https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T06:49:20.857967+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-43578 BREW-openclaw-cli-CVE-2026-43578 — OpenClaw: Heartbeat owner downgrade missed local async exec completion events 2026-10-05T06:49:20.861224+00:00

Affected: Homebrew: openclaw-cli

## Summary

Heartbeat owner downgrade missed local async exec completion events.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.3.31 < 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

Local background exec completion text could be missed by heartbeat owner-downgrade detection, leaving a run in a more privileged context than intended after untrusted completion content.

## Technical Details

The fix expands exec-completion detection to local background exec formats and adds targeted tests.

## Fix

The issue was fixed in #64376. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `19a2e9ddb5a8a494abcba812bb11f51075026a27` - PR: #64376

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-309046 EUVD-2026-309046 2026-10-05T06:49:20.861287+00:00 EUVD-2026-309046 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43578 fkie_cve-2026-43578 2026-10-05T06:49:20.861304+00:00

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to leave a run in a more privileged context than intended.

 https://cve.radiocsirt.org/vuln/ghsa-mw7v-rxqg-f85m GHSA-mw7v-rxqg-f85m 2026-10-05T06:49:20.861327+00:00

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to leave a run in a more privileged context than intended.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-05T06:49:20.861343+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.