{"answers":{"affected":"4 open source packages ship an affected version, including clawdbot and openclaw.","exploited":"There is no known exploitation of GHSA-chm2-m3w2-wcxm in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"GHSA-chm2-m3w2-wcxm is an authentication bypass vulnerability in clawdbot, published on 17 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-chm2-m3w2-wcxm and fix it if it is affected.\n\nWhat it is: GHSA-chm2-m3w2-wcxm is an authentication bypass vulnerability in clawdbot, published on 17 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-chm2-m3w2-wcxm in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- clawdbot (npm): affected all versions up to 2026.1.24-3; no fix listed\n- clawdbot (npm): affected all versions up to 2026.1.24-3; no fix listed\n- openclaw (npm): affected all versions; fixed in 2026.2.14\n- openclaw (npm): affected all versions; fixed in 2026.2.14\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-chm2-m3w2-wcxm/ (Markdown: https://insights.sbomify.com/GHSA-chm2-m3w2-wcxm/index.md)","id":"GHSA-chm2-m3w2-wcxm","markdown":"https://insights.sbomify.com/GHSA-chm2-m3w2-wcxm/index.md","name":"GHSA-chm2-m3w2-wcxm","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Google Chat extension","requires_auth":"high_privilege","summary":"Attackers with administrative control over identity lifecycle can bypass Google Chat allowlists by exploiting mutable email principal matching.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nGoogle Chat allowlisting supports matching by sender email in addition to immutable sender resource name (`users/\u003cid\u003e`). This weakens identity binding if a deployment assumes allowlists are strictly keyed by immutable principals.\n\n### Affected Packages / Versions\n(As of 2026-02-14; based on latest published npm versions)\n- `openclaw` (npm): `\u003c= 2026.2.13`\n- `clawdbot` (npm): `\u003c= 2026.1.24-3`\n\n### Details\nAffected component:\n- `extensions/googlechat/src/monitor.ts`\n\nThe `allowFrom` checks accept:\n- Immutable sender id (`users/\u003cid\u003e`)\n- Raw email (`alice@example.com`) for usability\n\nHistorically, `users/\u003cemail\u003e` was also treated as an email allowlist entry. This is now deprecated because it looks like an immutable ID but is actually a mutable principal.\n\n### Security Triage (2026-02-14)\nSeverity: **Low**\n\nRationale:\n- Requests are authenticated as coming from Google Chat (token verification), so this is not a generic unauthenticated spoofing vector.\n- A realistic exploit generally requires **Google Workspace / IdP administrative control** over identity lifecycle (e.g. reassigning an email address to a different underlying account) to obtain the same email with a different `users/\u003cid\u003e`.\n- With that level of access, the attacker typically has broader compromise paths.\n\nWe still treat it as a valid defense-in-depth report because accepting mutable principals in authorization decisions can increase risk in chained-failure scenarios.\n\n### Remediation / Behavior Changes\nGoal: preserve usability while reducing footguns.\n- Raw email allowlists remain supported.\n- `users/\u003cemail\u003e` is deprecated and treated as a **user id**, not as an email allowlist.\n- Documentation recommends `users/\u003cid\u003e` when strict immutable binding is required.\n\n### Fix Commit(s)\n- `c8424bf29a921e25663b29f308640b3d91a49432` (PR #16243)\n\nThanks @vincentkoc for reporting.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch","id":"GHSA-chm2-m3w2-wcxm","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":["2026.1.24-3"],"package":"clawdbot","purl":null,"source":"GHSA-chm2-m3w2-wcxm"},{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":["2026.1.24-3"],"package":"clawdbot","purl":"pkg:npm/clawdbot","source":"GHSA-chm2-m3w2-wcxm"},{"ecosystem":"npm","fixed":["2026.2.14"],"introduced":["0"],"last_affected":[],"package":"openclaw","purl":null,"source":"GHSA-chm2-m3w2-wcxm"},{"ecosystem":"npm","fixed":["2026.2.14"],"introduced":["0"],"last_affected":[],"package":"openclaw","purl":"pkg:npm/openclaw","source":"GHSA-chm2-m3w2-wcxm"}],"products":null,"published":"2026-02-17","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers with administrative control over identity lifecycle can bypass Google Chat allowlists by exploiting mutable email principal matching.","url":"https://insights.sbomify.com/GHSA-chm2-m3w2-wcxm/"}