https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T21:26:05.299574+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41350 BREW-openclaw-cli-CVE-2026-41350 — OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations 2026-10-04T21:26:05.303591+00:00

Affected: Homebrew: openclaw-cli

## Summary `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real on shipped v2026.3.22: non-sandboxed session_status skipped the shared visibility guard, but this is a same-agent session-policy bypass with unreleased fix, not a broader host-boundary break.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `4d369a3400dc9b737fbe8daa63f09d909ce7beb8` — 2026-03-30T16:48:12+02:00

## Release Process Note - The fix is already present in released version `2026.3.31`. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @tdjackey for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-292949 EUVD-2026-292949 2026-10-04T21:26:05.303674+00:00 EUVD-2026-292949 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41350 fkie_cve-2026-41350 2026-10-04T21:26:05.303701+00:00

OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to enforce configured tools.sessions.visibility restrictions for unsandboxed invocations. Attackers can invoke session_status without sandbox constraints to bypass session-policy controls and access restricted session information.

 https://cve.radiocsirt.org/vuln/ghsa-cpjq-67p9-jx5h GHSA-cpjq-67p9-jx5h 2026-10-04T21:26:05.303735+00:00

OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to enforce configured tools.sessions.visibility restrictions for unsandboxed invocations. Attackers can invoke session_status without sandbox constraints to bypass session-policy controls and access restricted session information.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-04T21:26:05.303762+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.