What is GHSA-5jgm-f9wr-9qm7?

GHSA-5jgm-f9wr-9qm7 is a security advisory published by GitHub Security Advisories with Medium severity. Duplicate Advisory: OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

Why does GHSA-5jgm-f9wr-9qm7 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-5jgm-f9wr-9qm7?

GHSA-5jgm-f9wr-9qm7 has a CVSS v3 base score of 5.0, published by GitHub Security Advisories.

Which products are affected by GHSA-5jgm-f9wr-9qm7?

GHSA-5jgm-f9wr-9qm7 affects 1 product, including: npm/openclaw:\u003c 2026.4.22.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: May 18, 2026

GHSA-5jgm-f9wr-9qm7MediumCVSS 5.0Disclosed before NVD

Duplicate Advisory: OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

Vendor

GitHub Security Advisories

Published

May 11, 2026

Last Modified

May 18, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-55cf-xx38-4p9p. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files.

🎯 Affected products1

npm/openclaw:< 2026.4.22

🔗 References (5)

https://github.com/openclaw/openclaw/security/advisories/GHSA-55cf-xx38-4p9p
https://nvd.nist.gov/vuln/detail/CVE-2026-45003
https://github.com/openclaw/openclaw/commit/0623079e98abf7202591f1b04a89755eb7ec9272
https://www.vulncheck.com/advisories/openclaw-connector-endpoint-host-override-via-workspace-dotenv-files
https://github.com/advisories/GHSA-5jgm-f9wr-9qm7