PHP2Shell: Read our blog on the critical RCE vulnerabilities affecting 70% of the Internet
Wiz
Vulnerability DatabaseGHSA-v8qf-fr4g-28p2

GHSA-v8qf-fr4g-28p2: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: < 2026.4.20
  • Patched version: 2026.4.20

Impact

The Control UI assistant-media route authenticated trusted-proxy callers but did not enforce the declared operator scopes for identity-bearing HTTP auth paths. A trusted-proxy caller without operator.read could access assistant-media files and metadata that were otherwise inside allowed media roots. The route still required successful gateway authentication and media-root checks. Severity is low.

Fix

Assistant-media file and metadata requests now require operator.read on identity-bearing HTTP auth paths. Fix commit:

  • 99ef3a63c58440d53f8e45ad861b846032fcb036

Release

Fixed in OpenClaw 2026.4.20.

Source: NVD

Related OpenClaw (formerly Moltbot or Clawdbot) vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-107392HIGH7.5
  • JavaScript logoJavaScript
  • openclaw
NoYesOct 08, 2026
CVE-2026-107391HIGH7.5
  • JavaScript logoJavaScript
  • openclaw
NoYesOct 08, 2026
CVE-2026-101899MEDIUM6.9
  • JavaScript logoJavaScript
  • commercial-gitlab-rails-ee-19.1
NoYesOct 13, 2026
GHSA-3x84-qq85-fj65MEDIUM6.3
  • OpenClaw (formerly Moltbot or Clawdbot) logoOpenClaw (formerly Moltbot or Clawdbot)
  • openclaw
NoYesOct 21, 2026
CVE-2026-107389MEDIUM6.2
  • JavaScript logoJavaScript
  • openclaw
NoYesOct 08, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo