Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/03/03 11:12 p.m.14 views

OpenClaw's typed sender-key matching for toolsBySender prevents identity-collision policy bypass

Summary channels..groups..toolsBySender could match a privileged sender policy using a colliding mutable identity value for example senderName or senderUsername when deployments used untyped keys. The fix introduces explicit typed sender keys id:, e164:, username:, name:, keeps legacy untyped key...

6.5CVSS5.9AI score0.0019EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder