What is GHSA-4gx2-8r4q-vj5x?

GHSA-4gx2-8r4q-vj5x is a security advisory published by GitHub Security Advisories with High severity. OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file...

Which CVE IDs does GHSA-4gx2-8r4q-vj5x cover?

GHSA-4gx2-8r4q-vj5x covers the following CVE IDs: CVE-2026-100529. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4gx2-8r4q-vj5x?

GHSA-4gx2-8r4q-vj5x has a CVSS v3 base score of 6.4, published by GitHub Security Advisories.

GHSA-4gx2-8r4q-vj5xHighCVSS 6.4

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file...

Vendor

GitHub Security Advisories

Published

September 26, 2026

Last Modified

September 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-100529 →

📋 Description

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different nodes beyond the operator's original approval scope.

🔗 References (4)

https://github.com/openclaw/openclaw/security/advisories/GHSA-7jfq-rmfm-29wp
https://nvd.nist.gov/vuln/detail/CVE-2026-100529
https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-authorization-scope-widening-via-file-transfer
https://github.com/advisories/GHSA-4gx2-8r4q-vj5x