https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T22:15:08.144469+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-42433 BREW-openclaw-cli-CVE-2026-42433 — OpenClaw: Matrix profile config persistence was reachable from operator.write message tools 2026-10-04T22:15:08.149590+00:00

Affected: Homebrew: openclaw-cli

## Summary

Matrix profile config persistence was reachable from operator.write message tools.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

Gateway `operator.write` message-tool paths could reach Matrix profile persistence that should have required admin-level authority.

## Technical Details

The fix gates Matrix profile updates for non-owner message-tool runs and prevents write-scoped callers from mutating persistent profile config.

## Fix

The issue was fixed in #62662. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `fe0f686c9228fffcec6de4011da45e69a6e23e54` - PR: #62662

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-308563 EUVD-2026-308563 2026-10-04T22:15:08.149663+00:00 EUVD-2026-308563 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42433 fkie_cve-2026-42433 2026-10-04T22:15:08.149680+00:00

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner message-tool runs.

 https://cve.radiocsirt.org/vuln/ghsa-7jp6-r74r-995q GHSA-7jp6-r74r-995q — OpenClaw: Matrix profile config persistence was reachable from operator.write message tools 2026-10-04T22:15:08.149704+00:00

Affected: npm: openclaw

## Summary

Matrix profile config persistence was reachable from operator.write message tools.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

Gateway `operator.write` message-tool paths could reach Matrix profile persistence that should have required admin-level authority.

## Technical Details

The fix gates Matrix profile updates for non-owner message-tool runs and prevents write-scoped callers from mutating persistent profile config.

## Fix

The issue was fixed in #62662. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `fe0f686c9228fffcec6de4011da45e69a6e23e54` - PR: #62662

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-04T22:15:08.149739+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.