OpenClaw Vulnerability: Empty Approver Lists Granting Unauthorized Approval
Summary
GHSA-49cg-279w-m73x: OpenClaw: Empty approver lists could grant explicit approval authorization. Affects openclaw versions < 2026.4.12. Fixed in 2026.4.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an npm package designed to facilitate communication and approval processes in software applications. It allows users to manage approvals through helper-backed channels, ensuring that only authorized senders can resolve pending approvals. However, a critical vulnerability was identified where empty approver lists could inadvertently grant explicit approval authorization, posing a risk to the integrity of the approval process.
Vulnerability Detail
The vulnerability arises from the interpretation of empty approver lists as explicit approval authorization. This flaw allows unauthorized senders to resolve pending approvals if they possess the approval ID, bypassing the normal authorization checks. The technical details indicate that the fix prevents such empty lists from granting unauthorized access and includes regression tests to cover unauthorized sender scenarios.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.4.12
This is the first release that contains the fix.
npm install openclaw@2026.4.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as described above.
Conclusion
The OpenClaw vulnerability related to empty approver lists poses a significant risk by allowing unauthorized approval resolutions. Users are strongly advised to upgrade to the patched versions to ensure the security of their applications and maintain the integrity of the approval process.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows empty approver lists to be interpreted as explicit approval authorization, enabling unauthorized users to resolve pending approvals.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.0, indicating a moderate severity level.
While there are no specific workarounds, it is crucial to plan for an update to the patched version as soon as possible to mitigate the risk.
The vulnerability was reported by a user identified as @anshumanbh.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
