What is GHSA-7jp6-r74r-995q?

GHSA-7jp6-r74r-995q is a security advisory published by GitHub Security Advisories with High severity. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools

Which CVE IDs does GHSA-7jp6-r74r-995q cover?

GHSA-7jp6-r74r-995q covers the following CVE IDs: CVE-2026-42433. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7jp6-r74r-995q?

GHSA-7jp6-r74r-995q has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-7jp6-r74r-995q?

GHSA-7jp6-r74r-995q affects 1 product, including: npm/openclaw:\u003c 2026.4.10.

GHSA-7jp6-r74r-995qHighCVSS 6.5

OpenClaw: Matrix profile config persistence was reachable from operator.write message tools

Vendor

GitHub Security Advisories

Published

April 17, 2026

Last Modified

May 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-42433 →

📋 Description

Summary

Matrix profile config persistence was reachable from operator.write message tools.

Affected Packages / Versions

Package: openclaw
Ecosystem: npm
Affected versions: < 2026.4.10
Patched versions: >= 2026.4.10

Impact

Gateway operator.write message-tool paths could reach Matrix profile persistence that should have required admin-level authority.

Technical Details

The fix gates Matrix profile updates for non-owner message-tool runs and prevents write-scoped callers from mutating persistent profile config.

Fix

The issue was fixed in #62662. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.

Fix Commit(s)

fe0f686c9228fffcec6de4011da45e69a6e23e54
PR: #62662

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

🎯 Affected products1

npm/openclaw:< 2026.4.10