GHSA-grc3-2j34-p6gm: OpenClaw action forwarding

Q: Is GHSA-grc3-2j34-p6gm actively exploited?

No confirmed active exploitation of GHSA-grc3-2j34-p6gm has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-grc3-2j34-p6gm?

Upgrade to OpenClaw 2026.5.2 or later, the first patched version. Until patched: disable message action forwarding if not required, and where it must stay enabled, restrict or hard-code forwarding targets so model output cannot select an arbitrary (especially loopback) URL. Keep channel and tool allowlists narrow, avoid sharing one Gateway across mutually untrusted users or plugins, and audit any third-party skills/plugins that could supply action metadata. For detection, monitor for unexpected outbound connections to loopback/localhost addresses correlated with Gateway credential use, and review OpenClaw skill/plugin sources given the broader ecosystem history of malicious skills (AIID #1368).

Q: What systems are affected by GHSA-grc3-2j34-p6gm?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI gateway / orchestration, tool and plugin invocation pipelines.

Q: What is the CVSS score for GHSA-grc3-2j34-p6gm?

No CVSS score has been assigned yet.

CISO Take

OpenClaw's message.action forwarding feature can be manipulated by model-controlled metadata to redirect Gateway credentials and action payloads to an attacker-chosen loopback URL, effectively handing a local listener a live authentication token. This is scoped to a named feature and doesn't break OpenClaw's broader trusted-operator model, but any deployment with lower-trust input reaching the action-selection path is exposed regardless of that boundary. There's no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, and only 4 known downstream dependents, so this reads as low current exploitation pressure rather than an active-threat scenario. Patch to OpenClaw 2026.5.2 or later; until then, disable message action forwarding where not needed, block model-supplied loopback targets, and keep channel/tool allowlists narrow, especially on Gateways shared across mutually untrusted users.

Sources: GitHub Advisory ATLAS

What is the risk?

Medium severity is appropriate: the flaw requires the affected feature to be enabled and reachable, and practical exploitation depends on whether lower-trust input (e.g., prompt injection or an untrusted plugin) can influence the action metadata that selects the loopback target. No CVSS vector, EPSS score, KEV listing, or public PoC/Nuclei template exists, so there's no evidence of active or imminent exploitation. However, the underlying weakness (CWE-522, insufficiently protected credentials) has high-value impact if triggered — Gateway credentials are a pivot point for further access — so risk should be treated as 'contained but not negligible' until patched, particularly on shared or multi-tenant Gateways.

How does the attack unfold?

Influence action metadata

Adversary gains the ability to influence model-controlled action metadata via a malicious skill, plugin, or indirect prompt injection reaching the action-selection path.

AML.T0051.001

Select malicious loopback target

The crafted action metadata specifies an attacker-controlled loopback URL as the destination for message.action forwarding.

AML.T0053

Credential forwarding

OpenClaw's Gateway forwards the action payload along with Gateway credentials to the model-selected loopback listener.

AML.T0086

Credential capture and misuse

The attacker-controlled local listener captures the exposed Gateway credentials, enabling reuse for further unauthorized access.

AML.T0055

Influence action metadata

Adversary gains the ability to influence model-controlled action metadata via a malicious skill, plugin, or indirect prompt injection reaching the action-selection path.

AML.T0051.001

Select malicious loopback target

The crafted action metadata specifies an attacker-controlled loopback URL as the destination for message.action forwarding.

AML.T0053

Credential forwarding

OpenClaw's Gateway forwards the action payload along with Gateway credentials to the model-selected loopback listener.

AML.T0086

Credential capture and misuse

The attacker-controlled local listener captures the exposed Gateway credentials, enabling reuse for further unauthorized access.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	npm	<= 2026.4.29	`2026.5.2`
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade to OpenClaw 2026.5.2 or later, the first patched version. Until patched: disable message action forwarding if not required, and where it must stay enabled, restrict or hard-code forwarding targets so model output cannot select an arbitrary (especially loopback) URL. Keep channel and tool allowlists narrow, avoid sharing one Gateway across mutually untrusted users or plugins, and audit any third-party skills/plugins that could supply action metadata. For detection, monitor for unexpected outbound connections to loopback/localhost addresses correlated with Gateway credential use, and review OpenClaw skill/plugin sources given the broader ecosystem history of malicious skills (AIID #1368).

How is it classified?

Data Leakage Auth Bypass Agent Framework AML.T0051.001 - Indirect AML.T0053 - AI Agent Tool Invocation AML.T0055 - Unsecured Credentials AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system operational security controls

NIST AI RMF

MANAGE 4.1 - Risk treatment and monitoring for deployed AI systems

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is GHSA-grc3-2j34-p6gm?

OpenClaw's message.action forwarding feature can be manipulated by model-controlled metadata to redirect Gateway credentials and action payloads to an attacker-chosen loopback URL, effectively handing a local listener a live authentication token. This is scoped to a named feature and doesn't break OpenClaw's broader trusted-operator model, but any deployment with lower-trust input reaching the action-selection path is exposed regardless of that boundary. There's no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, and only 4 known downstream dependents, so this reads as low current exploitation pressure rather than an active-threat scenario. Patch to OpenClaw 2026.5.2 or later; until then, disable message action forwarding where not needed, block model-supplied loopback targets, and keep channel/tool allowlists narrow, especially on Gateways shared across mutually untrusted users.

Is GHSA-grc3-2j34-p6gm actively exploited?

No confirmed active exploitation of GHSA-grc3-2j34-p6gm has been reported, but organizations should still patch proactively.

How to fix GHSA-grc3-2j34-p6gm?

Upgrade to OpenClaw 2026.5.2 or later, the first patched version. Until patched: disable message action forwarding if not required, and where it must stay enabled, restrict or hard-code forwarding targets so model output cannot select an arbitrary (especially loopback) URL. Keep channel and tool allowlists narrow, avoid sharing one Gateway across mutually untrusted users or plugins, and audit any third-party skills/plugins that could supply action metadata. For detection, monitor for unexpected outbound connections to loopback/localhost addresses correlated with Gateway credential use, and review OpenClaw skill/plugin sources given the broader ecosystem history of malicious skills (AIID #1368).

What systems are affected by GHSA-grc3-2j34-p6gm?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI gateway / orchestration, tool and plugin invocation pipelines.

What is the CVSS score for GHSA-grc3-2j34-p6gm?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI gateway / orchestrationtool and plugin invocation pipelines

MITRE ATLAS Techniques

AML.T0051.001 Indirect

AML.T0053 AI Agent Tool Invocation

AML.T0055 Unsecured Credentials

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

### Summary message.action forwarding could send Gateway credentials to model-supplied loopback URLs. In affected versions, model-controlled action metadata that selects a loopback Gateway URL could forward the action payload with Gateway credentials to the supplied loopback URL. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed. ### Impact When the affected feature is enabled and reachable, this could expose the token and action payload to a local listener chosen through the affected path. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. ### Patched Versions The first stable patched version is `2026.5.2`. ### Mitigations restrict message action forwarding and avoid model-supplied loopback targets until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.

Exploitation Scenario

An adversary who can influence model output — via a malicious or compromised third-party skill, an indirect prompt injection in ingested content, or a lower-trust channel that reaches the action-selection path — crafts action metadata specifying a loopback URL under their control (e.g., a listener on 127.0.0.1 bound by a co-located malicious process). When OpenClaw's message.action forwarding processes this metadata, it forwards the action payload along with Gateway credentials to that attacker-controlled loopback endpoint. The local listener captures the token, which the attacker can then reuse to impersonate the Gateway or access whatever resources the credential authorizes — all without crossing OpenClaw's normal authenticated-operator boundary, since the forwarding itself is the vulnerability.

Weaknesses (CWE)

CWE-522 Insufficiently Protected Credentials Primary

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.