https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T20:44:40.272069+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41385 BREW-openclaw-cli-CVE-2026-41385 — OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get 2026-10-04T20:44:40.275438+00:00

Affected: Homebrew: openclaw-cli

## Summary OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get

## Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: v2026.3.28 still models Nostr privateKey as plain string so config views can expose it, and the secret-schema fix is unreleased.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `57700d716f660591fb6e09727f3ca8041fa48b9d` — 2026-03-31T19:55:03+09:00

## Release Process Note - The fix is already present in released version `2026.3.31`. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @ccreater222 for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-307797 EUVD-2026-307797 2026-10-04T20:44:40.275497+00:00 EUVD-2026-307797 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41385 fkie_cve-2026-41385 2026-10-04T20:44:40.275514+00:00

OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations.

 https://cve.radiocsirt.org/vuln/ghsa-jjw7-3vjf-fg5j GHSA-jjw7-3vjf-fg5j — OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get 2026-10-04T20:44:40.275536+00:00

Affected: npm: openclaw

## Summary OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get

## Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: v2026.3.28 still models Nostr privateKey as plain string so config views can expose it, and the secret-schema fix is unreleased.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `57700d716f660591fb6e09727f3ca8041fa48b9d` — 2026-03-31T19:55:03+09:00

## Release Process Note - The fix is already present in released version `2026.3.31`. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @ccreater222 for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-04T20:44:40.275567+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.