PT-2026-37319

Published

2026-04-25

·

Updated

2026-04-25

Description by

CVSS 4.0
6.9
Medium
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: < 2026.4.20
  • Patched version: 2026.4.20

Impact

Templated hook mapping sessionKey values were treated differently from request-supplied session keys. A hook mapping could render an externally influenced session key even when hooks.allowRequestSessionKey was disabled, bypassing the intended routing opt-in for hook callers.
This affects webhook routing isolation. It does not grant host execution by itself. Severity is medium.

Fix

Template-rendered mapping session keys are now treated as externally supplied routing input and require hooks.allowRequestSessionKey=true plus the existing prefix policy checks.
Fix commit:
  • 5275d008ed33203dba3f98e969ad683a65c416c3

Release

Fixed in OpenClaw 2026.4.20.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-639: Authorization Bypass Through User-Controlled Key
Related identifiers
GHSA-2XCP-X87W-Q377
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com