Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
When Nextcloud Talk webhook signing was valid, replayed requests could be accepted without durable replay suppression, allowing duplicate inbound processing after replay-window expiry or process restart. Details OpenClaw's Nextcloud Talk webhook path verified HMAC(secret, random + body) but previously lacked durable replay state tied to webhook events. This allowed replay of a previously valid signed request in some operational conditions. The fix on main adds: - persistent per-account replay dedupe for Nextcloud Talk webhook events, - replay checks before webhook side effects (onMessage), - backend-origin validation against configured account base URL (when configured). Impact A captured valid signed webhook request could be replayed to trigger duplicate inbound handling. This is an integrity/availability issue (duplicate actions/noise), scoped to deployments using Nextcloud Talk webhook integration. Affected Packages / Versions - Package: openclaw (npm) - Affected: <=…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When tools.exec.safeBins contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries (for example python3, node, ruby) execute inline payloads via flags like -c. This requires explicit operator configuration to add such binaries to safeBins, so impact is limited to non-default/misconfigured deployments. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.21-2 - Patched in code: = 2026.2.22 (planned next npm release) Fix - Remove generic safe-bin fallback during allowlist evaluation. - Require explicit safe-bin profiles for safeBins entries. - Add configurable tools.exec.safeBinProfiles (global + per-agent) for safe custom binaries. - Update docs to clearly separate safeBins from command allowlist semantics. Fix Commit(s) - 47c3f742b6c488be26dd7b9636dbbb8676089154 Release Process Note patchedversions is pre-set to the planned next…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw versions 2026.2.22 and 2026.2.23, the optional synology-chat channel plugin had an authorization fail-open condition: when dmPolicy was allowlist and allowedUserIds was empty/unset, unauthorized senders were still allowed through to agent dispatch. This is assessed as medium severity because it requires channel/plugin setup and Synology sender access, but can still trigger downstream agent/tool actions. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: = 2026.2.22, <= 2026.2.23 - Latest published affected version at patch time: 2026.2.23 - Planned patched version: 2026.2.24 Details Root cause was a policy mismatch across plugin code paths: 1. Default resolved DM policy was allowlist. 2. Empty allowedUserIds was treated as allow-all. 3. Webhook auth in allowlist mode depended on that helper. Result: allowlist with empty list behaved like open access for inbound Synology senders. Fix Commit(s) - 0ee30361b8f6ef3f110f3a7b001da6dd3df96bb5 -…
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability OpenClaw reused gateway.auth.token (and gateway.remote.token) as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay=hash and commands.ownerDisplaySecret was unset. This created secret dual-use between gateway authentication and prompt metadata hashing. Impact - Auth-secret dual-use across security domains (gateway auth and prompt metadata hashing). - Hash outputs are visible to third-party model providers in system prompts. - No direct plaintext token disclosure. - Practical risk is highest when operators use weak gateway tokens and leave owner hash secret unset. Affected Packages / Versions - Package: openclaw (npm) - Latest affected published version: 2026.2.21-2 - Vulnerable range: <= 2026.2.21-2 - Patched version (planned next release): 2026.2.22 Affected Components - src/agents/cli-runner/helpers.ts - src/agents/pi-embedded-runner/run/attempt.ts - src/agents/pi-embedded-runner/compact.ts Remediation - Added a shared owner-display…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Webhook transform modules were validated with lexical path checks only. A symlink under the allowed hooks transform tree could resolve outside the intended directory and be dynamically imported. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.21-2 - Patched version (planned next release): 2026.2.22 Impact When an attacker can cause a transform module path to reference a symlinked entry that resolves outside the trusted transform directory, the gateway may import and execute unintended JavaScript with gateway-process privileges. Attack Preconditions - Hook transforms are enabled and reachable. - Attacker can influence transform path resolution (for example via privileged config access and/or writable filesystem path in the transform tree). - A symlink escape exists to attacker-controlled code. Remediation - Enforce realpath-aware containment for existing path ancestors before dynamic import. - Keep lexical containment checks for…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This issue applies to a non-default configuration only. If sort is manually added to tools.exec.safeBins, OpenClaw could treat sort --compress-program=<prog as valid safe-bin usage. In security=allowlist + ask=on-miss, this could satisfy allowlist checks and skip operator approval, while GNU sort may invoke an external program via --compress-program. Affected Packages / Versions - Ecosystem: npm - Package: openclaw - Affected: <= 2026.2.21-2 - Patched (planned next release): = 2026.2.22 Default Installations Default installs are not impacted by this specific path because sort is not included in default tools.exec.safeBins. Impact - Type: approval/allowlist bypass in optional safe-bin configuration - Scope: deployments that explicitly include sort in tools.exec.safeBins and use allowlist + ask=on-miss - Consequence: an external program may run under the OpenClaw process context without expected approval Technical Details - sort safe-bin profile allowed --compress-program as a…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw@2026.2.25, BlueBubbles group authorization could incorrectly treat DM pairing-store identities as group allowlist identities when dmPolicy=pairing and groupPolicy=allowlist. A sender that was only DM-paired (not explicitly present in groupAllowFrom) could pass group sender checks for message and reaction ingress. Per OpenClaw's SECURITY.md trust model, this is a constrained authorization-consistency issue, not a multi-tenant boundary bypass or host-privilege escalation. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version at triage time: 2026.2.25 - Affected versions: <= 2026.2.25 - Patched versions: = 2026.2.26 (planned next release) Technical Details Root cause was DM/group allowlist composition where DM pairing-store identities could flow into group authorization decisions. Fix approach: - centralize DM/group authorization composition via shared resolvers - remove local DM/group list recomposition at channel callsites - add…
Recommended action: Upgrade to 2026.2.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The voice-call Twilio webhook path accepted replay/dedupe identity from unsigned request metadata (i-twilio-idempotency-token), enabling replayed signed requests to bypass replay detection and manager dedupe by mutating only that header. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.25 (latest published npm version at triage time) - Fixed on main: commit 1aadf26f9acc399affabd859937a09468a9c5cb4 - Planned patched npm version: 2026.2.26 Impact Deployments using the optional voice-call Twilio webhook path could accept replayed webhook events as fresh events when an attacker had one valid signed request and changed only the unsigned idempotency header. Technical Details The fix removes unsigned-header trust from Twilio replay/dedupe identity and binds replay/manager dedupe to authenticated request material. It also threads a verified request identity through provider parsing so dedupe uses verification-derived identity rather than mutable…
Recommended action: Upgrade to 2026.2.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Three Dockerfiles in scripts/docker/ and scripts/e2e/ lack a USER directive, meaning all processes run as uid 0 (root). If any process is compromised, the attacker has root inside the container, making container breakout significantly easier. Partial fix (2026-02-08): Commit 28e1a65e added USER sandbox to Dockerfile.sandbox and Dockerfile.sandbox-browser. The E2E/test Dockerfiles listed below remain unpatched. Affected components: - scripts/e2e/Dockerfile - scripts/e2e/Dockerfile.qr-import - scripts/docker/install-sh-e2e/Dockerfile - scripts/docker/install-sh-nonroot/Dockerfile (runs as app but with NOPASSWD sudo — see related advisory) Technical Reproduction: 1. Open each Dockerfile listed above and search for a USER directive — none found. 2. Run any of these containers: docker run --rm -it <image id 3. Observe: returns uid=0(root). Demonstrated Impact: - Root inside the container enables kernel exploit attempts, volume mount abuse, and privileged syscall access. - Test images…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
tools.exec allowlist/safe-bins evaluation could diverge from runtime execution for wrapper commands using GNU env -S/--split-string semantics. This allowed policy checks to treat a command as a benign safe-bin invocation while runtime executed a different payload. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable versions: <= 2026.2.22-2 (latest currently published npm version) - Patched version (released): 2026.2.23 Impact An attacker able to influence tool command text (for example via untrusted prompt/content injection reaching an exec-capable flow) could bypass allowlist/safe-bins intent and execute unexpected commands. Technical Details Root cause was policy/runtime interpretation mismatch for dispatch wrappers: - analysis resolved an effective executable from wrapper-unwrapped argv, - execution could still run original wrapper argv semantics, - safe-bin short-flag handling also allowed unknown short options in clusters. Remediation The fix hardens exec…
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Microsoft Teams media handling used mixed fetch paths for Graph metadata/content and attachment auth-retry flows. Some paths bypassed the shared SSRF guard model and created inconsistent host/DNS enforcement across redirect/fetch hops. Affected Packages / Versions - Package: openclaw (npm) - Latest published vulnerable version: 2026.2.25 - Affected range: <= 2026.2.25 - Planned patched version for next release: 2026.2.26 Technical Details The Microsoft Teams attachment/media code previously relied on plugin-local fetch behavior in parts of the flow, instead of uniformly using shared guarded fetch logic with pinned DNS + policy checks. This could allow policy drift and SSRF boundary inconsistency between channel/plugin paths. The fix unifies this path by: - routing Microsoft Teams Graph message/hosted-content/attachment fetches through shared SSRF-guarded fetch paths, - routing auth-scope fallback attachment downloads through the same guarded policy model, - centralizing…
Recommended action: Upgrade to 2026.2.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This issue is a browser-origin WebSocket auth chain on local loopback deployments using password auth. It is serious, but conditional: an attacker must get the user to open a malicious page and then successfully guess the gateway password. Context and Preconditions OpenClaw’s web/gateway surface is designed for local use and trusted-operator workflows. In affected versions, a browser-origin client could combine three behaviors: - Origin checks not enforced for some non-Control-UI WebSocket client IDs. - Loopback auth attempts exempt from password-failure throttling. - Silent local pairing path available to browser-origin non-Control-UI clients. Successful exploitation requires all of the following: - Gateway reachable on loopback (default). - Password auth mode in use. - Victim opens attacker-controlled web content. - Password is guessable within feasible brute-force/dictionary attempts. Practical Impact If the password is guessed, an attacker can establish an authenticated operator…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw used left-most X-Forwarded-For values when requests came from configured trusted proxies. In proxy chains that append/preserve header values, this could let attacker-controlled header content influence security decisions tied to client IP. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.19-2 - Patched: 2026.2.21 (planned next release) Impact Possible client-IP spoofing in security-sensitive paths (for example auth rate-limit identity and local/private classification) for deployments behind trusted proxies with non-recommended forwarding behavior. Scope Note OpenClaw docs recommend reverse proxies overwrite (not append/preserve) inbound forwarding headers. This condition reduces severity. Fix Commit(s) - 07039dc089e51589a213ec0d16f8d6f2cd871fa1 - 8877bfd11ec7760b115b2d0d7500a45da2749747 Release Process Note patchedversions is pre-set to the planned next release (2026.2.21). After npm release is out, publish this advisory. OpenClaw thanks…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw versions up to and including 2026.2.22-2, a non-default exec-approval configuration could allow a skill-name collision to bypass an ask=on-miss prompt. When autoAllowSkills=true, a path-scoped executable such as ./skill-bin could resolve to basename skill-bin, satisfy the skills allowlist segment, and run without prompting for approval. Affected Packages / Versions - Package: npm openclaw - Affected versions: <= 2026.2.22-2 - Patched versions: = 2026.2.23 (released) Configuration Scope (Not Default) This behavior requires non-default settings and does not affect default installs. Required conditions: - autoAllowSkills=true (default is false) - system.run with security=allowlist - ask=on-miss Technical Details The allowlist evaluator accepted skills satisfaction by bin-name match, so ./skill-bin could match skillBins.has("skill-bin") after resolution. The fix hardens skill auto-allow matching by requiring: - a pathless invocation token (no / or \\), and - a trusted…
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
system.run environment sanitization allowed shell-startup env overrides (HOME, ZDOTDIR) that can execute attacker-controlled startup files before allowlist-evaluated command bodies. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.21-2 (latest published vulnerable version) - Planned patched version: = 2026.2.22 Technical Details In affected versions: - Env sanitization blocked many dangerous keys, but not startup-sensitive override keys (HOME, ZDOTDIR) in host exec env paths. - Shell-wrapper analysis for allowlist mode models command bodies, but not shell startup side effects. - Runtime execution used sanitized env, so attacker-provided startup-key overrides could run hidden startup payloads first. Observed exploit vectors: - HOME + bash -lc + malicious .bashprofile - ZDOTDIR + zsh -c + malicious .zshenv Fix Commit(s) - c2c7114ed39a547ab6276e1e933029b9530ee906 Release Process Note patchedversions is pre-set to the planned next release (=…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw accepted prototype-reserved keys in runtime /debug set override object values (proto, constructor, prototype). Impact /debug is disabled by default, and exploitation requires an already authorized /debug set caller. No unauthenticated vector was identified. This issue affects runtime in-memory overrides only (non-persistent and cleared on restart/reset). Given the required prior authorization boundary, this is treated as defense-in-depth hardening for command flag evaluation. Affected Packages / Versions - Package: openclaw (npm) - Latest published vulnerable version confirmed: 2026.2.19-2 - Vulnerable range: <= 2026.2.19-2 - Patched in planned next release: 2026.2.21 Technical Details - Runtime override merges now block reserved prototype keys during deep merge. - Runtime override writes now sanitize nested object values to remove reserved prototype keys before storing overrides. - Restricted command gates (bash, config, debug) now require own-property boolean…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A workspace-only file-system guard mismatch allowed @-prefixed absolute paths to bypass boundary validation in some tool path checks. Impact When tools.fs.workspaceOnly=true, certain @-prefixed absolute paths (for example @/etc/passwd) could be validated before canonicalization while runtime path handling normalized the prefix differently. In affected code paths this could permit reads outside the intended workspace boundary. Per SECURITY.md, OpenClaw is primarily a personal-assistant runtime with trusted-user assumptions, and this path is gated behind non-default sandbox/tooling configuration. That reduces practical exposure, but the bypass is still a security bug and is fixed. Affected Packages / Versions - Package: openclaw (npm) - Latest published at triage time: 2026.2.23 - Affected versions: <= 2026.2.23 - Patched versions: = 2026.2.24 Fix Commit(s) - 9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260 OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
BASHENV / ENV startup-file injection could lead to unintended pre-command shell execution when attacker-controlled environment values were admitted and then inherited by host command execution paths. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.19-2 - Fixed on main: 2cdbadee1f8fcaa93302d7debbfc529e19868ea4 - Planned patched release version: 2026.2.21 Details The fix hardens environment handling across all relevant execution paths: - Blocks dangerous startup/runtime env keys and prefixes in shared host env sanitization. - Sanitizes inherited ambient environment even when no per-request overrides are provided. - Blocks dangerous config-driven env injection before values enter process environment. - Uses the same sanitizer in macOS host execution paths. - Aligns skill env override sanitization with the shared dangerous-env policy. Impact Medium. Exploitation requires local/privileged influence over configuration or environment inputs; there is no…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The exported session HTML viewer allowed stored XSS when untrusted session content included raw HTML markdown tokens or unescaped metadata fields. Impact Opening a crafted exported HTML session could execute attacker-controlled JavaScript in the viewer context. This can expose session content in the page and enable phishing or UI spoofing in the trusted export view. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.22-2 - Patched version (released): = 2026.2.23 Technical Details The exporter rendered markdown with marked.parse(...) and inserted HTML via innerHTML, but did not override the html renderer token path. Raw HTML (for example <img ... onerror=...) was passed through. Additional tree/header metadata fields were interpolated without escaping in the export template. Reproduction 1. Create a session containing content like <img src=x onerror=alert(1). 2. Export the session to HTML. 3. Open the exported file. 4. Observe script…
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A sandbox path validation bypass in openclaw allows host file reads outside sandboxRoot via the media path fallback tmp flow when the fallback tmp root is a symlink alias. Affected Packages / Versions - Package: npm openclaw - Affected versions: <= 2026.2.24 - Latest published npm version at triage time (February 26, 2026): 2026.2.24 - Patched version : 2026.2.25 Details When /tmp/openclaw is unavailable or unsafe, resolvePreferredOpenClawTmpDir() in src/infra/tmp-openclaw-dir.ts fell back to os.tmpdir()/openclaw-<uid without verifying that fallback path was a trusted non-symlink directory. resolveSandboxedMediaSource() (src/agents/sandbox-paths.ts) allows absolute tmp media paths under the OpenClaw tmp root using lexical containment and alias checks. If the fallback tmp root is a symlink alias (for example to /), inputs like $TMPDIR/openclaw-<uid/etc/passwd can pass validation and resolve to host files outside sandboxRoot. Impact This can break sandbox media path confinement…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
tools.exec.safeBins allowlist checks could be bypassed by PATH-hijacked binaries, allowing execution of attacker-controlled trojan binaries under an allowlisted executable name. Affected Packages / Versions - Package: openclaw (npm) - Latest published version at triage time: 2026.2.17 - Affected range: = 2026.1.21 < 2026.2.18 - Patched version: 2026.2.19 Impact In allowlist mode, safeBins validation previously accepted a resolved executable path based on executable name and argument shape, without enforcing trusted executable directories. If an attacker could influence process PATH resolution before gateway startup (or otherwise control the gateway launch environment), a trojan binary with an allowlisted name (for example jq) could be executed. Severity Rationale This issue is rated medium because exploitation requires an additional precondition: influencing the gateway process PATH / launch environment. Request-scoped PATH injection is blocked for host execution. Fix…
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A command injection vulnerability exists in OpenClaw’s Linux systemd unit generation path. When rendering Environment= entries, attacker-controlled values are not rejected for CR/LF, and systemdEscapeArg() uses an incorrect whitespace-matching regex. This allows newline injection to break out of an Environment= line and inject standalone systemd directives (for example, ExecStartPre=). On service restart, the injected command is executed, resulting in local arbitrary command execution (local RCE) under the gateway service user. --- Details The issue is in src/daemon/systemd-unit.ts: - renderEnvLines(...) builds: - Environment=${systemdEscapeArg(${key}=${value})} - No CR/LF validation is enforced for environment keys/values before writing unit lines. - systemdEscapeArg(...) uses: - /[\\s"\\\\]/ - In this regex, \\s is interpreted as a literal backslash + s, not a whitespace character class. As a result, whitespace detection/quoting behavior is incorrect. Because systemd parses…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A trusted-proxy Control UI pairing bypass accepted client.id=control-ui without device identity checks. The bypass did not require operator role, so an authenticated node role session could connect unpaired and reach node event methods. Impact With trusted-proxy authentication enabled, a node role websocket client could skip pairing by using client.id=control-ui. That created an authorization boundary bypass from a node-scoped connection into node event execution flows. Affected Packages / Versions - Package: openclaw (npm) - Affected range: <= 2026.2.24 - Latest published vulnerable version: 2026.2.24 - Patched in next release: 2026.2.25 (pre-set below so this advisory is ready to publish after npm release) Fix The trusted-proxy Control UI bypass now additionally requires role === "operator". Fix Commit(s) - ec45c317f5d0631a3d333b236da58c4749ede2a3 Release Process Note patchedversions is intentionally pre-set to the release (2026.2.25). Advisory published with npm release…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A local process can capture the OpenClaw Gateway auth token from Chrome CDP probe traffic on loopback. Details Affected versions inject x-openclaw-relay-token for loopback CDP URLs, and CDP reachability probes send that header to /json/version. If an attacker controls the probed loopback port, they can read that token and reuse it as Gateway bearer auth. Relevant code paths (pre-fix): - src/browser/extension-relay.ts (getChromeExtensionRelayAuthHeaders) - src/browser/cdp.helpers.ts (getHeadersWithAuth) - src/browser/chrome.ts (fetchChromeVersion) Affected Packages / Versions - Package: openclaw (npm) - Latest published (at triage): 2026.2.21-2 - Vulnerable: <= 2026.2.21-2 - Patched: = 2026.2.22 Deployment Model Applicability This does not change OpenClaw’s documented security model for standard single-owner installs (you own the machine/VPS and trust local processes under that OS account boundary). Risk is for non-standard shared-user/shared-host installs where an untrusted…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A command injection vulnerability existed in Windows Scheduled Task script generation for OpenClaw. Environment values were written into gateway.cmd using unquoted set KEY=VALUE, which allowed Windows shell metacharacters in config-provided environment variables to break out of assignment context. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.17 - Patched version: = 2026.2.19 - Latest published vulnerable version at review time (2026-02-19): 2026.2.17 Practical Risk Context For a single-user, localhost-only setup on a personally controlled machine, practical risk is typically low. This issue becomes materially relevant when configuration or environment values are sourced from less-trusted inputs, for example: - shared/team config templates, - copied config snippets, - setup scripts, automation, or repos that write config, - any workflow where another party can influence env values before gateway install/reinstall. In those scenarios, it…
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.