3vulnerabilities
- Critical0 (0.0%)
- High2 (66.7%)
- Medium0 (0.0%)
- Moderate1 (33.3%)
- Low0 (0.0%)
openclaw-feishu
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 2 vulnerabilities
- Critical: 0
- High: 2
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting openclaw-feishu, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-g7fw-3gjp-g5hf | Moderate | OpenClaw: Channel read actions could skip target allowlists### Summary Channel read actions could skip target allowlists. In affected versions, explicit read targets in Microsoft Teams, Feishu, Matrix, and Google Chat could reach channels or rooms outside the configured read policy. This advisory is scoped to caller-supplied targets for message, reaction, pin, member, and related metadata reads in the named plugins. It does not change OpenClaw's trusted-operator model or create per-user isolation within one Gateway. ### Impact A lower-trust sender or steered agent with access to a channel read action could retrieve content or metadata from a targe |
| GitHub (opens in a new tab) | |
| GHSA-2q7j-2vhx-56g8 | High | OpenClaw Feishu tools could ignore per-account disablement### Summary Feishu tools could ignore per-account disablement. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed. ### Impact When the affected feature is enabled and reachable, t |
| GitHub (opens in a new tab) | |
| GHSA-w8wf-3qvj-6xqf | High | OpenClaw Feishu permission tools could ignore per-account disablement### Summary Feishu permission tools could ignore per-account disablement. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed. ### Impact When the affected feature is enabled and r |
| GitHub (opens in a new tab) |
- GHSA-g7fw-3gjp-g5hfModerateOpenClaw: Channel read actions could skip target allowlists
< 2026.8.1
### Summary Channel read actions could skip target allowlists. In affected versions, explicit read targets in Microsoft Teams, Feishu, Matrix, and Google Chat could reach channels or rooms outside the configured read policy. This advisory is scoped to caller-supplied targets for message, reaction, pin, member, and related metadata reads in the named plugins. It does not change OpenClaw's trusted-operator model or create per-user isolation within one Gateway. ### Impact A lower-trust sender or steered agent with access to a channel read action could retrieve content or metadata from a targe
CVE: CVE-2026-100582
- GHSA-2q7j-2vhx-56g8HighOpenClaw Feishu tools could ignore per-account disablement
< 2026.6.9
### Summary Feishu tools could ignore per-account disablement. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed. ### Impact When the affected feature is enabled and reachable, t
CVE: CVE-2026-62187
- GHSA-w8wf-3qvj-6xqfHighOpenClaw Feishu permission tools could ignore per-account disablement
< 2026.6.9
### Summary Feishu permission tools could ignore per-account disablement. In affected versions, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed. ### Impact When the affected feature is enabled and r
CVE: CVE-2026-62188