https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:31:01.921486+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-32919 BREW-openclaw-cli-CVE-2026-32919 — OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent` 2026-10-03T15:31:02.020242+00:00

Affected: Homebrew: openclaw-cli

## Summary In affected versions of `openclaw`, a gateway caller with `operator.write` could issue `agent` requests containing `/new` or `/reset` and reach the same reset path used by the admin-only `sessions.reset` RPC.

## Impact On gateways where a caller is intentionally granted `operator.write` but not `operator.admin`, that caller could reset targeted conversation state through `agent` slash commands. This crosses the documented method-scope boundary between write-scoped messaging and admin-only session mutation.

## Affected Packages and Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.3.8` - Fixed in: `2026.3.11`

## Technical Details Scope checks were enforced only on the outer RPC method. The `agent` slash-command path reused admin-only reset logic internally, so a write-scoped caller could reach session-reset mutation without holding `operator.admin`.

## Fix OpenClaw no longer routes conversation `/new` and `/reset` through the admin-only `sessions.reset` entry point. Reset logic now lives in a shared service, while `sessions.reset` remains admin-only. The fix shipped in `openclaw@2026.3.11`.

## Workarounds Upgrade to `2026.3.11` or later.

 https://cve.radiocsirt.org/vuln/cnvd-2026-16685 cnvd-2026-16685 2026-10-03T15:31:02.020320+00:00 cnvd-2026-16685 https://cve.radiocsirt.org/vuln/euvd-2026-329468 EUVD-2026-329468 2026-10-03T15:31:02.020342+00:00 EUVD-2026-329468 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32919 fkie_cve-2026-32919 2026-10-03T15:31:02.020355+00:00

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with operator.write scope can issue agent requests containing /new or /reset slash commands to reset targeted conversation state without holding operator.admin privileges.

 https://cve.radiocsirt.org/vuln/ghsa-jgqj-5ggg-rgg4 GHSA-jgqj-5ggg-rgg4 2026-10-03T15:31:02.020379+00:00

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with operator.write scope can issue agent requests containing /new or /reset slash commands to reset targeted conversation state without holding operator.admin privileges.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0711 WID-SEC-W-2026-0711 — OpenClaw: Mehrere Schwachstellen 2026-10-03T15:31:02.020395+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.