{"id":186,"date":"2026-10-29T07:36:20","date_gmt":"2026-10-29T07:36:20","guid":{"rendered":"https:\/\/bugskan.com\/?p=186"},"modified":"2026-10-29T07:36:20","modified_gmt":"2026-10-29T07:36:20","slug":"openclaw-log-poisoning-advisory-depends-on-how-an-assistant-later-reads-the-logs","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/openclaw-log-poisoning-advisory-depends-on-how-an-assistant-later-reads-the-logs\/","title":{"rendered":"OpenClaw log-poisoning advisory depends on how an assistant later reads the logs"},"content":{"rendered":"<p>OpenClaw\u2019s advisory describes unsanitized WebSocket header values being written to gateway logs. An unauthenticated client able to reach the gateway could place crafted content into those records.<\/p>\n<p>The prompt-injection risk arises when an LLM or automation later interprets the logs. The maintainer rates the issue Low and says impact is limited when logs are not fed into such workflows, correcting more dramatic secondary headlines.<\/p>\n<p>Versions through 2026.2.12 are listed as affected, with 2026.2.13 patched. Use a maintained release, restrict gateway exposure and treat logs as untrusted data during AI-assisted debugging. Never let log text itself authorize commands.<\/p>\n<p><a href=\"https:\/\/github.com\/openclaw\/openclaw\/security\/advisories\/GHSA-g27f-9qjv-22pm\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The maintainer rates this issue Low, with a fix in 2026.2.13; it is not a direct, universal code-execution flaw.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_7e485fa9aa5807","bugskan_event_type":"vulnerability","bugskan_response":"REVIEW","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"high","bugskan_affected_scope":"Gateway log-header handling through OpenClaw 2026.2.12 and downstream AI log interpretation.","bugskan_recommended_next_step":"Update OpenClaw and keep log-derived text outside command-approval boundaries.","bugskan_who_should_check":"","bugskan_material_updated_at":"2026-02-14T00:00:00Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[2],"bugskan_technology":[46],"class_list":["post-186","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-security-brief","bugskan_technology-openclaw"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/186","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=186"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/186\/revisions"}],"predecessor-version":[{"id":413,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/186\/revisions\/413"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=186"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=186"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=186"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=186"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=186"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}