https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:53:36.296516+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-34512 BREW-openclaw-cli-CVE-2026-34512 — OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding 2026-10-03T09:53:36.370313+00:00

Affected: Homebrew: openclaw-cli

## Summary

Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding.

## Details

The HTTP route previously treated any bearer-authenticated request as admin-eligible and could call without binding the action to requester ownership or caller-granted operator scopes. The flaw removes the bearer-token admin fallback and keeps remote session kills on the local-admin or requester-owned path only.

 https://cve.radiocsirt.org/vuln/cnvd-2026-21181 cnvd-2026-21181 2026-10-03T09:53:36.370395+00:00 cnvd-2026-21181 https://cve.radiocsirt.org/vuln/euvd-2026-329494 EUVD-2026-329494 2026-10-03T09:53:36.370414+00:00 EUVD-2026-329494 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34512 fkie_cve-2026-34512 2026-10-03T09:53:36.370427+00:00

OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. Attackers can exploit this by sending authenticated requests to kill arbitrary subagent sessions via the killSubagentRunAdmin function, bypassing ownership and operator scope restrictions.

 https://cve.radiocsirt.org/vuln/ghsa-h254-pw58-pj8j GHSA-h254-pw58-pj8j 2026-10-03T09:53:36.370450+00:00

OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. Attackers can exploit this by sending authenticated requests to kill arbitrary subagent sessions via the killSubagentRunAdmin function, bypassing ownership and operator scope restrictions.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0884 WID-SEC-W-2026-0884 — OpenClaw: Mehrere Schwachstellen 2026-10-03T09:53:36.370466+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte, einschließlich Administratorrechte, zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.