PT-2026-37319
تاريخ النشر
2026-04-25
·
تاريخ التحديث
2026-04-25
الوصف من
CVSS 4.0
6.9
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
< 2026.4.20 - Patched version:
2026.4.20
Impact
Templated hook mapping
sessionKey values were treated differently from request-supplied session keys. A hook mapping could render an externally influenced session key even when hooks.allowRequestSessionKey was disabled, bypassing the intended routing opt-in for hook callers.This affects webhook routing isolation. It does not grant host execution by itself. Severity is medium.
Fix
Template-rendered mapping session keys are now treated as externally supplied routing input and require
hooks.allowRequestSessionKey=true plus the existing prefix policy checks.Fix commit:
5275d008ed33203dba3f98e969ad683a65c416c3
Release
Fixed in OpenClaw
2026.4.20. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾