https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:30:14.762840+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41394 CVE-2026-41394 — OpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes 2026-10-05T18:30:14.797872+00:00

Affected: OpenClaw

OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators.

 https://cve.radiocsirt.org/vuln/ghsa-mhgq-xpfq-6r66 GHSA-mhgq-xpfq-6r66 — OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes 2026-10-05T18:30:14.797937+00:00

Affected: npm: openclaw

## Summary Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still gives auth:"plugin" routes operator WRITE_SCOPE, but impact should stay limited to plugin routes that actually touch privileged runtime actions before plugin auth completes.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `2a1db0c0f1fa375004a95ba0ef030534790a6d47` — 2026-04-01T00:20:49+09:00

OpenClaw thanks @davidluzsilva for reporting.