https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T17:47:16.594094+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-42439 BREW-openclaw-cli-CVE-2026-42439 — OpenClaw: Browser tabs action select and close routes bypassed SSRF policy 2026-10-04T17:47:16.597262+00:00

Affected: Homebrew: openclaw-cli

## Summary

Browser tabs action select and close routes bypassed SSRF policy.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The browser `/tabs/action` select and close branches could operate on targets without enforcing configured browser SSRF policy, weakening tab-level navigation protections.

## Technical Details

The fix enforces browser SSRF policy in the select and close tab-action branches.

## Fix

The issue was fixed in #63332. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `48c0347921b7e9438af0312968fc360ca88023f3` - PR: #63332

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @tdjackey for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-308562 EUVD-2026-308562 2026-10-04T17:47:16.597324+00:00 EUVD-2026-308562 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42439 fkie_cve-2026-42439 2026-10-04T17:47:16.597341+00:00

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured browser SSRF policy protections by exploiting the /tabs/action endpoint to perform unauthorized tab navigation operations.

 https://cve.radiocsirt.org/vuln/ghsa-rj2p-j66c-mgqh GHSA-rj2p-j66c-mgqh — OpenClaw: Browser tabs action select and close routes bypassed SSRF policy 2026-10-04T17:47:16.597371+00:00

Affected: npm: openclaw

## Summary

Browser tabs action select and close routes bypassed SSRF policy.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The browser `/tabs/action` select and close branches could operate on targets without enforcing configured browser SSRF policy, weakening tab-level navigation protections.

## Technical Details

The fix enforces browser SSRF policy in the select and close tab-action branches.

## Fix

The issue was fixed in #63332. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `48c0347921b7e9438af0312968fc360ca88023f3` - PR: #63332

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @tdjackey for reporting this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-04T17:47:16.597408+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.