GHSA-5gjc-grvm-m88j
OpenClaw: Memory dreaming config persistence was reachable from operator.write commands
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
Memory dreaming config persistence was reachable from operator.write commands.
## Affected Packages / Versions
- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.4.5 < 2026.4.10`
- Patched versions: `>= 2026.4.10`
## Impact
A write-scoped gateway path could toggle persistent memory dreaming settings through `/dreaming`, crossing into an admin-class configuration mutation.
## Technical Details
The fix requires admin scope for persistent dreaming gateway toggles.
## Fix
The issue was fixed in #63872. The first stable tag containing the fix is `v2026.4.10`, and `[email protected]` includes the fix.
## Fix Commit(s)
- `6af17b39e11f5f35e23b7e5a5f71a7d0aa3c7310`
- PR: #63872
## Release Process Note
Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.
## Credits
Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
References
External links from the advisory. They lead to third-party sites.