https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T20:25:24.423626+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-43568 BREW-openclaw-cli-CVE-2026-43568 — OpenClaw: Memory dreaming config persistence was reachable from operator.write commands 2026-10-04T20:25:24.427402+00:00

Affected: Homebrew: openclaw-cli

## Summary

Memory dreaming config persistence was reachable from operator.write commands.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.4.5 < 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

A write-scoped gateway path could toggle persistent memory dreaming settings through `/dreaming`, crossing into an admin-class configuration mutation.

## Technical Details

The fix requires admin scope for persistent dreaming gateway toggles.

## Fix

The issue was fixed in #63872. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `6af17b39e11f5f35e23b7e5a5f71a7d0aa3c7310` - PR: #63872

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-321179 EUVD-2026-321179 2026-10-04T20:25:24.427473+00:00 EUVD-2026-321179 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43568 fkie_cve-2026-43568 2026-10-04T20:25:24.427489+00:00

OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming settings. Attackers with write-scoped gateway access can toggle admin-class configuration mutations through the /dreaming endpoint to escalate privileges.

 https://cve.radiocsirt.org/vuln/ghsa-5gjc-grvm-m88j GHSA-5gjc-grvm-m88j — OpenClaw: Memory dreaming config persistence was reachable from operator.write commands 2026-10-04T20:25:24.427513+00:00

Affected: npm: openclaw

## Summary

Memory dreaming config persistence was reachable from operator.write commands.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.4.5 < 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

A write-scoped gateway path could toggle persistent memory dreaming settings through `/dreaming`, crossing into an admin-class configuration mutation.

## Technical Details

The fix requires admin scope for persistent dreaming gateway toggles.

## Fix

The issue was fixed in #63872. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `6af17b39e11f5f35e23b7e5a5f71a7d0aa3c7310` - PR: #63872

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-04T20:25:24.427556+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.