Control Scope Bypass Vulnerability in OpenClaw: Focus Command Issue
Summary
GHSA-gw2c-6hcg-5g52: Duplicate Advisory: Focus command could miss controlScope enforcement. Affects openclaw versions < 2026.4.24. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source framework designed for building applications that require a gateway for managing various operations. It allows developers to create customizable solutions with a focus on modularity and extensibility. However, prior to version 2026.4.25, OpenClaw had a significant vulnerability related to the focus command, which could be exploited by authenticated users to bypass control scope enforcement.
Vulnerability Detail
The vulnerability in OpenClaw arises from a flaw in the focus command that allows authenticated users to execute commands without proper authorization checks. This control scope enforcement bypass could enable attackers to change the focus state outside their intended authority, leading to unauthorized operations depending on the gateway configuration and the trust levels of the input. The issue is classified under CWE-862, indicating a lack of proper authorization checks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the focus command by implementing additional authorization checks in your application logic until the package is updated.
Conclusion
The control scope bypass vulnerability in OpenClaw's focus command poses a significant risk to applications utilizing this framework. It is crucial for developers to update to the patched version to mitigate potential unauthorized operations. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows authenticated users to bypass control scope enforcement when using the focus command, potentially leading to unauthorized operations.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If exploited, attackers could perform unauthorized actions within the application, depending on the gateway configuration and input trust levels.
Yes, the vulnerability has been patched in version 2026.4.25 of OpenClaw. It is recommended to update to this version or later.
The CVSS score for this vulnerability is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
