GHSA-qrp5-gfw2-gxv4 — MEDIUM AI Security Vulnerability

Q: What is GHSA-qrp5-gfw2-gxv4?

OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy

Q: Is GHSA-qrp5-gfw2-gxv4 actively exploited?

No confirmed active exploitation of GHSA-qrp5-gfw2-gxv4 has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-qrp5-gfw2-gxv4?

Update to patched version: openclaw 2026.4.20.

Q: What is the CVSS score for GHSA-qrp5-gfw2-gxv4?

No CVSS score has been assigned yet.

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `< 2026.4.20` - Patched version: `2026.4.20` ## Impact Bundled MCP and LSP tools could be appended to the agent's effective tool set after the normal tool-policy pipeline had already filtered core tools. If an...

Full CISO analysis pending enrichment.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
openclaw	npm	< 2026.4.20	`2026.4.20`
2 dependents 93% patched ~1d to patch Full package profile →

Do you use openclaw? You're affected.

Severity & Risk

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

Recommended Action

Patch available

Update openclaw to version 2026.4.20

Compliance Impact

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is GHSA-qrp5-gfw2-gxv4?

OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy

Is GHSA-qrp5-gfw2-gxv4 actively exploited?

No confirmed active exploitation of GHSA-qrp5-gfw2-gxv4 has been reported, but organizations should still patch proactively.

How to fix GHSA-qrp5-gfw2-gxv4?

Update to patched version: openclaw 2026.4.20.

What is the CVSS score for GHSA-qrp5-gfw2-gxv4?

No CVSS score has been assigned yet.

Technical Details

NVD Description

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `< 2026.4.20` - Patched version: `2026.4.20` ## Impact Bundled MCP and LSP tools could be appended to the agent's effective tool set after the normal tool-policy pipeline had already filtered core tools. If an operator configured a restrictive policy, such as a tool profile, explicit allow/deny list, owner-only tool restriction, sandbox tool policy, or subagent tool policy, a bundled MCP/LSP tool could remain available even though the same policy would have denied it. The issue required a configured bundled MCP or LSP tool source and an operator policy that should have restricted that tool. This was a local agent policy-enforcement bypass, not an unauthenticated remote gateway compromise. Severity is medium. ## Fix OpenClaw now applies a final effective tool policy pass to bundled MCP/LSP tools before merging them into the tool set used by normal runs and compaction. The pass covers profile policy, provider profile policy, global/agent/group policies, owner-only filtering, sandbox tool policy, and subagent tool policy. Fix commit: - `0e7a992d3f3155199c1acc2dd9a53c5b3a4d3ada` ## Release Fixed in OpenClaw `2026.4.20`.