw 2026.6.9 or later, where the authorization check is enforced correctly. Until patched, disable the Feishu tool/feature entirely if it isn't required, or restrict it to trusted operators only. Keep channel and tool allowlists narrow, and avoid sharing a single Gateway instance between mutually untrusted users or tenants. For detection, audit logs for any Feishu tool actions attributed to accounts that were explicitly disabled or flagged low-trust, and review the commit (d4f11d3) and PR #93363 to understand exactly which enforcement path was missing.

How is it classified?

Auth BypassPrivacy ViolationAgentPluginAML.T0012- Valid Accounts AML.T0053- AI Agent Tool Invocation AML.T0086- Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system deployment controls

NIST AI RMF

MANAGE-4.1-Risk treatment for third-party/access risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is GHSA-2q7j-2vhx-56g8?

OpenClaw's Feishu integration failed to enforce per-account disablement, meaning a lower-trust caller or a configured input path could trigger tool actions that should have required a stronger authorization or policy check. This is a CVSS 8.1 (network vector, low complexity, low privileges, no user interaction) incorrect-authorization flaw (CWE-863) with high confidentiality and integrity impact, so a caller you believed was locked out could still read or manipulate data through the agent's Feishu tool. There is no evidence of active exploitation — it's not in CISA KEV, no EPSS score is available, and no public exploit or scanner template exists — and the package shows only 3 tracked downstream dependents, which caps the immediate blast radius. The real exposure is operational: any Gateway shared across mutually untrusted users or tenants with the Feishu feature enabled is at risk right now, independent of internet-scale exploitation trends. Upgrade to `2026.6.9` immediately; until then, disable the Feishu feature or restrict it to trusted operators only, and keep tool/channel allowlists narrow.

Is GHSA-2q7j-2vhx-56g8 actively exploited?

No confirmed active exploitation of GHSA-2q7j-2vhx-56g8 has been reported, but organizations should still patch proactively.

How to fix GHSA-2q7j-2vhx-56g8?

Upgrade to OpenClaw `2026.6.9` or later, where the authorization check is enforced correctly. Until patched, disable the Feishu tool/feature entirely if it isn't required, or restrict it to trusted operators only. Keep channel and tool allowlists narrow, and avoid sharing a single Gateway instance between mutually untrusted users or tenants. For detection, audit logs for any Feishu tool actions attributed to accounts that were explicitly disabled or flagged low-trust, and review the commit (`d4f11d3`) and PR #93363 to understand exactly which enforcement path was missing.

What systems are affected by GHSA-2q7j-2vhx-56g8?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/tool integrations, multi-tenant AI gateways.

What is the CVSS score for GHSA-2q7j-2vhx-56g8?

GHSA-2q7j-2vhx-56g8 has a CVSS v3.1 base score of 8.1 (HIGH).

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin/tool integrationsmulti-tenant AI gateways

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0053AI Agent Tool Invocation

AML.T0086Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

### Summary Feishu tools could ignore per-account disablement. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed. ### Impact When the affected feature is enabled and reachable, this could perform actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. ### Patched Versions The first stable patched version is `2026.6.9`. ### Mitigations Upgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.

Exploitation Scenario

An operator disables a specific user's or channel's access to the Feishu tool inside their OpenClaw Gateway deployment, expecting that account to be fully locked out. An attacker controlling that disabled account (or able to route input through the affected lower-trust input path) sends a request that reaches the Feishu tool handler anyway, because the per-account disablement check is not enforced (CWE-863). The tool executes as if the caller were still authorized, letting the attacker read confidential Feishu messages/data or perform integrity-impacting actions (e.g., posting or modifying content) inside the connected workspace, all without needing user interaction or high privileges.

Weaknesses (CWE)

CWE-863Incorrect AuthorizationPrimary

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.