What is GHSA-26gh-65q7-rfpf?

GHSA-26gh-65q7-rfpf is a security advisory published by GitHub Security Advisories with Medium severity. OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group...

Which CVE IDs does GHSA-26gh-65q7-rfpf cover?

GHSA-26gh-65q7-rfpf covers the following CVE IDs: CVE-2026-100566. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-26gh-65q7-rfpf?

GHSA-26gh-65q7-rfpf has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-26gh-65q7-rfpfMediumCVSS 6.5

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group...

Vendor

GitHub Security Advisories

Published

September 26, 2026

Last Modified

September 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-100566 →

📋 Description

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restrictions when DM access is broader than intended group access.

🔗 References (4)

https://github.com/openclaw/openclaw/security/advisories/GHSA-fgwg-c3wv-8f45
https://nvd.nist.gov/vuln/detail/CVE-2026-100566
https://www.vulncheck.com/advisories/openclaw-line-before-2026.8.1-access-control-inheritance
https://github.com/advisories/GHSA-26gh-65q7-rfpf