https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T09:52:46.474809+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-43573 BREW-openclaw-cli-CVE-2026-43573 — OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement 2026-10-05T09:52:46.478045+00:00

Affected: Homebrew: openclaw-cli

## Summary

Existing-session browser interaction routes bypassed SSRF policy enforcement.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

Existing-session browser interaction routes could continue interacting with or navigating targets without applying the same SSRF navigation guard used by guarded browser routes.

## Technical Details

The fix guards existing-session navigation and interaction routes with browser navigation policy checks.

## Fix

The issue was fixed in #64370. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `daeb74920d5ad986cb600625180037e23221e93a` - PR: #64370

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-308558 EUVD-2026-308558 2026-10-05T09:52:46.478110+00:00 EUVD-2026-308558 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43573 fkie_cve-2026-43573 2026-10-05T09:52:46.478126+00:00

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement.

 https://cve.radiocsirt.org/vuln/ghsa-527m-976r-jf79 GHSA-527m-976r-jf79 — OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement 2026-10-05T09:52:46.478149+00:00

Affected: npm: openclaw

## Summary

Existing-session browser interaction routes bypassed SSRF policy enforcement.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

Existing-session browser interaction routes could continue interacting with or navigating targets without applying the same SSRF navigation guard used by guarded browser routes.

## Technical Details

The fix guards existing-session navigation and interaction routes with browser navigation policy checks.

## Fix

The issue was fixed in #64370. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `daeb74920d5ad986cb600625180037e23221e93a` - PR: #64370

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-05T09:52:46.478183+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.