https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:47:15.608498+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-32924 BREW-openclaw-cli-CVE-2026-32924 — OpenClaw: Feishu reaction events could bypass group authorization and mention gating 2026-10-03T19:47:15.683001+00:00

Affected: Homebrew: openclaw-cli

### Summary

A Feishu reaction-originated synthetic event could misclassify a group conversation as `p2p` when the inbound reaction payload omitted `chat_type`. Authorization and mention-gating logic keyed off that incorrect chat type and evaluated the event as a direct message instead of a group message.

### Impact

This could bypass `groupAllowFrom` and `requireMention` protections for reaction-derived events in Feishu group chats.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Reaction events now preserve the correct group context before authorization and mention-gate evaluation. Users should update to `2026.3.12` or later.

 https://cve.radiocsirt.org/vuln/cnvd-2026-16695 cnvd-2026-16695 2026-10-03T19:47:15.683068+00:00 cnvd-2026-16695 https://cve.radiocsirt.org/vuln/euvd-2026-329473 EUVD-2026-329473 2026-10-03T19:47:15.683087+00:00 EUVD-2026-329473 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32924 fkie_cve-2026-32924 2026-10-03T19:47:15.683100+00:00

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass groupAllowFrom and requireMention protections in group chat reaction-derived events.

 https://cve.radiocsirt.org/vuln/ghsa-988c-qpg2-7hpv GHSA-988c-qpg2-7hpv 2026-10-03T19:47:15.683123+00:00

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass groupAllowFrom and requireMention protections in group chat reaction-derived events.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0711 WID-SEC-W-2026-0711 — OpenClaw: Mehrere Schwachstellen 2026-10-03T19:47:15.683139+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.