https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T21:44:03.297847+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41333 BREW-openclaw-cli-CVE-2026-41333 — OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting 2026-10-04T21:44:03.370637+00:00

Affected: Homebrew: openclaw-cli

## Summary Fake DeviceToken Bypasses Shared Auth Rate Limiting

## Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: Real in shipped mixed WS auth flow, but practical risk is mostly weak shared-password deployments since strong shared tokens remain non-bruteforceable.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `af0c0862f22ca4492406a3103d05e3628f94cbe9` — 2026-03-31T09:08:57+09:00

## Release Process Note - The fix is already present in released version `2026.3.31`.

OpenClaw thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-292883 EUVD-2026-292883 2026-10-04T21:44:03.370703+00:00 EUVD-2026-292883 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41333 fkie_cve-2026-41333 2026-10-04T21:44:03.370720+00:00

OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authentication flow to bypass rate limiting controls and conduct brute force attacks against weak shared passwords.

 https://cve.radiocsirt.org/vuln/ghsa-6p8r-6m93-557f GHSA-6p8r-6m93-557f — OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting 2026-10-04T21:44:03.370743+00:00

Affected: npm: openclaw

## Summary Fake DeviceToken Bypasses Shared Auth Rate Limiting

## Current Maintainer Triage - Status: narrow - Normalized severity: low - Assessment: Real in shipped mixed WS auth flow, but practical risk is mostly weak shared-password deployments since strong shared tokens remain non-bruteforceable.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `af0c0862f22ca4492406a3103d05e3628f94cbe9` — 2026-03-31T09:08:57+09:00

## Release Process Note - The fix is already present in released version `2026.3.31`.

OpenClaw thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-04T21:44:03.370774+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.