GHSA-gp79-m99v-gjmh: OpenClaw fail-open bypasses

Q: Is GHSA-gp79-m99v-gjmh actively exploited?

No confirmed active exploitation of GHSA-gp79-m99v-gjmh has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-gp79-m99v-gjmh?

Upgrade OpenClaw to the patched release 2026.5.6 or later, where the first stable fix ships. Until patched: restrict Mattermost bot access to trusted channels only, keep channel and tool allowlists narrow, avoid sharing a single Gateway between mutually untrusted users, and disable the affected Mattermost DM-gating feature entirely if it isn't required. For detection, review logs for Mattermost events with missing or malformed channel-type metadata and audit Gateway logs for messages that were processed outside the expected DM-only path — treat repeated metadata errors as a signal worth investigating rather than noise.

Q: What systems are affected by GHSA-gp79-m99v-gjmh?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, chat/messaging integrations for AI agents.

Q: What is the CVSS score for GHSA-gp79-m99v-gjmh?

No CVSS score has been assigned yet.

CISO Take

A patched OpenClaw bug (GHSA-gp79-m99v-gjmh) let Mattermost-sourced events skip the intended DM policy check whenever the event was missing channel-type metadata, so input that should have been restricted to trusted direct-message context could instead be processed as if it were allowed. This is a classic 'fail open' flaw (CWE-636) in an AI agent gateway's trust boundary, not a remote-code or data-exfiltration bug on its own, and the advisory explicitly scopes it to a specific feature rather than the whole trusted-operator model. Real-world urgency is low right now: it's not in CISA KEV, there's no EPSS score or public exploit/scanner template, and OpenSSF/dependent signals show only 4 downstream consumers, so this hasn't been weaponized or widely deployed against. Still, patch to 2026.5.6 promptly since any org running OpenClaw's Mattermost integration as an agent input channel is trusting that policy gate to keep untrusted chat traffic out of privileged agent context. Until patched, restrict bot access, keep channel/tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and watch logs for channel-metadata errors as a detection signal.

Sources: GitHub Advisory ATLAS CISA KEV

What is the risk?

Medium severity as rated, and that tracks: this is an access-control logic gap (CWE-636, failing open) rather than a memory-corruption or auth-bypass-to-RCE bug. No CVSS vector, no EPSS percentile, not in CISA KEV, no public PoC or Nuclei template — nothing suggests active or imminent mass exploitation. The limited blast radius (4 known downstream dependents, package risk score 0/100 reflecting low visibility rather than confirmed safety) further narrows exposure to organizations that specifically wired Mattermost into an OpenClaw Gateway deployment. The real risk is conditional: it only matters where the affected DM-gating feature is enabled and reachable by lower-trust input, and where an attacker can actually trigger or induce a malformed/missing channel-type event.

How does the attack unfold?

Entry point

A Mattermost event reaches the OpenClaw Gateway without valid channel-type metadata, whether by malformed input, integration bug, or crafted request.

AML.T0093

Policy check fails open

The handler cannot evaluate the missing channel type and, due to CWE-636, proceeds instead of denying or applying the stricter DM policy.

Untrusted content processed

Content that should have been restricted to trusted DM context is passed into the agent's processing pipeline with unintended trust level.

AML.T0051.001

Impact

Depending on downstream agent logic and operator configuration, this could expose the agent to input it was never meant to trust, within the bounds of OpenClaw's existing trusted-operator model.

Entry point

A Mattermost event reaches the OpenClaw Gateway without valid channel-type metadata, whether by malformed input, integration bug, or crafted request.

AML.T0093

Policy check fails open

The handler cannot evaluate the missing channel type and, due to CWE-636, proceeds instead of denying or applying the stricter DM policy.

Untrusted content processed

Content that should have been restricted to trusted DM context is passed into the agent's processing pipeline with unintended trust level.

AML.T0051.001

Impact

Depending on downstream agent logic and operator configuration, this could expose the agent to input it was never meant to trust, within the bounds of OpenClaw's existing trusted-operator model.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	npm	<= 2026.5.5	`2026.5.6`
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade OpenClaw to the patched release 2026.5.6 or later, where the first stable fix ships. Until patched: restrict Mattermost bot access to trusted channels only, keep channel and tool allowlists narrow, avoid sharing a single Gateway between mutually untrusted users, and disable the affected Mattermost DM-gating feature entirely if it isn't required. For detection, review logs for Mattermost events with missing or malformed channel-type metadata and audit Gateway logs for messages that were processed outside the expected DM-only path — treat repeated metadata errors as a signal worth investigating rather than noise.

How is it classified?

Auth Bypass Privacy Violation Agent Plugin AML.T0051.001 - Indirect AML.T0093 - Prompt Infiltration via Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is GHSA-gp79-m99v-gjmh?

A patched OpenClaw bug (GHSA-gp79-m99v-gjmh) let Mattermost-sourced events skip the intended DM policy check whenever the event was missing channel-type metadata, so input that should have been restricted to trusted direct-message context could instead be processed as if it were allowed. This is a classic 'fail open' flaw (CWE-636) in an AI agent gateway's trust boundary, not a remote-code or data-exfiltration bug on its own, and the advisory explicitly scopes it to a specific feature rather than the whole trusted-operator model. Real-world urgency is low right now: it's not in CISA KEV, there's no EPSS score or public exploit/scanner template, and OpenSSF/dependent signals show only 4 downstream consumers, so this hasn't been weaponized or widely deployed against. Still, patch to 2026.5.6 promptly since any org running OpenClaw's Mattermost integration as an agent input channel is trusting that policy gate to keep untrusted chat traffic out of privileged agent context. Until patched, restrict bot access, keep channel/tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and watch logs for channel-metadata errors as a detection signal.

Is GHSA-gp79-m99v-gjmh actively exploited?

No confirmed active exploitation of GHSA-gp79-m99v-gjmh has been reported, but organizations should still patch proactively.

How to fix GHSA-gp79-m99v-gjmh?

Upgrade OpenClaw to the patched release 2026.5.6 or later, where the first stable fix ships. Until patched: restrict Mattermost bot access to trusted channels only, keep channel and tool allowlists narrow, avoid sharing a single Gateway between mutually untrusted users, and disable the affected Mattermost DM-gating feature entirely if it isn't required. For detection, review logs for Mattermost events with missing or malformed channel-type metadata and audit Gateway logs for messages that were processed outside the expected DM-only path — treat repeated metadata errors as a signal worth investigating rather than noise.

What systems are affected by GHSA-gp79-m99v-gjmh?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, chat/messaging integrations for AI agents.

What is the CVSS score for GHSA-gp79-m99v-gjmh?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworkschat/messaging integrations for AI agents

MITRE ATLAS Techniques

AML.T0051.001 Indirect

AML.T0093 Prompt Infiltration via Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

### Summary Mattermost handlers could fall open when channel type was missing. In affected versions, a Mattermost event missing channel type metadata could continue without applying the intended DM policy decision. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed. ### Impact When the affected feature is enabled and reachable, this could process a Mattermost event that should have been gated by channel policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. ### Patched Versions The first stable patched version is `2026.5.6`. ### Mitigations keep Mattermost bot access restricted and review channel metadata errors until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.

Exploitation Scenario

An operator has wired an OpenClaw Gateway into Mattermost so the agent only acts on messages arriving via direct message, relying on channel-type metadata to enforce that boundary. An adversary who can influence or intercept how a Mattermost event reaches the Gateway — for example via a malformed webhook payload, a client/integration bug, or a race condition that drops metadata — sends a message lacking channel-type information. Instead of being rejected or held to the stricter DM policy, the fail-open handler lets the event proceed as if it had passed the gate, so content from a less-trusted context reaches the agent's processing pipeline with elevated trust. Combined with any downstream weakness that treats trusted-channel input as instruction-worthy, this could become a stepping stone toward the agent acting on attacker-controlled input it should never have seen.

Weaknesses (CWE)

CWE-636 Not Failing Securely ('Failing Open') Primary

CWE-636 — Not Failing Securely ('Failing Open'): When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.