https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T02:38:59.159543+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-43566 BREW-openclaw-cli-CVE-2026-43566 — OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events 2026-10-05T02:38:59.249800+00:00

Affected: Homebrew: openclaw-cli

## Summary

Heartbeat owner downgrade missed untrusted webhook wake events.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.4.7 < 2026.4.14` - Patched versions: `>= 2026.4.14`

## Impact

Heartbeat owner downgrade logic could skip webhook wake events carrying untrusted content, preserving owner-like execution context where the run should have been downgraded.

## Technical Details

The fix includes wake and hook event reasons in owner-downgrade inspection and forces downgrade for untrusted hook wake events.

## Fix

The issue was fixed in #66031. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `31281bc92f55796817a92bc43f722cba1e77ab42` - PR: #66031

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-308580 EUVD-2026-308580 2026-10-05T02:38:59.249874+00:00 EUVD-2026-308580 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43566 fkie_cve-2026-43566 2026-10-05T02:38:59.249891+00:00

OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content. Attackers can exploit this by sending untrusted webhook wake events to preserve owner-like execution context when the run should have been downgraded.

 https://cve.radiocsirt.org/vuln/ghsa-g2hm-779g-vm32 GHSA-g2hm-779g-vm32 — OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events 2026-10-05T02:38:59.249915+00:00

Affected: npm: openclaw

## Summary

Heartbeat owner downgrade missed untrusted webhook wake events.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.4.7 < 2026.4.14` - Patched versions: `>= 2026.4.14`

## Impact

Heartbeat owner downgrade logic could skip webhook wake events carrying untrusted content, preserving owner-like execution context where the run should have been downgraded.

## Technical Details

The fix includes wake and hook event reasons in owner-downgrade inspection and forces downgrade for untrusted hook wake events.

## Fix

The issue was fixed in #66031. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `31281bc92f55796817a92bc43f722cba1e77ab42` - PR: #66031

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-05T02:38:59.249950+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.